Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden SDK relicensed from proprietary to GPLv3

github.com

Post reply on HN
Print view View original

341–350 of 381 posts

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#341

Post by chickahoona »

zie wrote: post #277
creesch wrote: post #248

Earlier quoted context omitted.

Are there other alternatives that are 1) open source 2) offer the same integration to begin with and finally 3) have been audited or are popular enough to be under constant scrutiny? There is of course the KeePass ecosystem, but that is why I included my second point, as with KeePass you are responsible for vault syncing, having clients for all platforms, etc. I suppose that it is good to be aware of other options. A…

I have no affiliation, just found them this week, but https://psono.com/ exists. So 1 and 2 are met and 3 is half-way there maybe? It's a self-audit but they have been around a while. Apache2 licensed. Again, I literally found them the other day, and other than a cursory check to make sure the UI/UX is friendly enough to compete with BW or 1P, I haven't had a chance to look through their code at all yet. I have no id…

Hi, Sascha here, the main developer behind Psono. Psono has been audited multiple times so far, usually on a yearly bases. The last one here https://psono.com/blog/security-audit-2024 (you will also find a link to the audit itself)

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#342

Post by EasyMark »

solarkraft wrote: post #282

I’m relieved. Maybe the company would have survived this somehow, but they sure wouldn’t have been the techies’ darling anymore and that was going to be expensive. I hope they realized that being FOSS is their moat and it nets them a lot of goodwill (it’s the whole reason I bother with their not-quite-the-best product in the first place). The bold claim „the most trusted password manager“ was kind of justifiable whil…

Eh it’s not as good as never having the OSS’ness of it challenged but it also shows they’re open to feedback and willing to reassess when customers get out the pitchforks and torches. It’s a story as old as time.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#343

Post by EasyMark »

_bin_ wrote: post #335
apitman wrote: post #325

Earlier quoted context omitted.

I'm cautiously optimistic, but still concerned about the long term. * I just don't see how taking $100 million can be good for users in the long run. By far the most likely outcomes are bloat or enshittification. * bitwarden does not appear to be very forkable, ie it's a complex system written in C#. The existence of Vaultwarden helps a lot with this, but what about the client apps? Forkability is the second most imp…

The client apps can pretty easily be forked and maintained. We probably wouldn't see much feature growth but I also don't think we need that so much. Lots of OSS projects have been messed up by fundraising and communities often just fork them and keep them around so I'm not too worried. Besides, garbage features could probably just be unsupported by Vaultwarden, which has worked extremely well for me and been nothing…

I hope that they keep it a password manager and don’t try to turn it into a “security multitool” or something. I like it how it is. They’ve been careful about adding things and I appreciate that. If they wanted to say move from an electron app to a qt or tauri app I could appreciate that as well.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#344

Post by EasyMark »

spl757 wrote: post #310
ryukafalz wrote: post #230

Earlier quoted context omitted.

Yeah, likewise. I'm a Bitwarden subscriber but I'd been looking into alternatives recently because of the licensing kerfuffle. But switching password managers is a pain, so I'm glad to not feel like I have to now.

KeePassXC (and I assume the other versions) can import an encrypted JSON Password Protected (NOT Account Restricted) export from Bitwarden. I use them both. I have KeePassXC for my local machine, and Bitwarden for things I may need out and about. With the browser plugins for both it's not that hard to manage them both, at least in my opinion. I was hoping to see some course correction on this from Bitwarden, even if…

There is little chance I’ll ever move to keepassxc as that requires me to maintain it myself and take the chance on deleting something very precious. I’ll stick with the cloud solutions for now.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#345

Post by dcow »

lxgr wrote: post #319
dcow wrote: post #73

Earlier quoted context omitted.

The only true 2nd factor is a setup where your totp codes live on a separate piece of physical hardware. If your totp codes are in an app on your phone, and your password is in a different app on your phone, you're not pure 2nd factor despite convincing yourself that you are. Anything that is convenient is not real 2FA. Real 2FA needs to be pick two of: a password in your head, a verifiable biometric signature, a cod…

> Anything that is convenient is not real 2FA. That's a pretty user-hostile attitude. Sure, some combinations of factors are pretty unergonomic, but I'd call that a bug, not a feature. It's also incorrectly suggesting that somehow complexity/painful usability automatically yields security, while usually the opposite is true: An effective secure authentication solution absolutely must consider usability, or it's doome…

I’m speaking to how things are practically implemented, not making a statement about ideals.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#346

Post by dcow »

freedomben wrote: post #333
dcow wrote: post #324

Earlier quoted context omitted.

No I’m specifically not. Did you read my 2nd paragraph? It’s essentially your argument here. The person I was responding to was arguing that totp in pw manager is no good. Maybe you meant to reply to them and not me?

I did read your second paragraph. There is some ambiguity, but I ultimately decided you weren't agreeing with me because you said (emphasis added): > I think 99.999% of the time storing your 2FA codes in your PW manager , or just moving on to Passkeys, is the right answer. If you're storing your 2FA codes in your PW manager, then you're NOT using separate apps. You're using the same app (your PW manager). My argument…

I may be arguing for (3) but then I’m not letting the perfect be the enemy of the good. I don’t fancy the security types that do that.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#348

Post by Dylan16807 »

teo_zero wrote: post #106
freeone3000 wrote: post #47

Earlier quoted context omitted.

I store the password vault in dropbox. Done.

> store the password vault in dropbox No local backup? Do you rely on the network working all the time? I do something similar on the mobile phone (the reasining is, if there's no network, there's nothing I need to login to) but I also keep a local copy on my laptop (that I sometimes operate with limited connectivity). Without any automatic syncing, one of the two copies will be stale.

> No local backup? Do you rely on the network working all the time?

Normal dropbox behavior keeps a copy on every computer.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#349

Post by leshenka »

spiffytech wrote: post #313
leshenka wrote: post #281

Earlier quoted context omitted.

in Vaultwarden you can have "organizations" that are like groups of people and you can have passwords there that are accessible by members No idea how this maps into Bitwarden's own offerings though but all clients support this kind of thing

The downside is you can only share to other users on your Vaultwarden instance. You can't e.g., set up emergency sharing to family members who use cloud Bitwarden.

well this is true the other way around

BW clients support having several accounts at once so you're not forced to choose. Your family can have a regular bitwarden.com account and your vw.example.com account just for emergency access

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#350

Post by palata »

renewiltord wrote: post #309
palata wrote: post #209

Earlier quoted context omitted.

I don't think it was a bug. They dismissed it and clearly said that they had no intention to adjust the license: https://github.com/bitwarden/sdk/issues/898 .

To be honest, it looks like he just had an internal model of “internal code no gpl”, “external code gpl” and mindlessly answered based on that. The fact that it made the latter impossible seems to have been successfully impressed on him. Overall, I’ll stay a Bitwarden customer. People fuck up and I’m a tit-for-tat-with-random-forgiveness tactic user, not grim-trigger.

I could accept that he doesn't understand how open source licenses work, or doesn't care, and that it was not meant as a shady move. But still I wouldn't call it a bug, and it does not inspire confidence. Still it's not LastPass-bad.

This said, I still recommend Bitwarden to my family. I moved to pass (https://www.passwordstore.org/) a while ago just because it corresponds better to my needs and I have more control.

Post reply on HN