Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Avoid at all costs (outage issue)

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 137 posts

Re: Bitwarden: Avoid at all costs (outage issue)

#41

Post by alyandon »

yogenpro wrote: post #13

I've been using Bitwarden's clients (browser extension, mobile apps, desktop apps) with a self-hosted vaultwarden [1] server. It's marginally free if you are already self-hosting other stuff. I'm hosting it on a raspberry pi 4b at home and exposing it to public Internet through Cloudflare zero trust (also free). Had no problems so far. [1] https://github.com/dani-garcia/vaultwarden , note that it's different from Bit…

Added bonus - even if the client extensions/app stopped working you can still log into the vaultwarden web UI to access your secrets.

Re: Bitwarden: Avoid at all costs (outage issue)

#42

Post by Macha »

lake_vincent wrote: post #38
torstenvl wrote: post #5

Enpass - Local-first so you own your data - Open about technical documentation and assisted in providing encryption scheme info to an open-source vault reader (so you own your data...) https://github.com/hazcod/enpass-cli - Works with lots of cloud/sync providers - Cross-platform (Windows, macOS, Linux, iOS, Android) - Browser integration (Safari, Firefox, Chrome, Edge, Opera, Vivaldi) - Lifetime license for $79.99

Wow, okay, yeah, I'm actually sold. There's a CLI for desktop, and it's on both ios and android. Damn. Will gleefully fork over $80 for a lifetime license if it's as good as it seems. Why have I never heard of Enpass before? Anyone have any reason to not switch from Bitwarden to Enpass right now?

It depends if you feel happy entrusting your passwords to what is ultimately a closed source client.

I do not.

Moving to self hosted vaultwarden from keepassxc-in-syncthing was a big leap. A closed source client is a leap too far.

Re: Bitwarden: Avoid at all costs (outage issue)

#43

Post by password4321 »

yogenpro wrote: post #13

I've been using Bitwarden's clients (browser extension, mobile apps, desktop apps) with a self-hosted vaultwarden [1] server. It's marginally free if you are already self-hosting other stuff. I'm hosting it on a raspberry pi 4b at home and exposing it to public Internet through Cloudflare zero trust (also free). Had no problems so far. [1] https://github.com/dani-garcia/vaultwarden , note that it's different from Bit…

Vaultwarden "is the way" if you need a polished iOS client, almost too good to be true now that VC's are involved.

Re: Bitwarden: Avoid at all costs (outage issue)

#44

Post by DavideNL »

Decabytes wrote: post #35

Damn I literally just created my Bitwarden account today and then immediately experienced this problem. I thought I was doing good not getting last pass, and needed the iOS app so that disqualified KeePassXC. What am I left with 1password?

Perhaps try KeePassXC on Desktop + Strongbox on iOS.

Re: Bitwarden: Avoid at all costs (outage issue)

#45

Post by lake_vincent »

derilok wrote: post #40
lake_vincent wrote: post #38

Earlier quoted context omitted.

Wow, okay, yeah, I'm actually sold. There's a CLI for desktop, and it's on both ios and android. Damn. Will gleefully fork over $80 for a lifetime license if it's as good as it seems. Why have I never heard of Enpass before? Anyone have any reason to not switch from Bitwarden to Enpass right now?

It is closed sourced and I am not sure that the code base was audited.

Closed source I can deal with, as long as a strong audit has been performed.

Found this: https://www.enpass.io/security-audit-report/

I'm not a security expert, so not sure if those audits are trustworthy.

Re: Bitwarden: Avoid at all costs (outage issue)

#46

Post by jimmygrapes »

lake_vincent wrote: post #45
derilok wrote: post #40

Earlier quoted context omitted.

It is closed sourced and I am not sure that the code base was audited.

Closed source I can deal with, as long as a strong audit has been performed. Found this: https://www.enpass.io/security-audit-report/ I'm not a security expert, so not sure if those audits are trustworthy.

That's the problem though isn't it? Unless you're an absolute expert in every aspect of a thing, you gotta trust someone who claims to be the expert, eventually. Or never trust it.

When it comes to security audits of software I often prefer to see that software failed at this or that, and was corrected, with a reasonable explanation of both the problem and the applied solution. To me, this shows that 1) the audit was actually performed and not just bought/pencil-whipped; and, 2) the developers acknowledge their [inevitable] mistakes and correct them. It also teaches me what to be aware of for other, similar software.

In other words, I would rather see a pimple once in awhile than be convinced by makeup that everything is perfect.

Re: Bitwarden: Avoid at all costs (outage issue)

#47

Post by zen_1 »

Canada wrote: post #20

No matter what password you use, I highly recommend regularly exporting a plaintext copy of it to somewhere safe like an encrypted volume on one or more of your devices. Just do it once a month - mount the volume, export the database in plaintext directly to the volume, then unmount it. If your password manager locks you out because of a bad software update, service outage, or you hold the wrong passport and got sanc…

Or just use KeePassXC+nextcloud/syncthing as others have suggested, it's just an encrypted database with no cloud bullshit.

Re: Bitwarden: Avoid at all costs (outage issue)

#49

Post by secabeen »

throw149102 wrote: post #36

Lots of people are mentioning that you can host these types of things yourself, I want to say that that is not a solution at all. The entire point of these hosted password services is that they are a turnkey solution - I could give them to my mom, who knows nothing about technology, and trust that they work. I like using a turnkey solution myself even though I could self-host because I don't want to spend brain cycle…

I think this is the flip-side. They want to support remote wipe, which means they can pull access.

Re: Bitwarden: Avoid at all costs (outage issue)

#50

Post by viro »

cabbagesauce wrote: post #3
Reflex0184 wrote: post #2

If you need "seven nines", your best bet might be to host it yourself. Probably not going to find it anywhere for $10/yr

You're one of the anon-Bitwarden boys? 1) I want sane error messages on the client side. 2) I want my feedback on community forums not to be shushed. You screwed up — own it. Community mods aren't janitors to wipe out user feedback. 3) I want the extension to be working no matter what kind of server-side problems you have. Let me know about a sync problem but don't terminate my access. But if you do think, that for $…

Idk why you think you should be able to login to a cloud SaaS product while its down. From your comment here I highly highly doubt you were at all even remotely civil in that forum post $12 a month doesn't mean you get to be an asshole to people. Not all forms of Auth can be done locally, for example most 2fa requires server access.
Post reply on HN