5 ms·

I would like to switch to Bitwarden, but I don't know how I can assure I can trust them with all my passwords. Are any of the founders well-known security exper

I would like to switch to Bitwarden, but I don't know how I can assure I can trust them with all my passwords. Are any of the founders well-known security experts? Has the service been recommended by respected security researchers? I am not a security expert, so I cannot assert their trustworthiness myself. I know that you can run your own server. But even then, without auditing the code, configuring a firewall, and checking network logs, I cannot assure the server and the clients do not call home. And all of those solutions are both prohibitively time-consuming and way out of my area of expertise. How did you decide Bitwarden was trustworthy? How can I stop worrying and give them my passwords already?

terminalcommand 9y ago
I use KeePass as my password manager, it doesn't sync automatically across all my devices, I occasionaly transfer my keys database to my phone. You could always upload your encrypted key database to dropbox, and keep your private key on your phone, on your computer, or on a USB stick, if you want automatic sync.
- zzalpha 9y ago
  Syncthing + KeePass works very well for cross device peer-to-peer syncing. Just make sure to configure Syncthing to ignore KeePass lockfiles.
lern_too_spel 9y ago
It has no unit tests.
satysin 9y ago
I didn't pick Bitwarden right away. The comment that mentioned it prompted me to research password managers in general. I looked at primarily online (1Password, LastPass, Bitwarden, etc) and offline desktop client ones (Keepass). I do prefer the idea of using something like Keepass and not relying on a service but I found it rather frustrating to manage between my multiple devices. I knew if I were to actually make use of a password manager it needed to be a smooth experience because otherwise I would just return to using Chrome's built in one out of laziness. After researching the main online managers I decided to go with Bitwarden. It is open source so if it does do something dodgy I would hope it is found and reported. I do not have the time nor expertise to audit all of the code myself so I have to put some trust in others. Plus while it would be a real pain in the ass if accounts were compromised due to the developer being an asshole/idiot it wouldn't destroy my life. I have a strong password on my primary email account (not stored in Bitwarden) along with 2FA. Most of the logins stored in Bitwarden are for things like Hacker News, Reddit, Slack (personal not work), etc. Randomly generated 18+ character strings that are a pain to enter manually, especially on a phone.
- zzalpha 9y ago
  FYI: KeePass plus Syncthing works great for me for cross-device password databases.
  - satysin 9y ago
    Will have to check this out. Not used Syncthing before. Thanks!
    - zzalpha 9y ago
      No problem! As I mentioned in my other comment, the only gotcha is to make sure you set up your syncthing ignore file to ignore the KeePass database lockfile.

terminalcommand 9y ago

I use KeePass as my password manager, it doesn't sync automatically across all my devices, I occasionaly transfer my keys database to my phone. You could always upload your encrypted key database to dropbox, and keep your private key on your phone, on your computer, or on a USB stick, if you want automatic sync.

zzalpha 9y ago
Syncthing + KeePass works very well for cross device peer-to-peer syncing. Just make sure to configure Syncthing to ignore KeePass lockfiles.

lern_too_spel 9y ago

It has no unit tests.

satysin 9y ago

I didn't pick Bitwarden right away. The comment that mentioned it prompted me to research password managers in general. I looked at primarily online (1Password, LastPass, Bitwarden, etc) and offline desktop client ones (Keepass). I do prefer the idea of using something like Keepass and not relying on a service but I found it rather frustrating to manage between my multiple devices. I knew if I were to actually make use of a password manager it needed to be a smooth experience because otherwise I would just return to using Chrome's built in one out of laziness. After researching the main online managers I decided to go with Bitwarden. It is open source so if it does do something dodgy I would hope it is found and reported. I do not have the time nor expertise to audit all of the code myself so I have to put some trust in others. Plus while it would be a real pain in the ass if accounts were compromised due to the developer being an asshole/idiot it wouldn't destroy my life. I have a strong password on my primary email account (not stored in Bitwarden) along with 2FA. Most of the logins stored in Bitwarden are for things like Hacker News, Reddit, Slack (personal not work), etc. Randomly generated 18+ character strings that are a pain to enter manually, especially on a phone.

zzalpha 9y ago
FYI: KeePass plus Syncthing works great for me for cross-device password databases.
- satysin 9y ago
  Will have to check this out. Not used Syncthing before. Thanks!
  - zzalpha 9y ago
    No problem! As I mentioned in my other comment, the only gotcha is to make sure you set up your syncthing ignore file to ignore the KeePass database lockfile.