Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden SDK relicensed from proprietary to GPLv3

github.com

Post reply on HN
Print view View original

71–80 of 381 posts

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#71

Post by odo1242 »

lxgr wrote: post #21
blendergeek wrote: post #19

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But for anyone with more advance needs (or who doesn't trust a password manager built into a web browser, I always recommend Bitwarden because KeepassXC + syncing is way too difficult for normal people.

Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independent is a huge advantage, in my view.

Yes, through TOTPs will run you a (worth it imo) $10/year subscription. Passkeys have been supported for a while (free) on all major platforms, and I haven't seen any issues with it.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#72

Post by odo1242 »

freedomben wrote: post #32
lxgr wrote: post #21

Earlier quoted context omitted.

Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independent is a huge advantage, in my view.

There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis o…

I mean, if you're using a password manager, you're already protecting against 99% of the things that 2FA is designed to protect against. If you really wanted to, it would probably make the most sense to enable 2FA on your password manager?

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#73

Post by dcow »

freedomben wrote: post #32
lxgr wrote: post #21

Earlier quoted context omitted.

Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independent is a huge advantage, in my view.

There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis o…

The only true 2nd factor is a setup where your totp codes live on a separate piece of physical hardware. If your totp codes are in an app on your phone, and your password is in a different app on your phone, you're not pure 2nd factor despite convincing yourself that you are. Anything that is convenient is not real 2FA. Real 2FA needs to be pick two of: a password in your head, a verifiable biometric signature, a code/key on your phone or separate physical hardware yubikey.

I'm not saying I think everyone needs real 2FA. I think 99.999% of the time storing your 2FA codes in your PW manager, or just moving on to Passkeys, is the right answer. 2FA is a hack put in place to mitigate passwords being relatively insecure and phishable. It's supplanted by Passkeys.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#75

Post by nichos »

nocoder wrote: post #64

What would be a good way to backup the passwords stored in Bitwarden? I am worried that someday suddenly bitwarden could stop working and I will lose access to all the stored passwords? Should I have a physical copy of all the passwords stored in a vault at home?

Export your BE vault and import it into key pass. Then store that file somewhere safe.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#76

Post by chpatrick »

dcow wrote: post #52
freeone3000 wrote: post #47

Earlier quoted context omitted.

I store the password vault in dropbox. Done.

100% serious question: how is using dropbox (one cloud) to sync passwords any better or more secure than using a password manager that syncs your vault for you (another cloud)? I see so many "I don't trust so I use dropbox" comments around these parts and I just don't understand what real or perceived threat is being mitigated.

I guess the idea is that you trust open source software to encrypt the vault, so Dropbox couldn't do anything with it even if they wanted to. That's also true for the open source Bitwarden clients though.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#77

Post by dcow »

freeone3000 wrote: post #68
dcow wrote: post #52

Earlier quoted context omitted.

100% serious question: how is using dropbox (one cloud) to sync passwords any better or more secure than using a password manager that syncs your vault for you (another cloud)? I see so many "I don't trust so I use dropbox" comments around these parts and I just don't understand what real or perceived threat is being mitigated.

It’s small enough for dropbox’s free tier so it saves me a subscription.

Ah! Threat to the wallet I see. That Dropbox referral credit must still be paying dividends.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#78

Post by danpalmer »

simfree wrote: post #50
danpalmer wrote: post #31

Earlier quoted context omitted.

> Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good Interesting, I've always felt that browser-based password managers provided remarkably little value for most people. Using them on mobile is tricky and platform dependent, it's easy to have local-only, non-synced data and then lose it, and being multi-device is trickier, especially in a work…

Firefox password sync just works. It's one of those things I never think about. Watching friends and family struggle with bespoke, poorly integrated password managers makes me cringe and is one of the big reasons I enjoy the seamless experience of the built-in Firefox password manager.

Does it require a Firefox account? Does it only store them locally if you haven't signed in to Firefox? This is the sort of failure I've seen, where people think their passwords are synced but because they didn't sign in years ago it's actually not backed up at all. At least on Chrome you get reminded of that all the time on YouTube/Google search, etc.

I know for Safari all the sync is via iCloud meaning if you're not signed in it's locally stored and vulnerable in that way. Especially as many people can't/don't sign in to their own iCloud on work computers, or don't have a Mac.

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#79

Post by notpushkin »

danpalmer wrote: post #78
simfree wrote: post #50

Earlier quoted context omitted.

Firefox password sync just works. It's one of those things I never think about. Watching friends and family struggle with bespoke, poorly integrated password managers makes me cringe and is one of the big reasons I enjoy the seamless experience of the built-in Firefox password manager.

Does it require a Firefox account? Does it only store them locally if you haven't signed in to Firefox? This is the sort of failure I've seen, where people think their passwords are synced but because they didn't sign in years ago it's actually not backed up at all. At least on Chrome you get reminded of that all the time on YouTube/Google search, etc. I know for Safari all the sync is via iCloud meaning if you're no…

Firefox reminds you a bunch of times, too. Would be nice if you could just link a new device via QR code (creating an account for you in the background).

Re: Bitwarden SDK relicensed from proprietary to GPLv3

#80

Post by mikae1 »

simfree wrote: post #50
danpalmer wrote: post #31

Earlier quoted context omitted.

> Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good Interesting, I've always felt that browser-based password managers provided remarkably little value for most people. Using them on mobile is tricky and platform dependent, it's easy to have local-only, non-synced data and then lose it, and being multi-device is trickier, especially in a work…

Firefox password sync just works. It's one of those things I never think about. Watching friends and family struggle with bespoke, poorly integrated password managers makes me cringe and is one of the big reasons I enjoy the seamless experience of the built-in Firefox password manager.

But does it work for non-website passwords like the PIN for the door at your workplace or the usernames and passwords for your computers?
Post reply on HN