5 ms·

I'm a paid licence holder for 1Password, but am uncomfortable with being more and more forcefully pushed into using their cloud-based subscription service (whic

I'm a paid licence holder for 1Password, but am uncomfortable with being more and more forcefully pushed into using their cloud-based subscription service (which while I use for work, I'd rather _not_ us personally). What're people's experiences with alternatives to 1PW - ones that do device-device sync and work at least across iOS/macos and ideally integrate nicely with browsers and apps on both those platforms? Is BitWarden ready for prime time for something as critical as secure password storage yet? Does it's iOS app take advantage of the secure enclave features of iPhones?

deleted 7y ago
[deleted]
jerrac 7y ago
Not sure how it would work with iOS, but keeweb (or keepass) .kdbx files sync really well via syncthing. Even to my mobile devices.
mceachen 7y ago
I had my whole extended family on 1PW. We've all switched to Bitwarden (after a few transgressed to LastPass, but that's behind us now), and we're happy. Having the developer respond quickly on email is delightful, it works great on Ubuntu, macOS, Windows, Chrome OS, Android, Firefox, and sharing credentials between accounts works seamlessly.
- rkagerer 7y ago
  How's BitWarden at autofilling forms on webpages? Does it work in Chrome on Android (or other mobile browsers)? Can you authenticate with a fingerprint? Can you force a non-fingerprint method after device reboot or a certain period of time? I might have a closer look at it myself.
  - mceachen 7y ago
    > autofilling forms on webpages It works fairly well. Some sites (banking, mostly) don't work, but the UI lets you easily copy the username or password so you can paste it where it should go. > Does it work in Chrome on Android Yes, and Firefox on Android. > Can you authenticate with a fingerprint That's how I have it set up. > Can you force a non-fingerprint method after device reboot or a certain period of time? Maybe? I haven't seen (nor looked for) that feature.
  - dsissitka 7y ago
    > How's BitWarden at autofilling forms on webpages? I don't think I ever had any issues with it. It looks like it might use some old code from 1Password: https://github.com/bitwarden/browser/blob/280f6f495f9f8bdfe3d68709fcbfdb88869e21d5/src/content/autofill.js https://github.com/bitwarden/browser/blob/280f6f495f9f8bdfe3...
    - syntheticcdo 7y ago
      This is one of the most interesting things I've seen in this thread. I would not have expected 1Password to make any part of their platform MIT licensed.
  - pedrocx486 7y ago
    Autofill on desktop is pretty amazing, I never had problems. On Chrome Android it uses the autofill APIs and is quite good but not perfect. You can authenticate with a fingerprints and afaik no, you can't force pin after a reboot/period of time. I never had trouble with it regarding that part and still recommend it. It also accepts 2FA with an YubiKey.
- ppseafield 7y ago
  I second Bitwarden. Possible to self-host, open source, and works everywhere I want to.
Nullabillity 7y ago
KeePassXC is FOSS, free of cloud nonsense, works fine on desktop, and has integrations for most browsers. I have no idea about the iOS situation, but on Android KeePass2Android provides global autofill and works with a ton of storage providers (everything from Dropbox to bring-your-own-SFTP).
- hanklazard 7y ago
  On iOS, there’s KyPass. It plays nicely with the Linux and Mac versions of Keepass, syncs with Dropbox, supports Touch ID, etc. There was a reasonable one-time purchase price, I believe. I switched to the Keepass world a while back when 1Password started to try to nudge me into paying a monthly fee for software that I already paid for on multiple platforms. The Keepass variants aren’t as slick but who cares.
  - bigiain 7y ago
    I actually _do_ care enough about "slickness" to be prepared to pay for it. I want to be able to keep my encrypted password db off other people's computers though - using 1PW's cloud service requiring Dropbox for multi device sync is not what I'm after...
    - hanklazard 7y ago
      I paid about 50$ or so for it with no complaints. I’m not willing to pay that plus a subscription fee for what is, at the end of the day, a small encrypted database.
- bolzano 7y ago
  Big fan of KeePass. On Mac KeePassXC is great, on Windows KeePass, but on iOS I use Strongbox [1] which is excellent. Auto fill works well, it's open source [2] and actively developed, I really don't trust none open source password managers [1] https://apps.apple.com/us/app/strongbox-password-safe/id897283731 https://apps.apple.com/us/app/strongbox-password-safe/id8972... [2] https://github.com/mmcguill/Strongbox/ https://github.com/mmcguill/Strongbox/
snailmailman 7y ago
I don’t know about the secure enclave, but I can anecdotally say that I’ve been using Bitwarden seamlessly across iOS/Windows/Linux for a while now. It uses the convenient auto fill api thing on iOS and the extension is pretty good on desktop as well. (Although I haven’t worked with it on Mac) Haven’t had any issues, I switched from LastPass and the only feature I miss for personal use is password sharing. I think it was in the free version of LastPass but not part of Bitwarden. I didn’t really use that feature much anyway though.
- Fnoord 7y ago
  I use it daily on a Mac. Works great, just like it does on Windows/Linux/Android. Can't comment on iOS.
stevewillows 7y ago
I've been using Bitwarden since just after it launched. I've yet to have any issue with it. The desktop, browser, and mobile clients are all seamless and... well, just work. I was part of the LastPass exodus after their acquision and used 1Pass with Windows and (then) OSX. The lack of Linux client was a hassle, and eventually left me shopping around. I tried Keepassx and the others, but I ran into issues with sync (most likely my error.) I saw Bitwarden mentioned here and gave it a swing. Importing everything only took a minute, and I haven't looked back. It works on all operating systems, has 2FA, etc etc. It's perfect for my needs. At some point in the future I may go self-hosted.
- whydoineedthis 7y ago
  yup. similar journey. I think LastPass is going out of business - we were enterprise subscribers last year and it was impossible to get in contact with support when our license expired. couldn't even get in contact with a sales person - they literally didn't want our money anymore. Switched to BitWarden and am so much happier with the interface and such better pricing than 1password, plus i feel have always been upfront with their product development while 1password has been, um, sorta shady, imho.
  - stevewillows 7y ago
    that's crazy about LastPass. It was a decent product for its time, but password managers evolved quite quickly over the past few years. My beef with 1Pass is that they charged around $35 - $50 for their standalone product during the exodus, and about a year later moved to their subscription platform --- pretty much abandoning development for the standalone users. The OSX application was far less buggy than the Windows client. And when you needed to grab a new copy of the standalone client, it was buried on their site in a FAQ. 1Pass should have offered a few months for free to pull the standalone folks over to the new service, but instead they said 'we don't have any offers, but feel free to contact sales' -- which is a difficult sell when compared to the newly polished Bitwarden that works on all systems and browsers out of the box without any requirement for payment or a subscription. All this said, we're technical people, so we're more aware of sketchy practices and are quick to jump to different products, and may not be their target -- especially with their previous lack of Linux support.
dsissitka 7y ago
> Is BitWarden ready for prime time for something as critical as secure password storage yet? It works pretty well, but the user experience eventually drove me back to 1Password: https://news.ycombinator.com/item?id=19839087 https://news.ycombinator.com/item?id=19839087 #4 in particular.
- dev_dull 7y ago
  Does it auto lock? That sounds annoying. Saving passwords not as big of a deal, but definitely for filling in passwords.
  - Fnoord 7y ago
    You can set timeout on auto lock or put it on different settings such as browser restart, OS restart, or never.
- jonathankoren 7y ago
  That’s horrible. How is that not considered a bug?
  - dsissitka 7y ago
    The developer says "Unfortunately the browser APIs don’t allow for this.": https://community.bitwarden.com/t/autofill-shortcut-should-open-login-window-when-vault-is-locked/1494/2 https://community.bitwarden.com/t/autofill-shortcut-should-o...
    - jonathankoren 7y ago
      Now I’m going to have to check see what 1 Password does in this situation.
stouset 7y ago
I took one look at BitWarden and, as a security person, ran the other way when I saw the CLI expects you to enter your password on the command line in order to operate it. This password gets exposed in your shell history, to anyone who can view a process list, etc. If a company writing a security product can be this incompetent about something so basic, I don’t have any interest in gambling that the rest of their product is any better.
- xref 7y ago
  You mean the cli doesn’t prompt you to type the pwd separate from the cli command itself, akin to how Postgres ‘psql -p’ works?
  - stouset 7y ago
    According to the docs, all of the relevant commands accept the password as an argument to the binary itself. https://help.bitwarden.com/article/cli/ https://help.bitwarden.com/article/cli/
  - krmbzds 7y ago
    It does. In fact, when you --help in the cli tool the first example it suggests is to login with "bw login" command which is the default way.
- txcwpalpha 7y ago
  Did you actually try using the CLI tool, or did you only read the documentation? The documentation isn't super clear, but in actual usage your password (nor your email) doesn't get entered into shell history or otherwise. You can pass your email and password as arguments to the "bw login [email] [password]" command, which will put them into your history, but the default way of typing "bw login" will then prompt you for them both, masking your password just like any other CLI tool does.
  - stouset 7y ago
    If if you can do this, the fact that the documentation encourages you to do otherwise is extremely worrisome. Securely-written tools shouldn't even allow you to do this in the first place, much less promote it. https://help.bitwarden.com/article/cli/ https://help.bitwarden.com/article/cli/

deleted 7y ago

[deleted]

jerrac 7y ago

Not sure how it would work with iOS, but keeweb (or keepass) .kdbx files sync really well via syncthing. Even to my mobile devices.

mceachen 7y ago

I had my whole extended family on 1PW. We've all switched to Bitwarden (after a few transgressed to LastPass, but that's behind us now), and we're happy. Having the developer respond quickly on email is delightful, it works great on Ubuntu, macOS, Windows, Chrome OS, Android, Firefox, and sharing credentials between accounts works seamlessly.

rkagerer 7y ago
How's BitWarden at autofilling forms on webpages? Does it work in Chrome on Android (or other mobile browsers)? Can you authenticate with a fingerprint? Can you force a non-fingerprint method after device reboot or a certain period of time? I might have a closer look at it myself.
- mceachen 7y ago
  > autofilling forms on webpages It works fairly well. Some sites (banking, mostly) don't work, but the UI lets you easily copy the username or password so you can paste it where it should go. > Does it work in Chrome on Android Yes, and Firefox on Android. > Can you authenticate with a fingerprint That's how I have it set up. > Can you force a non-fingerprint method after device reboot or a certain period of time? Maybe? I haven't seen (nor looked for) that feature.
- dsissitka 7y ago
  > How's BitWarden at autofilling forms on webpages? I don't think I ever had any issues with it. It looks like it might use some old code from 1Password: https://github.com/bitwarden/browser/blob/280f6f495f9f8bdfe3d68709fcbfdb88869e21d5/src/content/autofill.js https://github.com/bitwarden/browser/blob/280f6f495f9f8bdfe3...
  - syntheticcdo 7y ago
    This is one of the most interesting things I've seen in this thread. I would not have expected 1Password to make any part of their platform MIT licensed.
- pedrocx486 7y ago
  Autofill on desktop is pretty amazing, I never had problems. On Chrome Android it uses the autofill APIs and is quite good but not perfect. You can authenticate with a fingerprints and afaik no, you can't force pin after a reboot/period of time. I never had trouble with it regarding that part and still recommend it. It also accepts 2FA with an YubiKey.
ppseafield 7y ago
I second Bitwarden. Possible to self-host, open source, and works everywhere I want to.

Nullabillity 7y ago

KeePassXC is FOSS, free of cloud nonsense, works fine on desktop, and has integrations for most browsers. I have no idea about the iOS situation, but on Android KeePass2Android provides global autofill and works with a ton of storage providers (everything from Dropbox to bring-your-own-SFTP).

hanklazard 7y ago
On iOS, there’s KyPass. It plays nicely with the Linux and Mac versions of Keepass, syncs with Dropbox, supports Touch ID, etc. There was a reasonable one-time purchase price, I believe. I switched to the Keepass world a while back when 1Password started to try to nudge me into paying a monthly fee for software that I already paid for on multiple platforms. The Keepass variants aren’t as slick but who cares.
- bigiain 7y ago
  I actually _do_ care enough about "slickness" to be prepared to pay for it. I want to be able to keep my encrypted password db off other people's computers though - using 1PW's cloud service requiring Dropbox for multi device sync is not what I'm after...
  - hanklazard 7y ago
    I paid about 50$ or so for it with no complaints. I’m not willing to pay that plus a subscription fee for what is, at the end of the day, a small encrypted database.
bolzano 7y ago
Big fan of KeePass. On Mac KeePassXC is great, on Windows KeePass, but on iOS I use Strongbox [1] which is excellent. Auto fill works well, it's open source [2] and actively developed, I really don't trust none open source password managers [1] https://apps.apple.com/us/app/strongbox-password-safe/id897283731 https://apps.apple.com/us/app/strongbox-password-safe/id8972... [2] https://github.com/mmcguill/Strongbox/ https://github.com/mmcguill/Strongbox/

snailmailman 7y ago

I don’t know about the secure enclave, but I can anecdotally say that I’ve been using Bitwarden seamlessly across iOS/Windows/Linux for a while now. It uses the convenient auto fill api thing on iOS and the extension is pretty good on desktop as well. (Although I haven’t worked with it on Mac) Haven’t had any issues, I switched from LastPass and the only feature I miss for personal use is password sharing. I think it was in the free version of LastPass but not part of Bitwarden. I didn’t really use that feature much anyway though.

Fnoord 7y ago
I use it daily on a Mac. Works great, just like it does on Windows/Linux/Android. Can't comment on iOS.

stevewillows 7y ago

I've been using Bitwarden since just after it launched. I've yet to have any issue with it. The desktop, browser, and mobile clients are all seamless and... well, just work. I was part of the LastPass exodus after their acquision and used 1Pass with Windows and (then) OSX. The lack of Linux client was a hassle, and eventually left me shopping around. I tried Keepassx and the others, but I ran into issues with sync (most likely my error.) I saw Bitwarden mentioned here and gave it a swing. Importing everything only took a minute, and I haven't looked back. It works on all operating systems, has 2FA, etc etc. It's perfect for my needs. At some point in the future I may go self-hosted.

whydoineedthis 7y ago
yup. similar journey. I think LastPass is going out of business - we were enterprise subscribers last year and it was impossible to get in contact with support when our license expired. couldn't even get in contact with a sales person - they literally didn't want our money anymore. Switched to BitWarden and am so much happier with the interface and such better pricing than 1password, plus i feel have always been upfront with their product development while 1password has been, um, sorta shady, imho.
- stevewillows 7y ago
  that's crazy about LastPass. It was a decent product for its time, but password managers evolved quite quickly over the past few years. My beef with 1Pass is that they charged around $35 - $50 for their standalone product during the exodus, and about a year later moved to their subscription platform --- pretty much abandoning development for the standalone users. The OSX application was far less buggy than the Windows client. And when you needed to grab a new copy of the standalone client, it was buried on their site in a FAQ. 1Pass should have offered a few months for free to pull the standalone folks over to the new service, but instead they said 'we don't have any offers, but feel free to contact sales' -- which is a difficult sell when compared to the newly polished Bitwarden that works on all systems and browsers out of the box without any requirement for payment or a subscription. All this said, we're technical people, so we're more aware of sketchy practices and are quick to jump to different products, and may not be their target -- especially with their previous lack of Linux support.

dsissitka 7y ago

> Is BitWarden ready for prime time for something as critical as secure password storage yet? It works pretty well, but the user experience eventually drove me back to 1Password: https://news.ycombinator.com/item?id=19839087 https://news.ycombinator.com/item?id=19839087 #4 in particular.

dev_dull 7y ago
Does it auto lock? That sounds annoying. Saving passwords not as big of a deal, but definitely for filling in passwords.
- Fnoord 7y ago
  You can set timeout on auto lock or put it on different settings such as browser restart, OS restart, or never.
jonathankoren 7y ago
That’s horrible. How is that not considered a bug?
- dsissitka 7y ago
  The developer says "Unfortunately the browser APIs don’t allow for this.": https://community.bitwarden.com/t/autofill-shortcut-should-open-login-window-when-vault-is-locked/1494/2 https://community.bitwarden.com/t/autofill-shortcut-should-o...
  - jonathankoren 7y ago
    Now I’m going to have to check see what 1 Password does in this situation.

stouset 7y ago

I took one look at BitWarden and, as a security person, ran the other way when I saw the CLI expects you to enter your password on the command line in order to operate it. This password gets exposed in your shell history, to anyone who can view a process list, etc. If a company writing a security product can be this incompetent about something so basic, I don’t have any interest in gambling that the rest of their product is any better.

xref 7y ago
You mean the cli doesn’t prompt you to type the pwd separate from the cli command itself, akin to how Postgres ‘psql -p’ works?
- stouset 7y ago
  According to the docs, all of the relevant commands accept the password as an argument to the binary itself. https://help.bitwarden.com/article/cli/ https://help.bitwarden.com/article/cli/
- krmbzds 7y ago
  It does. In fact, when you --help in the cli tool the first example it suggests is to login with "bw login" command which is the default way.
txcwpalpha 7y ago
Did you actually try using the CLI tool, or did you only read the documentation? The documentation isn't super clear, but in actual usage your password (nor your email) doesn't get entered into shell history or otherwise. You can pass your email and password as arguments to the "bw login [email] [password]" command, which will put them into your history, but the default way of typing "bw login" will then prompt you for them both, masking your password just like any other CLI tool does.
- stouset 7y ago
  If if you can do this, the fact that the documentation encourages you to do otherwise is extremely worrisome. Securely-written tools shouldn't even allow you to do this in the first place, much less promote it. https://help.bitwarden.com/article/cli/ https://help.bitwarden.com/article/cli/