Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden SDK relicensed from proprietary to GPLv3

github.com

Post reply on HN
Print view View original

371–380 of 381 posts

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#371

Post by cryptos »

retrochameleon wrote: post #368
apitman wrote: post #325

Earlier quoted context omitted.

I'm cautiously optimistic, but still concerned about the long term. * I just don't see how taking $100 million can be good for users in the long run. By far the most likely outcomes are bloat or enshittification. * bitwarden does not appear to be very forkable, ie it's a complex system written in C#. The existence of Vaultwarden helps a lot with this, but what about the client apps? Forkability is the second most imp…

The UX of Bitwarden is pretty lacking compared to 1Password. I finally made the switch after years of Bitwarden because of the vast UX improvements. For one, it's much easier and natural to add additional pieces of information on entries in 1Password. Bitwarden's implementation of this always feels like a poorly integrated afterthought.

The UX is exactly the reason why a stayed away from Bitwarden.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#372

Post by slightwinder »

seabrookmx wrote: post #293
slightwinder wrote: post #223

Earlier quoted context omitted.

> I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good I wouldn't say it's good, but it does its job, if you can live with the insecurity and limitations. It's very comfortable, which is the only reason I'm still using it over KeePass and Bitwarden. KeepPass has no reliable Browser-integration, and Bitwarden is hard to selfhost. Firefox Passwordmanager is just…

Have you tried vaultwarden (formerly bitwarden-rs)? It's trivial to self host. I've been running it in a GCP free tier VM for years.

Yes, I know vaultwarden. And it's indeed simple to start the docker-container. But no every use case can be satisfied with docker.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#373

Post by phs318u »

KeePassium wrote: post #370
BodyCulture wrote: post #307

Earlier quoted context omitted.

This discussion is about an open source password manager. I wonder why you are recommending a closed source software? Are you aware that many people prefer open source for security software for a reason?

I think most Strongbox users did not notice it turned proprietary. It's not like Strongbox advertised the change :) Context: https://github.com/strongbox-password-safe/Strongbox/issues/...

Correct. I did not realise this and am disappointed, having paid a pretty penny for the lifetime license. Reading the github thread, the surreptitious way they changed things is a bit of a dick move.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#374

Post by berkes »

jasode wrote: post #241
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

>, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But a lot of "normal people" actually need a secrets manager which is larger in scope than just a "websites urls passwords manager". This means a password manager with extra metadata fields for users to add notes, associated email aliases, etc. E.g. if a website has an extra step of "Confirm your identit…

AFAIK Firefox also doesn't store bank-account or creditcard details.

Here's why I recommend bitwarden to "my mom":

- It stores and fills in all your website passwords on your phone and on your laptop

- It makes it easy to generate new passwords for all these places

- It stores your PIN for your bank-accounts (in many EU country payments with PIN are the default)

- It stores your creditcard info and 3d passwords or other extra secrets it requires.

- It's the perfect place to store SSN, Tax IDs, "whats was the name of your first pet?" and so on.

I've never understood the rigid structure of e.g. Firefox or even lastpass, where they e.g. insist on having an URL or even insist on a username/password. I want secret notes with optional metadata - metadata that may follow a predefined structure (username, OTP secret, url, etc) but not always. Bitwarden does this much better IMO.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#375

Post by Saris »

nocoder wrote: post #64

What would be a good way to backup the passwords stored in Bitwarden? I am worried that someday suddenly bitwarden could stop working and I will lose access to all the stored passwords? Should I have a physical copy of all the passwords stored in a vault at home?

Use the export feature and just save the file somewhere safe, mine is in a Cryptomator vault. You could also import to Keepass and then delete the file.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#376

Post by Saris »

aae42 wrote: post #236
hexfish wrote: post #178

Earlier quoted context omitted.

Frankly I would worry about that with any third party that holds my data. There are a few Bitwarden exporters on Github that also account for attachments (something the builtin exporter doesn't for some reason).

BW synchronizes all your data on each client... if you logged in before, and your server goes down, you can still log in to a recent client, it just won't be able to update you could recover from that

No way to export from the client though, so you would have to recover the server unless you previously made backups with the export feature.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#377

Post by ErikBjare »

jvdvegt wrote: post #315
qwertyuiop_ wrote: post #254

Earlier quoted context omitted.

This ^ passwords just don’t live in Firefox when you are using apps that need passwords across platforms (mac ios windows) and apps. This is where Bitwarden shines.

I don't know about iOS, but Firefox syncs my passwords between my Linux machine and Android phone just fine.

Your web passwords, not your app passwords.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#378

Post by seabrookmx »

slightwinder wrote: post #372
seabrookmx wrote: post #293

Earlier quoted context omitted.

Have you tried vaultwarden (formerly bitwarden-rs)? It's trivial to self host. I've been running it in a GCP free tier VM for years.

Yes, I know vaultwarden. And it's indeed simple to start the docker-container. But no every use case can be satisfied with docker.

Unless you only have non-Linux hosts available, this use case can :)

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#379

Post by accrual »

accrual wrote: post #44
freedomben wrote: post #35

Earlier quoted context omitted.

It probably doesn't matter for you if you'll never be leaving Apple's ecosystem, but for anyone else, I think that's something to keep in mind before moving to a non-portable solution like Apple keychain.

I would love to use Apple keychain but you're right - as a mixed OS user, it's a tough sell.

Just thinking outloud to myself - if Apple could embed their key management tech in a simple cross platform UI and support Windows, Linux, iOS, Android, and the web like Bitwarden - they'd be a viable alternative.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#380

Post by ivanfilhoz »

odo1242 wrote: post #72
freedomben wrote: post #32

Earlier quoted context omitted.

There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis o…

I mean, if you're using a password manager, you're already protecting against 99% of the things that 2FA is designed to protect against. If you really wanted to, it would probably make the most sense to enable 2FA on your password manager?

Not really — I do it just for peace of mind, TBH. Although your primary password could be cracked somehow, so it doesn't hurt to have this additional layer.
Post reply on HN