Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Free, open-source password manager

bitwarden.com

Post reply on HN
Print view View original

71–80 of 306 posts

Re: Bitwarden: Free, open-source password manager

#71

Post by Aerbil313 »

I have no passwords.

Don't get me wrong, I don't use a password manager either. Not a single one of them is truly portable, safe or secure. What if you lose all your electronics? All your belongings? Your house burns down in a fire? The cloud gets hacked? You have conflicting interests with US government and they kindly request your passwords from Apple? You have conflicting interests with any other country and they find and use the backdoors installed in US companies by US agencies?

I use an algorithmic password which is:

* Trivial to run in my head (I got used to it)

* Compliant with all silly password character requirements

* Has password rotation built in for apps/websites which require you to change your password every X monts

* Has a shorter version for apps/websites which have a password length limit of 20 chars

* Has a third easier-to-spell version for passwords I need to share with family and friends

* Completely ASCII

* Impossible to tell with bare eyes it's the password for amazon.com from the resulting password. It looks like randomly generated gibberish.

* Leaves the Caps Lock off (so that you won't try again and fail again when you fail once and the Caps Lock is on)

I only have an algorithm in my head. The downsides? It's a bit more slower to enter a password if I haven't entered it in a while. Still doesn't take more than 30 secs. And it can only be brute forced in a million years instead of a billion.

And yes, you need these features in your algorithmic password. It took me about a year of trial and error to get to this point.

Re: Bitwarden: Free, open-source password manager

#72

Post by nichtverstehen »

I use and pay for Bitwarden. I want it to succeed, but I still find it weird.

1. Security.

Bitwarden's documentation on its security model is quite thin.

1password has a great write-up about how it works in detail: https://1passwordstatic.com/files/security/1password-white-p.... Corresponding doc for Bitwarden is much lighter on detail: https://bitwarden.com/help/bitwarden-security-white-paper/.

The security audits they list of https://bitwarden.com/help/is-bitwarden-audited/ are focused on the client software implementation bits, and make no judgement on the overall security model.

My main concern is that the password is the only key that is needed to both log into the server and to decrypt the vault. There is no additional key that is completely offline, like 1password Secret Key (that is presumably stored in Keychain / Secure Enclave at rest). A password seems somewhat more easily stealable (with keyloggers or clipboard loggers etc).

I am not a security expert, but I know enough to be concerned :). I wish there was more discussion on the implications of this difference on security models.

2. Offline access.

Bitwarden does not like to work offline.

You can unlock and view the vault, but you cannot make any changes without active connection to the internet! And Bitwarden will show you a very generic error ("failed to fetch") if you try editing while offline, it won't give you any suggestion on what to do.

Moreover, apparently they will delete the local copy of the vault if internet connection is missing for 30 days: https://www.reddit.com/r/Bitwarden/comments/vtaqi0/comment/i.... That's just nuts if true. I should not rely on the Cloud to have access to the vault as stored locally as long as I have the password.

While there is a general fear about trusting The Cloud as the source of truth for accessing the passwords, this caused very tangible practical issues. I have actually run into needing Bitwarden while on the go. Also the CloudFlare IP that Bitwarden uses was somehow blocked by my provider for some time, and that broke Bitwarden completely (both the provider and Bitwarden neglected to do anything about the problem when contacted).

3. UX.

You get used to it, but it's simply not great.

Worst of all, the UI of the browser extension is prone to data loss. The Bitwarden popup resets the state every time it is unfocused. So imagine the scenario:

* I start creating a new entry and generate a password. * I briefly dismiss the Bitwarden popup to paste the password into the website. * I open Bitward popup again hoping to finish entering the data and save. But the entry is gone. I just need to hope that the generated password is still on the clipboard.

1password in contrast keeps full UI state and partially entered data even if the vault is locked in the interim.

Re: Bitwarden: Free, open-source password manager

#73

Post by r4indeer »

antioxidant wrote: post #8
nomercy400 wrote: post #2

I am a KeepassXC user, yet this sounds interesting. What does Bitwarden offer to make me want to switch?

Nothing. Adding 2FA codes to logins costs money, and self-hosting is deliberately difficult so you’ll be using the cloud. Also you can’t edit while offline.

> Adding 2FA codes to logins costs money

If you don't want to pay $10/year for Premium, you can still host Vaultwarden instead and get the features for free.

> self-hosting is deliberately difficult so you'll be using the cloud

[citation needed] in my opinion. Yes, the current self-hosting method is rather complex, but still not that difficult to set up. Just follow their guide.

They are even working on a new "unified" deployment method [1] where you can choose your own DB and all the Bitwarden containers are merged into one. The resulting docker-compose.yml looks as simple as any other service I self-host. Why would they do this if what you said were true?

[1] https://bitwarden.com/help/install-and-deploy-unified-beta/

Re: Bitwarden: Free, open-source password manager

#74

Post by ishtanbul »

Aerbil313 wrote: post #71

I have no passwords. Don't get me wrong, I don't use a password manager either. Not a single one of them is truly portable, safe or secure. What if you lose all your electronics? All your belongings? Your house burns down in a fire? The cloud gets hacked? You have conflicting interests with US government and they kindly request your passwords from Apple? You have conflicting interests with any other country and they…

Can you please explain this more?

Re: Bitwarden: Free, open-source password manager

#76

Post by Aerbil313 »

ishtanbul wrote: post #74
Aerbil313 wrote: post #71

I have no passwords. Don't get me wrong, I don't use a password manager either. Not a single one of them is truly portable, safe or secure. What if you lose all your electronics? All your belongings? Your house burns down in a fire? The cloud gets hacked? You have conflicting interests with US government and they kindly request your passwords from Apple? You have conflicting interests with any other country and they…

Can you please explain this more?

I cannot disclose the algorithm. What feature do you want explained?

Re: Bitwarden: Free, open-source password manager

#78

Post by gchamonlive »

vinckr wrote: post #49
aborsy wrote: post #22

Earlier quoted context omitted.

The difference is that Bitwarden is webapp, thus serves you code in real time. The server could serve bad JavaScript to a particular user. You have to trust the server. Also, there is a chance of data breach. The 2FA and hardware keys are bypassed in this case. It’s all your master password.

>The 2FA and hardware keys are bypassed in this case. It’s all your master password. Not sure I follow. When my master password is breached, attackers would still need to have my hardware key (which I obviously don't keep in the cloud), right?

In case of a password breach, yes, but the comment you are responding to refers to a data breach, where somehow the attacker dumps raw database data, which is still encrypted but only by your master password, afaik.

Re: Bitwarden: Free, open-source password manager

#79

Post by pil0u »

Aerbil313 wrote: post #71

I have no passwords. Don't get me wrong, I don't use a password manager either. Not a single one of them is truly portable, safe or secure. What if you lose all your electronics? All your belongings? Your house burns down in a fire? The cloud gets hacked? You have conflicting interests with US government and they kindly request your passwords from Apple? You have conflicting interests with any other country and they…

Interesting. If say 3 passwords using that algorithm leaked, would it be possible to deduce the algorithm itself?

Edit: what about digit-only password?

Re: Bitwarden: Free, open-source password manager

#80

Post by 1una »

rmdes wrote: post #66
ploum wrote: post #28

Earlier quoted context omitted.

Wow, thanks for the info. This is indeed quite a huge sum of money for such a cheap service from which you can easily migrate. That’s a bit worrying.

should OSS users of Vaultwarden be worried?

Maybe. Vaultwarden is just a compatible server. All the clients (web, browser extension, desktop, cli and mobile apps) are still maintained by Bitwarden.
Post reply on HN