Bitwarden Acquires Passwordless.dev

Post by StreamBright » Wed, Jan 18, 2023, 4:31 PM UTC

Post by yshavit » Wed, Jan 18, 2023, 4:34 PM UTC

tapland wrote: post #30

yshavit wrote: post #26

Earlier quoted context omitted.

I just switched password managers from LastPass, and Bitwarden's lack of multiple accounts on their browser plugin was a dealbreaker for me. Such a basic feature, especially if they want to get widespread adoption. Otherwise, anyone whose work uses Bitwarden basically can't also use it for their personal stuff without jumping through hoops.

Aren’t you supposed to have your personal Bitwarden account and get work passwords shared to your account? I thought that’s how Bitwarden for organisations worked.

Post by ramsj » Wed, Jan 18, 2023, 4:36 PM UTC

penciltwirler wrote: post #49

One can easily self host a bitwarden server on digitalocean. https://bitwarden.com/blog/digitalocean-marketplace/ However, I'm curious what y'all think about the cost. A digitalocean droplet for the recommended specs (4 GiB memory) is $24/month. This is hard to stomach when you compare with Bitwarden Premium which is <$1/month. I guess it depends on how much you value your own data.

Post by arianvanp » Wed, Jan 18, 2023, 4:40 PM UTC

candiddevmike wrote: post #50

arianvanp wrote: post #11

Earlier quoted context omitted.

it's just WebAuthn with an easier to understand name. However passkeys depends on a yet to be published standard for QR codes + bluetooth + websockets for doing WebAuthn from a second device. But that is planned to be published soon.

Just recently tried to add WebAuthn to an app and was shocked at how complicated the spec is and how quirky the implementation ends up being. The biggest thing I couldn't easily figure out is how to use it properly. It seems like hybrid auth with your phone or FIDO gives you sign in, and local could be used for sessions? It's hard to make heads or tails from it. The developer UX was also pretty bad, ArrayBuffers was…

    PublicKeyCredential.prototype.toFormData = function (this: PublicKeyCredential) {
        const formData = new FormData()
        formData.append('type', this.type)
        formData.append('id', this.id)
        formData.append('rawId', new Blob([this.rawId]))
        switch (this.type) {
            case 'webauthn.get':
                if (!(this.response instanceof AuthenticatorAssertionResponse)) {
                    throw new Error('Unknown type')
                }
                formData.append('response.authenticatorData', new Blob([this.response.authenticatorData]))
                formData.append('response.signature', new Blob([this.response.signature]))
                formData.append('response.clientDataJSON', new Blob([this.response.clientDataJSON]))
                if (this.response.userHandle) {
                    formData.append('response.userHandle', new Blob([this.response.userHandle]))
                }

            case 'webauthn.create':
                if (!(this.response instanceof AuthenticatorAttestationResponse)) {
                    throw new Error('Unknown type')
                }
                formData.append('response.attestationObject', new Blob([this.response.attestationObject]))
                formData.append('response.clientDataJSON', new Blob([this.response.clientDataJSON]))
                break
            default:
                throw new Error('Unknown type')
        }
        return formData
    }

    async solveChallenge(challenge: Challenge, credential: PublicKeyCredential) {
        const formData = credential.toFormData()
        await fetch(challenge.location, { method: 'POST', headers: {'content-type':'multipart/form-data'}, body: formData })
    }

Post by worble » Wed, Jan 18, 2023, 4:41 PM UTC

sph wrote: post #53

gagabity wrote: post #13

Earlier quoted context omitted.

Also Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.

Ah for fuck's sake. It keeps happening to all the software I love. I guess I'll have to stop relying on convenience (I was a 1Password user years ago) and go 100% open-source. None of the libre offerings seem to be as convenient and polished, but at least they're not into some VC's pocket ready to squeeze as much profit as possible out of my paid membership. What's a good OSS alternative that works with iOS and Linux…