Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden: Avoid at all costs (outage issue)

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 137 posts

Re: Bitwarden: Avoid at all costs (outage issue)

#81

Post by doodlesdev »

Georgelemental wrote: post #58
doodlesdev wrote: post #32

Earlier quoted context omitted.

Nextcloud is amazing, I just don't have the resources or time to self host right now so I'm currently not using it. Big problem for me is that most cloud providers don't actually support syncing to the filesystem through Android's Storage Access Framework and instead keep all of the data in the app data, requiring me to manually export from the cloud application, and re-import into the password manager.

KeePassAndroid (not KeePassDX) has integration with the major cloud providers, I used to use it with Dropbox before I switched to self-hosting

That's amazing, I'm going to try it out since they added support for my current cloud provider at the start of this year. Another poster here has also talked about pass, which I'm going to try out too I knew it synced with Git, but I wasn't aware that the mobile applications available would do the sync through Git too.

Re: Bitwarden: Avoid at all costs (outage issue)

#82

Post by bpye »

anotherevan wrote: post #65

For those suggesting to "just" use KeePassXC and KeePassDX, the sticking point for me is that the UI experience with Bitwarden in my desktop browser and on Android is just so darn good. How do the KeePass' compare? P.S. I do use a KeePassXC vault for a small amount of stuff. Discovered KeePassDX for Android this week from a recent HN comment. It is very good. After playing with it for ten minutes I deleted the other…

I switched from KeePassXC to Bitwarden (self hosted with Vaultwarden) a couple years ago. The experience is considerably better, the BW iOS app is great, and the Firefox extension also works reasonable well. I could never get integration in either case to work as well with KeePassXC. I'm confident if BW pull any real nonsense, there will be a fork of the client, and there's no reason for Vaultwarden to go away...

Re: Bitwarden: Avoid at all costs (outage issue)

#83

Post by Georgelemental »

Canada wrote: post #24
_wldu wrote: post #22

The Design Flaws of Password Managers - https://www.go350.com/posts/the-design-flaws-of-password-man...

The design flaws of these systems are the fact that they are terrible at changing passwords, dealing with the arbitrary password requirements of many sites, and dealing with the fact that many sites require the storage of additional secrets for practical use that cannot be generated. (eg. secondary passwords or pin codes for privileged operations within the application, mandatory security questions, etc)

KeePassXC supports all of that?

Re: Bitwarden: Avoid at all costs (outage issue)

#84

Post by password4321 »

Szpadel wrote: post #61
Canada wrote: post #20

No matter what password you use, I highly recommend regularly exporting a plaintext copy of it to somewhere safe like an encrypted volume on one or more of your devices. Just do it once a month - mount the volume, export the database in plaintext directly to the volume, then unmount it. If your password manager locks you out because of a bad software update, service outage, or you hold the wrong passport and got sanc…

especially when it's so easy to delete all your passwords when you use Google password manager with clear browser data feature... wife had issue with bank and wanted to flush all browser caches, but didn't notice that for some reason passwords checkbox was preselected. it deletes all saved passwords saved in cloud without way to recover (unless you have some offline device that didn't yet synced)

I did this, didn't quite realize the implications when in a hurry trying to remove one password stored accidentally, or something.

Literally running around the house trying to shut off other PC's before Chrome could sync on them... unsuccessful. What a disaster!

Re: Bitwarden: Avoid at all costs (outage issue)

#85

Post by password4321 »

cutierust wrote: post #75

Guys keepaasxc + keepassdx + Syncthing work just fine. For $10 nobody will answer to you. Yes, Syncthing doesn't work on iphone, buy your mother an android , or buy yourself a tie machine and write apps for windows Phone

> buy yourself a tie machine and write apps for windows Phone

Took me too long to realize you probably meant ti[m]e machine, but I still don't see how that would fix getting a non-techy off their iPhone.

Re: Bitwarden: Avoid at all costs (outage issue)

#86

Post by [deleted] »

viro wrote: post #53
cabbagesauce wrote: post #25

Earlier quoted context omitted.

Hello. I'm paying for the service. My expectation is as simple as being able to log into the password manager when the cloud has an outage and I don't experience any problems. When they did disable my log in attempts, they showed the centralized — we own your data type of an issue.

did you use 2fa?

[deleted]

Re: Bitwarden: Avoid at all costs (outage issue)

#87

Post by boloust »

Georgelemental wrote: post #83
Canada wrote: post #24

Earlier quoted context omitted.

The design flaws of these systems are the fact that they are terrible at changing passwords, dealing with the arbitrary password requirements of many sites, and dealing with the fact that many sites require the storage of additional secrets for practical use that cannot be generated. (eg. secondary passwords or pin codes for privileged operations within the application, mandatory security questions, etc)

KeePassXC supports all of that?

I believe the comment you're replying to is referring to the weaknesses of deterministic password generators.

Re: Bitwarden: Avoid at all costs (outage issue)

#88

Post by anotherevan »

password4321 wrote: post #85
cutierust wrote: post #75

Guys keepaasxc + keepassdx + Syncthing work just fine. For $10 nobody will answer to you. Yes, Syncthing doesn't work on iphone, buy your mother an android , or buy yourself a tie machine and write apps for windows Phone

> buy yourself a tie machine and write apps for windows Phone Took me too long to realize you probably meant ti[m]e machine , but I still don't see how that would fix getting a non-techy off their iPhone.

What do we want?

TIME TRAVEL!

When do we want it?

THAT'S IRRELEVANT!

Re: Bitwarden: Avoid at all costs (outage issue)

#89

Post by cabbagesauce »

8K832d7tNmiQ wrote: post #78

>because I'm stupid enough to trust them with my TOTPs and storing temp verification passwords. I'm sorry, but isn't the highlight of your problem is that you did not separate TOTP with any service that depends on it, including BW?

Good point. At one moment, I switched to BW premium exactly for convenience purposes. Before that, it was Authy for TOTP handling and BW for password manager.

Re: Bitwarden: Avoid at all costs (outage issue)

#90

Post by cabbagesauce »

viro wrote: post #50
cabbagesauce wrote: post #3

Earlier quoted context omitted.

You're one of the anon-Bitwarden boys? 1) I want sane error messages on the client side. 2) I want my feedback on community forums not to be shushed. You screwed up — own it. Community mods aren't janitors to wipe out user feedback. 3) I want the extension to be working no matter what kind of server-side problems you have. Let me know about a sync problem but don't terminate my access. But if you do think, that for $…

Idk why you think you should be able to login to a cloud SaaS product while its down. From your comment here I highly highly doubt you were at all even remotely civil in that forum post $12 a month doesn't mean you get to be an asshole to people. Not all forms of Auth can be done locally, for example most 2fa requires server access.

I can feel uncalled hostility in your attitude, dictated by your conjecture which isn't the right indicator to make judgement about this specific incident. Ad hominem is irrelevant here since it's not about me but service operations.

Anyway, I'll still respond.

>Idk why you think you should be able to login to a cloud SaaS product while its down

The application works without internet access.

> Not all forms of Auth can be done locally, for example most 2fa requires server access.

TOTP validation can be done at the offline level. And the hardest proof of it is that the tokens themselves are generated offline. All that is required at the server side is shared secret and a Unix time syscall. This gets done at the browser extension level[0], no network required.

[0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

Post reply on HN