Seriously? A password manager where the desktop app is build ontop of unsecure electron.
Bitwarden – Open Source Password Manager
81–90 of 163 posts
Re: Bitwarden – Open Source Password Manager
#82Any reason not to use Firefox's own password sync? It's been working fine for me so far.
Re: Bitwarden – Open Source Password Manager
#83https://github.com/bitwarden/core/blob/master/README.md SQL Server 2017, really? Interesting choice. Open source but we have to pay licenses for the database if we want to self host. I wonder what was wrong with PostgreSQL or MySQL even if they're using .NET Core as a language. Edit: there is an issue for that https://github.com/bitwarden/core/issues/10
Ah shit, its a . NET program :( It all sounded really good until this point. I was even going to say you could add support for postgres, but I don't know a lot of open source devs who are using. NET.
Keepass2 is also Open-Source and .Net because as far as I know .Net offers some extra security on Windows like locking the desktop while entering the master password.
Re: Bitwarden – Open Source Password Manager
#84On problem with password managers (that are using web authentication to create/manage an account for backing up the password manager in the cloud) is that the authentication password can be leaked during the authentication process. For example, the storage provider for password manager backup can simply read the password from the authentication web page since this web page is hosted at the provider. This is problematic if the authentication password is also used to encrypt the password manager, i.e. the provider could decrypt the password manager with the authentication password. You would actually need two passwords; one for authentication and one for encryption. Unfortunately, you usually don't even have the option to choose two passwords.
To solve this problem I'm working on FejoaAuth (https://fejoa.org/fejoapage/auth.html). FejoaAuth uses an authentication protocol that does not leak the user password to the provider who is going to store the password manager. This protocol is run in a trusted browser plugin in order to ensure the correct execution of the protocol. Thus you can use a single password for authentication and password manager encryption.
Re: Bitwarden – Open Source Password Manager
#85If you're searching for an open-source self-hosted alternative that offers corporate features like LDAP integration take a look at SysPass (https://github.com/nuxsmin/sysPass). Doesn't look as nice as Bitwarden though.
Re: Bitwarden – Open Source Password Manager
#86I switched from LastPass to bitwarden in November, and I love it. - it's FOSS, and audited, so it's software I can trust - great UX on Firefox, chrome, and even Edge. I had my issues, but the project improved them away very quickly. - sharing support for families or organizations. - convenient standalone clients for win/Mac/Linux... And even the CLI. - built in 2FA code generation for each entry, so I don't need a se…
Is storing the 2FA codes alongside your password a wise idea?
Re: Bitwarden – Open Source Password Manager
#87I switched from LastPass to bitwarden in November, and I love it. - it's FOSS, and audited, so it's software I can trust - great UX on Firefox, chrome, and even Edge. I had my issues, but the project improved them away very quickly. - sharing support for families or organizations. - convenient standalone clients for win/Mac/Linux... And even the CLI. - built in 2FA code generation for each entry, so I don't need a se…
Is storing the 2FA codes alongside your password a wise idea?
Yes, if the attack vector you're trying to close is a compromised keyboard/network/terminal and not a stolen-while-unlocked device.
"Catching" one 2FA code doesn't let you compromise someone's account.
Losing (or having compromised) the hardware running your password manager while that password manager is unlocked is a totally different thing from logging into a web site once from a library computer.
Re: Bitwarden – Open Source Password Manager
#88https://github.com/bitwarden/core/blob/master/README.md SQL Server 2017, really? Interesting choice. Open source but we have to pay licenses for the database if we want to self host. I wonder what was wrong with PostgreSQL or MySQL even if they're using .NET Core as a language. Edit: there is an issue for that https://github.com/bitwarden/core/issues/10
Pretty sure they were in the BizSpark program from Microsoft so that probably influenced alot of their technology choices
Re: Bitwarden – Open Source Password Manager
#89Seriously? A password manager where the desktop app is build ontop of unsecure electron.
I get that Electron is undesirable, but what do you mean by unsecure? Also, can you list some alternatives if you don't want them building a desktop app in Electron?
Re: Bitwarden – Open Source Password Manager
#90I switched from LastPass to bitwarden in November, and I love it. - it's FOSS, and audited, so it's software I can trust - great UX on Firefox, chrome, and even Edge. I had my issues, but the project improved them away very quickly. - sharing support for families or organizations. - convenient standalone clients for win/Mac/Linux... And even the CLI. - built in 2FA code generation for each entry, so I don't need a se…
It's been awesome. The one feature I'm still missing from LastPass is being able to mark some entries as more secure and reprompting auth on those.