Live data from Hacker News

Tell HN: Bitwarden does not export attachments in backups

news.ycombinator.com

71–80 of 128 posts

Re: Tell HN: Bitwarden does not export attachments in backups

#71
post #54

Earlier quoted context omitted.

I never switched to Bitwarden because I don't like how it was designed but this is clearly a huge bug even though I probably wouldn't use the feature to attach files.

>because I don't like how it was designed can you elaborate?

I already have a file server that is synced between my devices so for me KeepassXC works better (i.e.: I don't need to setup another server just for my password manager)...

Re: Tell HN: Bitwarden does not export attachments in backups

#72
post #17

I use bitwarden/vaultwarden (self hosted), and didn't even know there was an attachment option, so haven't used it upto now. I did use notes (for storing stuff like ssh/gpg keys), and can confirm that these are exported correctly. Attachments are also not exported in vaultwarden as far as I can see. I'll just stick to stuffing files in notes for now, as I had been doing.

> Attachments are also not exported in vaultwarden as far as I can see.

Understandable, since sibling comments are saying export happens on the client side, and Vaultwarden is merely a server-side replacement

Although also relevant is the sibling observation that if you're already running Vaultwarden isn't "backup" less "export from some faceless corporation" and more "take a backup of the vaultwanden database"?

Re: Tell HN: Bitwarden does not export attachments in backups

#73
post #32

Quoted post unavailable.

Except a bug is an unintentional problem with something, which exists. The backup feature not saving attachments is a missing feature. You need to write more code to support it, NOT simply modify existing code, which was already meant to provide this feature, but because of some mistakes it doesn’t.

Re: Tell HN: Bitwarden does not export attachments in backups

#74
post #45

This is sadly common. 1Password does not either.

Main thing keeping me off switching to something else. 1Password's extensions getting worse with every update gets me closer each day though.

The irony is that if they'd just open source them, it's not like that's where their real intellectual property lies and they may get a lot more help -- or at the bare minimum I can see what the extension is screwing up in my case and fix it while they "damn get around to it"

I'm waiting for someone to point out that BW's extensions are open source and are still a dumpster fire, but for me the difference is that BW started as a dumpster fire, so I don't feel compelled to bring their extension up to sane operating levels, whereas 1P's are _mostly_ right, and just need a tune-up here and there

Re: Tell HN: Bitwarden does not export attachments in backups

#75
post #4

It's been raised but doesn't appear to be a large enough issue to be put on the roadmap: https://community.bitwarden.com/t/allow-attachments-to-be-ex... The project is open-source, maybe send them a pull request?

I like Bitwarden and open source, but attachments are a paid feature for them, so you'd be essentially working to add value to their paid features for free. That feels unfair to me.

Well the clients are still quite nice and you can use them with VaultWarden for free and get attachments.

Re: Tell HN: Bitwarden does not export attachments in backups

#76
post #64

Earlier quoted context omitted.

As an Enterprise Client, I did not even know there was attachments, and i dont know what I would use attachments for...

Splunk licenses (and likely a ton of other enterprise-y software) are actual files, so when we renew our license, it goes into 1P as an attachment on our Splunk item I recognize that's not what you would use attachments for, but I'm offering that there are enterprises that get benefit from attachments, not just individual users

We have Software Asset management tools that manage those assests, This also tracks renewal dates, and various other aspects of Software management that makes password managers not a good fit.

Our password manager is just a password manager, I suspect many other organizations are the same.

Re: Tell HN: Bitwarden does not export attachments in backups

#77
post #32

Quoted post unavailable.

I am a paying customer, but a refund in this specific case is like spitting on a dead body. The fact that they designed it like that and never warned the users is treacherous. To all BW employees that keep rationalizing this and downvoting my comment: it’s all funny and stuff until there is a great damage. And then the shit hits the fan..

Re: Tell HN: Bitwarden does not export attachments in backups

#78
post #69
post #55

Earlier quoted context omitted.

Why is such a JSON file too big to use if it’s only ever handled by streaming parsers? SQLite would be a better backup format ofc.

Can you explain how sqlite is a better container for arbitrary binary files than zip? I mean, I know "INSERT INTO files ('my-file.bin', X'CAFEBABE...')" gets it into sqlite, but how would a sane person get that content back out?

Well, you can just get BLOBs out of an SQLite DB with SELECT. Also: https://www.sqlite.org/fasterthanfs.html

Not that performance or file size would matter in this case, BUT what using SQLite would allow is to use a single format for persisting all aspects of the password database, with immediate, programmatic, random access to all fields, including attachments.

But I also agree, that for this specific use-case, even SQLite is a bit of an overkill probably.

Finally, there is always https://www.passwordstore.org/ :)

Re: Tell HN: Bitwarden does not export attachments in backups

#80
post #70

Earlier quoted context omitted.

Thank you for saying something about this. I make up answers to "security" questions like: first pet's name? Favorite teacher? and so on but that means that I have to record what the answer is. I've been doing that in the notes section for LastPass. I think that I'm going to have to move to doing it in the Notes app since that works on all my Apple devices. And it looks like I can lock one Note without having to lock…

In case you haven't already seen it, 1P has effectively a "click button, get fake security question answers" and I love it: https://support.1password.com/generate-security-questions/ They use the "battery horse stable" scheme so you don't have to read crazy ascii over the phone to customer support

That is nice. I have ascii 24-48 characters with mixed special characters. A garbled mess to read aloud.
Post reply on HN