7 ms·

If you're interested in an open source option that compares quite well to the LastPass feature-set, check out bitwarden: https://bitwarden.com/ https://bitwarde

If you're interested in an open source option that compares quite well to the LastPass feature-set, check out bitwarden: https://bitwarden.com/ https://bitwarden.com/ (note: I am the lead developer).

bgrohman 10y ago
Hi, I'm considering giving bitwarden a try. I'm curious, though - are there any 3rd party security scans for the product? And (only half-joking) can we get Tavis to review it?
- xxkylexx 10y ago
  There have not been any formal third-party audits done that we can document yet, however, the product is entirely open source (from the database, backend apis, to all client-side applications). https://github.com/bitwarden https://github.com/bitwarden . Anyone is free to audit (and contribute) as much as they'd like. If you can get Travis (or any security researcher) interested in reviewing our products we would love to work with him.
  - bgrohman 10y ago
    Thanks. Are there any plans to have routine security audits done?
    - xxkylexx 10y ago
      As we bring some of our revenue generating features online we hope to have the cash flow to fund regular third-party audits.
devopsproject 10y ago
How are you making money off of this?
- xxkylexx 10y ago
  bitwarden is currently sponsored by the Microsoft BizSpark program which covers many of our operation costs and allows us to offer services for free to our users. We are working to introduce enterprise features for businesses in the future (scheduled for release next month) which will allow us to monetize. In the meantime, everything is free for users.
  - stryk 10y ago
    Which of the current free-for-everyone features, if any, are you considering making available to paid accounts only? (i.e., what will your current free users lose unless they move to a paid account once you monetize?)
    - xxkylexx 10y ago
      Everything you see today will remain free for personal users.
Veratyr 10y ago
I'm not the lead developer (or involved with the project at all) and I also recommend it. Only issues I have right now are: - No app-fill on Android. - No auto-fill (have to manually click the icon and select an account). - When using Firefox the extension periodically logs out for no apparent reason. - There's no address/wallet stuff so I actually have to pull out my credit cards. Other than that it works pretty well.
- xxkylexx 10y ago
  - We released app-fill (autofill) on android last month. Make sure you are using version 1.3.0 or greater. Read more here: https://blog.bitwarden.com/android-v1-3-0-now-with-auto-fill-a0b582ada0e9#.dnh2pm7hf https://blog.bitwarden.com/android-v1-3-0-now-with-auto-fill... - We also fixed the issue you are referring to on Firefox last week. Make sure you are using 1.10.1 - There are plans for additional "wallet" features in the future.
  - Veratyr 10y ago
    Woo! I just got app-fill working. To be clear though, app-fill and auto-fill were referring to different things. What I meant by lack of "auto-fill" was that when I visit a website on desktop, my details aren't instantly filled when the page loads. I have to manually click the extension icon in my browser and select the account I want.
    - fencepost 10y ago
      This is not always a bad thing. Sometimes you don't want software to automatically plunk your login credentials into appropriately named fields on a JavaScript driven web page
      - xxkylexx 10y ago
        This is why we don't offer this feature. This feature is one of the major offenders for lastpass in the past. It's very easy to get wrong and expose vulnerabilities.
toyg 10y ago
Looks cool. My personal "I can't use it because it lacks X" list: - Firefox extension - Password generator But I'll keep an eye on it. LastPass is far from perfect.
- xxkylexx 10y ago
  We have both of these things: - Firefox: https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/ https://addons.mozilla.org/en-US/firefox/addon/bitwarden-pas... - Generator: http://imgur.com/3q4w9Mn.png http://imgur.com/3q4w9Mn.png
  - toyg 10y ago
    You need to update your user home screen then, both features have empty links saying "coming soon".
- jonathonf 10y ago
  bitwarden has a Firefox extension [1], and it has a password generator. [1] https://addons.mozilla.org/firefox/addon/bitwarden-password-manager/ https://addons.mozilla.org/firefox/addon/bitwarden-password-...
pvg 10y ago
Perhaps you missed it at the time but I'm wondering if you can answer this https://news.ycombinator.com/item?id=13438225 https://news.ycombinator.com/item?id=13438225
mdekkers 10y ago
cool, thanks - I'll have a look!
sndean 10y ago
Thanks for this comment. I switched to bitwarden from LastPass last night.

If you're interested in an open source option that compares quite well to the LastPass feature-set, check out bitwarden: https://bitwarden.com/ https://bitwarden.com/ (note: I am the lead developer).

bgrohman 10y ago

Hi, I'm considering giving bitwarden a try. I'm curious, though - are there any 3rd party security scans for the product? And (only half-joking) can we get Tavis to review it?

xxkylexx 10y ago
There have not been any formal third-party audits done that we can document yet, however, the product is entirely open source (from the database, backend apis, to all client-side applications). https://github.com/bitwarden https://github.com/bitwarden . Anyone is free to audit (and contribute) as much as they'd like. If you can get Travis (or any security researcher) interested in reviewing our products we would love to work with him.
- bgrohman 10y ago
  Thanks. Are there any plans to have routine security audits done?
  - xxkylexx 10y ago
    As we bring some of our revenue generating features online we hope to have the cash flow to fund regular third-party audits.

devopsproject 10y ago

How are you making money off of this?

xxkylexx 10y ago
bitwarden is currently sponsored by the Microsoft BizSpark program which covers many of our operation costs and allows us to offer services for free to our users. We are working to introduce enterprise features for businesses in the future (scheduled for release next month) which will allow us to monetize. In the meantime, everything is free for users.
- stryk 10y ago
  Which of the current free-for-everyone features, if any, are you considering making available to paid accounts only? (i.e., what will your current free users lose unless they move to a paid account once you monetize?)
  - xxkylexx 10y ago
    Everything you see today will remain free for personal users.

Veratyr 10y ago

I'm not the lead developer (or involved with the project at all) and I also recommend it. Only issues I have right now are: - No app-fill on Android. - No auto-fill (have to manually click the icon and select an account). - When using Firefox the extension periodically logs out for no apparent reason. - There's no address/wallet stuff so I actually have to pull out my credit cards. Other than that it works pretty well.

xxkylexx 10y ago
- We released app-fill (autofill) on android last month. Make sure you are using version 1.3.0 or greater. Read more here: https://blog.bitwarden.com/android-v1-3-0-now-with-auto-fill-a0b582ada0e9#.dnh2pm7hf https://blog.bitwarden.com/android-v1-3-0-now-with-auto-fill... - We also fixed the issue you are referring to on Firefox last week. Make sure you are using 1.10.1 - There are plans for additional "wallet" features in the future.
- Veratyr 10y ago
  Woo! I just got app-fill working. To be clear though, app-fill and auto-fill were referring to different things. What I meant by lack of "auto-fill" was that when I visit a website on desktop, my details aren't instantly filled when the page loads. I have to manually click the extension icon in my browser and select the account I want.
  - fencepost 10y ago
    This is not always a bad thing. Sometimes you don't want software to automatically plunk your login credentials into appropriately named fields on a JavaScript driven web page
    - xxkylexx 10y ago
      This is why we don't offer this feature. This feature is one of the major offenders for lastpass in the past. It's very easy to get wrong and expose vulnerabilities.

toyg 10y ago

Looks cool. My personal "I can't use it because it lacks X" list: - Firefox extension - Password generator But I'll keep an eye on it. LastPass is far from perfect.

xxkylexx 10y ago
We have both of these things: - Firefox: https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/ https://addons.mozilla.org/en-US/firefox/addon/bitwarden-pas... - Generator: http://imgur.com/3q4w9Mn.png http://imgur.com/3q4w9Mn.png
- toyg 10y ago
  You need to update your user home screen then, both features have empty links saying "coming soon".
jonathonf 10y ago
bitwarden has a Firefox extension [1], and it has a password generator. [1] https://addons.mozilla.org/firefox/addon/bitwarden-password-manager/ https://addons.mozilla.org/firefox/addon/bitwarden-password-...

pvg 10y ago

Perhaps you missed it at the time but I'm wondering if you can answer this https://news.ycombinator.com/item?id=13438225 https://news.ycombinator.com/item?id=13438225

mdekkers 10y ago

cool, thanks - I'll have a look!

sndean 10y ago

Thanks for this comment. I switched to bitwarden from LastPass last night.