Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Avoid at all costs (outage issue)

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 137 posts

Re: Bitwarden: Avoid at all costs (outage issue)

#61

Post by Szpadel »

Canada wrote: post #20

No matter what password you use, I highly recommend regularly exporting a plaintext copy of it to somewhere safe like an encrypted volume on one or more of your devices. Just do it once a month - mount the volume, export the database in plaintext directly to the volume, then unmount it. If your password manager locks you out because of a bad software update, service outage, or you hold the wrong passport and got sanc…

especially when it's so easy to delete all your passwords when you use Google password manager with clear browser data feature...

wife had issue with bank and wanted to flush all browser caches, but didn't notice that for some reason passwords checkbox was preselected. it deletes all saved passwords saved in cloud without way to recover (unless you have some offline device that didn't yet synced)

Re: Bitwarden: Avoid at all costs (outage issue)

#62

Post by Szpadel »

yogenpro wrote: post #13

I've been using Bitwarden's clients (browser extension, mobile apps, desktop apps) with a self-hosted vaultwarden [1] server. It's marginally free if you are already self-hosting other stuff. I'm hosting it on a raspberry pi 4b at home and exposing it to public Internet through Cloudflare zero trust (also free). Had no problems so far. [1] https://github.com/dani-garcia/vaultwarden , note that it's different from Bit…

vaultwarden is awesome, just make sure you have some reliable automated backup (preferably cloud) for disaster recovery.

Re: Bitwarden: Avoid at all costs (outage issue)

#63

Post by presto8 »

Canada wrote: post #20

No matter what password you use, I highly recommend regularly exporting a plaintext copy of it to somewhere safe like an encrypted volume on one or more of your devices. Just do it once a month - mount the volume, export the database in plaintext directly to the volume, then unmount it. If your password manager locks you out because of a bad software update, service outage, or you hold the wrong passport and got sanc…

This is great advice. The problem is that it is hard to have the discipline to do this month after month.

Re: Bitwarden: Avoid at all costs (outage issue)

#64

Post by presto8 »

doodlesdev wrote: post #11
Georgelemental wrote: post #9

KeePassXC ( https://keepassxc.org/ ) - open source, full featured, standard file format, bring your own cloud storage

Another options is pass [0], which uses GPG to encrypt your stuff. Everything happens through the CLI but there are also GUI frontends for it. There's also gopass [1] which is very similar and compatible but does some extra stuff such as versioning with git. Similarly to this API compatibility there's KeePassDX [2] for mobile phones which is compatible with the KeePass database format. There's also KeePass [3] which…

I didn't find the sync that hard with pass and iOS (I'm sure Android has something equivalent): Set up a private git repo somewhere and configure passforios to pull from it. I have been running it for a few months now and it's smooth. This assumes you are on Linux or Mac.

Re: Bitwarden: Avoid at all costs (outage issue)

#65

Post by anotherevan »

For those suggesting to "just" use KeePassXC and KeePassDX, the sticking point for me is that the UI experience with Bitwarden in my desktop browser and on Android is just so darn good.

How do the KeePass' compare?

P.S. I do use a KeePassXC vault for a small amount of stuff. Discovered KeePassDX for Android this week from a recent HN comment. It is very good. After playing with it for ten minutes I deleted the other two Keepass apps I had on my phone.

Re: Bitwarden: Avoid at all costs (outage issue)

#66

Post by hanklazard »

Canada wrote: post #20

No matter what password you use, I highly recommend regularly exporting a plaintext copy of it to somewhere safe like an encrypted volume on one or more of your devices. Just do it once a month - mount the volume, export the database in plaintext directly to the volume, then unmount it. If your password manager locks you out because of a bad software update, service outage, or you hold the wrong passport and got sanc…

This. I have an automated backup to my home server to borgbase every night. Every few weeks I do a manual export of my vaultwarden to this server. Major peace of mind.

Re: Bitwarden: Avoid at all costs (outage issue)

#67

Post by CameronNemo »

torstenvl wrote: post #59
Macha wrote: post #42

Earlier quoted context omitted.

It depends if you feel happy entrusting your passwords to what is ultimately a closed source client. I do not. Moving to self hosted vaultwarden from keepassxc-in-syncthing was a big leap. A closed source client is a leap too far.

It's a closed-source UI on top of sqlite/SQLCipher. You'll be fine.

I mean sure... But why go out of my way to use closed source software when the open source options are right there?

Re: Bitwarden: Avoid at all costs (outage issue)

#68

Post by n3t »

doodlesdev wrote: post #15
mistrial9 wrote: post #12

Earlier quoted context omitted.

In our mission to continually strengthen services and protect our brand we have employed many protections for our remote monitoring, control and IP... what do people expect? all the wrong management are attracted to security products for exactly the reasons you suspected all along.. Lock-in is profits!

There is no lock-in to Bitwarden, stop spreading FUD. I'm not really sure how long this is going to be like this with the VC money, but right now: - Everything is open source - You get to self host - You get to export your database at any time - You don't even need to pay to use it if you don't want to Are local password managers objectively more secure and reliable? Yes. Does that mean that Bitwarden is just an awfu…

Let me quote some excerpts from their license FAQ[0]:

> With respect to the server software available under the Bitwarden License, production use requires a separate commercial agreement with Bitwarden

> The right to use the software in a production environment, or environments directly supporting production, requires a paid Bitwarden subscription

> The Bitwarden License does not qualify as an open source license under the OSI definition

[0]: https://github.com/bitwarden/server/blob/master/LICENSE_FAQ.... (permalink → https://github.com/bitwarden/server/blob/f848eb247767fbba8a4...)

Re: Bitwarden: Avoid at all costs (outage issue)

#69

Post by luckman212 »

DavideNL wrote: post #44
Decabytes wrote: post #35

Damn I literally just created my Bitwarden account today and then immediately experienced this problem. I thought I was doing good not getting last pass, and needed the iOS app so that disqualified KeePassXC. What am I left with 1password?

Perhaps try KeePassXC on Desktop + Strongbox on iOS.

Strongbox looks amazing, thank you.

Re: Bitwarden: Avoid at all costs (outage issue)

#70

Post by mkeedlinger »

Georgelemental wrote: post #9

KeePassXC ( https://keepassxc.org/ ) - open source, full featured, standard file format, bring your own cloud storage

I'm another very happy user of keypassxc. Passwords are too vital to me to depend on the security and reliability of network services. They also have a browser extension, so I mostly don't experience a large usability difference.
Post reply on HN