Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

41–50 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#41

Post by tmerc »

ohCh6zos wrote: post #12

I’m highly skeptical of Passkeys/Webauthn as it would seem to not have the same legal protections that a password has in the US. Maybe this is me becoming a conspiracy theorist.

This is conspiracy theorist talk until it isn't and that date will be not long after this is more commonly used. (I think this is a rational concern, btw)

The current legal climate is mixed but we have court cases that claim biometrics are not covered by the 4th and 5th. We also have the opposite. The reasoning being that producing biometrics is not testimonial. Until decided by the Supreme Court, I'll assume that anything that can be produced without my mind is not covered and that includes this.

I am not a lawyer and this is not legal advice.

Re: Bitwarden Acquires Passwordless.dev

#42

Post by vorpalhex »

cdev_gl wrote: post #35
paulryanrogers wrote: post #18

Earlier quoted context omitted.

BitWarden is open source on both ends. So worst case one can self host then fork clients. (Server has already been reimplemented independently.)

This is true, but LastPass proved that by the time the worst case occurs it's already too late. A security breach means, at minimum, redoing all your passwords, and these sites are a very compelling target. OTOH I wouldn't want to self-host because I know I'm not going to spend the same amount of time and effort a full security staff would, even if my self-hosted box would make a much less attractive target. It's qui…

You have security options self hosting that a big host does not.

Want to just encrypt everything on a node with no network access? Sure. That doesn't work for a "real" host but that is fine if you mostly use your phone and need to just occasionally sync your passwords back at home.

You don't need the things that make hosting hard. You can have a few hours of downtime. You password vault is gigabytes, not hundreds of terabytes. You don't need to arm guard your backups, just pass them (encrypted) to a friend with a safe.

Re: Bitwarden Acquires Passwordless.dev

#43

Post by mfer »

zucked wrote: post #39
gagabity wrote: post #13

Earlier quoted context omitted.

Also Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.

I'm happy for the one dev who's been lone rangering as I hope it means he's finally getting paid, but the pressure is going to be on to get an ROI.

If he was not being paid before it means he had not built a sustainable business. That means changes will need to come in the future to do that.

If he had a sustainable business and took the VC funding it means he has grander ambitions. That will mean change as well.

No matter how you look at it there will be change coming. Fueled by people who want a return on their investment.

Re: Bitwarden Acquires Passwordless.dev

#44

Post by cpsns »

gagabity wrote: post #13
AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

Also Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.

> Bitwarden recently raised 100M from VC

I wasn’t aware of this, but I’m glad I am now. If that’s the case it’s time to look elsewhere or self host, VC funds and acquisitions are rarely good for users so I’ll assume the worst.

Re: Bitwarden Acquires Passwordless.dev

#45

Post by cormacrelf »

judge2020 wrote: post #14

This seems a bit odd to me - is setting up WebAuthn in your main backend so hard that an external service like this for validating credentials is required?

Quoting the docs: it’s “WebAuthn - without reading the w3c spec”. So apparently yes. It does seem very silly that this has to be a third party service instead of open source code you just plug in to Rails or whatever. I guess they had to find some way to get paid for all the expertise they accumulated. Stuff running on external servers is the way tech companies as a whole have decided to remunerate work like that, and now everything looks like a nail. I note that since logging in is such a crucial part of online business, running consulting around open source software would appear to be a a good model. That’s what the people behind the C# OAuth2/OpenID code known as IdentityServer do.

Re: Bitwarden Acquires Passwordless.dev

#46

Post by mfer »

afavour wrote: post #37
gagabity wrote: post #13

Earlier quoted context omitted.

Also Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.

They did? Oh JFC I just switched from 1Password to avoid using a VC backed service. At least there's always Vaultwarden, now all I need is a service I can pay to host an instance for me. ...and to not take VC funding. https://github.com/dani-garcia/vaultwarden Though I fear it’s only a matter of time before the VC gods demand the client apps remove compatibility and they have to be forked too.

Not to totally burst your bubble but 1Password took funding a few years ago [1]. I say this as a 1Password user.

[1] https://www.wsj.com/articles/password-manager-1password-rais...

Re: Bitwarden Acquires Passwordless.dev

#47

Post by sigzero »

Jack5500 wrote: post #5

Slightly offtopic, but I really find the Bitwarden Clients to be lacking in the feature department. I switched to Bitwarden a few month ago and the client has evolved (for me) ever since. There are a few basic features missing, such as that if I search for something I wrote in the notes of password, that the client shows the according password. I get that the open-source model implies that everyone can contribute and…

Bitwarden (for me) is still a little clunkier in how it does things compared to 1Password. I find 1Password a much smoother experience.

Re: Bitwarden Acquires Passwordless.dev

#48

Post by kjfarm »

AdmiralAsshat wrote: post #4

As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence. Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.

A good note for bitwarden is that it has a self hosting open source version, vaultwarden that is easy to switch to: https://github.com/dani-garcia/vaultwarden I see this as downside protection, as I can quickly migrate if I disagree with bitwarden's direction with minimal changes to my clients.

I do worry about VC pressure on Bitwarden for hypergrowth. However in my personal opinion, the benefits outweigh the cons (for now).

Re: Bitwarden Acquires Passwordless.dev

#49

Post by penciltwirler »

One can easily self host a bitwarden server on digitalocean. https://bitwarden.com/blog/digitalocean-marketplace/

However, I'm curious what y'all think about the cost. A digitalocean droplet for the recommended specs (4 GiB memory) is $24/month. This is hard to stomach when you compare with Bitwarden Premium which is <$1/month. I guess it depends on how much you value your own data.

Re: Bitwarden Acquires Passwordless.dev

#50

Post by candiddevmike »

arianvanp wrote: post #11
xwowsersx wrote: post #3

Could someone clarify what the relationship between passkeys and WebAuthn is? Is it that Passkey is the Apple, Google, Microsoft implementation (commercialization?) of WebAuthn? If so, does it add anything on top of WebAuthn that makes it differ in some fundamental way? Also, are passkeys how WebAuthn is most commonly actually used in practice? Apologies for the noob questions.

it's just WebAuthn with an easier to understand name. However passkeys depends on a yet to be published standard for QR codes + bluetooth + websockets for doing WebAuthn from a second device. But that is planned to be published soon.

Just recently tried to add WebAuthn to an app and was shocked at how complicated the spec is and how quirky the implementation ends up being. The biggest thing I couldn't easily figure out is how to use it properly. It seems like hybrid auth with your phone or FIDO gives you sign in, and local could be used for sessions? It's hard to make heads or tails from it.

The developer UX was also pretty bad, ArrayBuffers was a poor design choice for passing around what ultimately becomes JSON.

Post reply on HN