7 ms·

Move to Bitwarden. It has a great free version but if you want to support them, you can pay 10 USD per year. Less than 1 dollar a month. Really reasonable.

janandonly 6y ago
added bonus, Bitwarden has " only " two trackers in it https://community.bitwarden.com/t/remove-embedded-trackers-from-bitwarden/18925 https://community.bitwarden.com/t/remove-embedded-trackers-f...
- ro_bit 6y ago
  I feel like these trackers (Firebase Analytics and Visual Studio Crash Reporting) need to be looked at in context of the data they actually send and who they report to. According to the thread > In the Mobile apps, Firebase Cloud Messaging (often mistaken for a tracker) is used only for push notifications related to sync and performs absolutely no tracking functions. Microsoft Visual Studio App Center is used for crash reporting on a range of mobile devices. In the Web Vault, Stripe and PayPal scripts are used for payment processing only on payment pages. Compare this to LastPass where it was feeding data to Google Analytics and MixPanel, which do much more invasive levels of analysis in general.
  - thetanil 6y ago
    Firebase is Google. I don't know why they deserve different levels of trust. If Firebase has your permission to harvest your sync info, there is no reason to think this doesn't get copied right on over into googles 'track every click and movement' apparatus.
    - sofixa 6y ago
      Firebase is Google, yes, and the name of a suite of mobile-related products. They have ML Kit, Crash analytics, configuration management, auth etc. Also, Firebase Cloud Messaging is the only way to have push notifications on Android. Using either of their products ( outside of Firebase Analytics and maybe Firebase Auth) isn't tracking users and isn't harvesting user data. It's using tools to make apps, that's it.
      - Nextgrid 6y ago
        This assumes you're trusting Google. Technically you are still sending a lot of data to them (IP address and persistent identifier, which would allow them to correlate other info they gather from other sources) and they have the capability to use it for nefarious purposes if they decide. Google is a malicious actor as a result of their business model and has already demonstrated their willingness to breach the GDPR with the non-compliant tracking consent prompts they use on their services, so it isn't that far-fetched to believe they can also use data from other services in ways you don't expect, especially when they can have plausible deniability.
    - smitop 6y ago
      The Firebase Data Processing and Security Terms [1] (section 5.2.1) limit Google's usage of any data they obtain through Firebase and would seem to prevent that sort of tracking. [1] https://firebase.google.com/terms/data-processing-terms#5.processing-of-data https://firebase.google.com/terms/data-processing-terms#5.pr...
  - Nextgrid 6y ago
    Crash reporting within a password manager is a serious liability considering memory dumps would often contain secrets or encryption keys.
- iCarrot 6y ago
  Also in the same thread, you can download the no tracker version from F-droid.
- deleted 6y ago
  [deleted]
tchalla 6y ago
Bitwarden has one critical feature that makes it unusable. For example, one feature that has been "in the works" for last 3+ years : "auto-save newly created passwords with a prompt" [0]. I understand that it is a different model than LastPass but 3y+ for a critical feature is one of the reasons BitWarden is not the first choices. [0] https://github.com/bitwarden/browser/issues/320 https://github.com/bitwarden/browser/issues/320 PS - If this issue does not occur for you personally, great but it does not for me and many others. Thus, it is unreliable.
- toyg 6y ago
  To clarify: the issue is that autosaving works only some of the time, not that it doesn't exist. From observation, it seemed to be overly keen at one point (prompting excessively) and now is very shy (not prompting even when it really should). At least that's my experience on Firefox. Seems to work better on FF/Mac than FF/Win.
  - tchalla 6y ago
    In my case, the some of time is almost never - macOS /Safari and macOS / Firefox.
francis-io 6y ago
I setup bitwarden_rs recently on my own server with traefik in front. I use the android app and browser plugin which point to my own instance. Currently it's only working on my home network, but I'm working from home. This setup seems fine for me. It seems faster and snappier than Lastpass, but that might just be down to the fact it's hosted on my LAN. All in all, I'm happy I moved and happy I'm now in control of such sensitive information as my passwords.
pizza234 6y ago
Bitwarden is a reasonable alternative, but it's important to be aware of the weak points compared to Lastpass (which IMO, makes it a good-enough-but-no-great-choice). Autofill is relatively poor (it fails even on HN!). Also, Lastpass has a convenient timed expiry that doesn't work (well) on Bitwarden (BW will expire the login when the browser is closed). All in all though, I do support the recommendation, in particular, because Lastpass works extremely poorly on Firefox (at least, that's what caused my switch some time ago).
- rsa25519 6y ago
  > it fails even on HN! Huh, weird, it works fine for me in Firefox.
  - toyg 6y ago
    Same here. I reckon some people set up their passwords manually, or didn't pay attention when creating the item, and now their URL-based autofill is screwed up.
- juriansluiman 6y ago
  > Autofill is relatively poor (it fails even on HN!). Autofill is much more customizable than LastPass afaik. You can both define how (domain)name matching should occur as you can have multiple entries to match. This means you can have instagram.com (as website) and androidapp://com.instagram.android (as app) which will use the same autofill entry. If you configure name matching correctly, any site should be able to provide autofill. My HN entry does match with news.ycombinator.com with default matching settings. But matching settings include hostname / domain name / starts with and even regex! > Also, Lastpass has a convenient timed expiry that doesn't work (well) on Bitwarden (BW will expire the login when the browser is closed). You can specify BW timeout settings. Even further, you can define if BW should lock the session (only a password is required to unlock) or if a sign-out is required. With a sign-out, you also need to provide your MFA if applicable. Time outs can happen directly (after autofill), after an amount of time (1/5/15/30 minutes or 1/4 hours) or upon closing the browser. So tbh, there is plenty to configure Bitwarden to suit your needs.
- 6y ago
aquir 6y ago
I done the same after the first breach and when they almost doubled the yearly sub free. Bitwarden is open source and works just fine. Had no issues with it
int_19h 6y ago
https://lesspass.com/ https://lesspass.com/ is another interesting option.
sneak 6y ago
Bitwarden grants full remote access to your computer to the Bitwarden developers if you use the desktop app. https://github.com/bitwarden/desktop/issues/552 https://github.com/bitwarden/desktop/issues/552 The issue has been reported and they refuse to fix it. This bug renders the Bitwarden encryption irrelevant, as the Bitwarden devs can always access your passwords regardless if they choose.
- codys 6y ago
  For those just scanning the comments, "full remote access" is just being used to mean "has an automatic update system" here
  - sneak 6y ago
    An interaction-free automatic update system is, by definition, RCE, which is equivalent to full remote access. The Bitwarden devs can always access your passwords at any time if they choose to do so, as a result. This, to me, is as serious a vulnerability as lacking encryption in the first place.
    - brigandish 6y ago
      How do they decrypt the vault without the master password?
      - sneak 6y ago
        By replacing the client code with code that exfiltrates the password the next time you enter it. Alternately, brute forcing the client password is straightforward due to their use of a too-fast KDF and low iteration count. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589 https://github.com/bitwarden/server/issues/589
        brigandish 6y ago
        I agree that automatic updates should have a toggle, Signal desktop is another client where the devs won't provide one and have even taken egregious steps to prevent blocking it. Run in a reduced-privilege account though and either client will still require your assent via the admin rights to install. You're also right about the KDF but to be fair to them the devs say they'll accept work from a fork[0] to Argon2, if and when it's done (properly). [0] https://community.bitwarden.com/t/switch-to-argon2/350/24 https://community.bitwarden.com/t/switch-to-argon2/350/24
simias 6y ago
I'm using pass as my password manager but I heard a lot of good about bitwarden so I decided to give it a try, that would be one fewer thing to administrate for me. One very important feature for me is having a command line interface because I have a bunch of scripts that need to be able to query the password manager. Fortunately bitwarden provides a first party CLI that seems pretty fully featured, so I was optimistic. Anyway, I try to install bitwarden-cli through AUR and I see that one of the dependencies is nodejs. Oh no. Right so it's a javascript thingy. I'm a bit shocked, but then I decide that I'm being silly and it's what all the kids use these days and it's just a programming language and who cares. So I decide to push forward and install the binary version of the program (installed size is 65MB, as a comparison point lastpass also provides a CLI tool written in C that's 0.2MB installed). Since I don't know how the tool works, I decide to launch it without argument to get the usage. It takes 0.6 seconds to display the usage. That's with a hot cache. Oh no. So that's the story of how I kept using pass. I know that some people will say that it's not that big of a deal, and I know that for bitwarden's devs it might make sense to implement their client that way because it lets you reuse some code and get good portability, but I just can't even. I'm running on an overclocked desktop computer capable of executing billions of instructions per second, I can play 4K videogames at 60 fps but apparently I get 1.6 UPS (usages per second) with this tool. It unironically makes me sad that this is the state of software engineering nowadays. Reading this thread it seems like it's a mess when it comes to privacy too, so I suppose I dodged a bullet.
- jeroenhd 6y ago
  I've never had a use for a command line password manager so I've got to ask: how does this fit into your workflow? I'm honestly mostly using a password manager in my browser and on my phone; I don't need command line authentication all that often. I didn't even know LastPass had a CLI, but it seems like it's a rewrite of the algorithm and surrounded toolset in C. I can understand why the Bitwarden devs didn't want to go through the effort, though. The tiny minority of Linux-users that want a command-line password manager is not exactly worth a lot of development time, so I figured they just put their JS library in a NodeJS application and called it a day.
  - 6y ago
chronolitus 6y ago
Love bitwarden and use it every day (paid user). I like almost every part of the experience except an annoying issue where the autofill doesn't work on firefox android (everything latest version). it shows up 10% of the time, for a few milliseconds. I've seen similar issues dating back from a year ago (https://github.com/bitwarden/mobile/issues/784 https://github.com/bitwarden/mobile/issues/784). Makes me wonder how such commonly used things can be so broken for so long (see also https://news.ycombinator.com/item?id=26296339 https://news.ycombinator.com/item?id=26296339).
- behringer 6y ago
  Lastpass is the same way.

janandonly 6y ago

added bonus, Bitwarden has " only " two trackers in it https://community.bitwarden.com/t/remove-embedded-trackers-from-bitwarden/18925 https://community.bitwarden.com/t/remove-embedded-trackers-f...

ro_bit 6y ago
I feel like these trackers (Firebase Analytics and Visual Studio Crash Reporting) need to be looked at in context of the data they actually send and who they report to. According to the thread > In the Mobile apps, Firebase Cloud Messaging (often mistaken for a tracker) is used only for push notifications related to sync and performs absolutely no tracking functions. Microsoft Visual Studio App Center is used for crash reporting on a range of mobile devices. In the Web Vault, Stripe and PayPal scripts are used for payment processing only on payment pages. Compare this to LastPass where it was feeding data to Google Analytics and MixPanel, which do much more invasive levels of analysis in general.
- thetanil 6y ago
  Firebase is Google. I don't know why they deserve different levels of trust. If Firebase has your permission to harvest your sync info, there is no reason to think this doesn't get copied right on over into googles 'track every click and movement' apparatus.
  - sofixa 6y ago
    Firebase is Google, yes, and the name of a suite of mobile-related products. They have ML Kit, Crash analytics, configuration management, auth etc. Also, Firebase Cloud Messaging is the only way to have push notifications on Android. Using either of their products ( outside of Firebase Analytics and maybe Firebase Auth) isn't tracking users and isn't harvesting user data. It's using tools to make apps, that's it.
    - Nextgrid 6y ago
      This assumes you're trusting Google. Technically you are still sending a lot of data to them (IP address and persistent identifier, which would allow them to correlate other info they gather from other sources) and they have the capability to use it for nefarious purposes if they decide. Google is a malicious actor as a result of their business model and has already demonstrated their willingness to breach the GDPR with the non-compliant tracking consent prompts they use on their services, so it isn't that far-fetched to believe they can also use data from other services in ways you don't expect, especially when they can have plausible deniability.
  - smitop 6y ago
    The Firebase Data Processing and Security Terms [1] (section 5.2.1) limit Google's usage of any data they obtain through Firebase and would seem to prevent that sort of tracking. [1] https://firebase.google.com/terms/data-processing-terms#5.processing-of-data https://firebase.google.com/terms/data-processing-terms#5.pr...
- Nextgrid 6y ago
  Crash reporting within a password manager is a serious liability considering memory dumps would often contain secrets or encryption keys.
iCarrot 6y ago
Also in the same thread, you can download the no tracker version from F-droid.
deleted 6y ago
[deleted]

tchalla 6y ago

Bitwarden has one critical feature that makes it unusable. For example, one feature that has been "in the works" for last 3+ years : "auto-save newly created passwords with a prompt" [0]. I understand that it is a different model than LastPass but 3y+ for a critical feature is one of the reasons BitWarden is not the first choices. [0] https://github.com/bitwarden/browser/issues/320 https://github.com/bitwarden/browser/issues/320 PS - If this issue does not occur for you personally, great but it does not for me and many others. Thus, it is unreliable.

toyg 6y ago
To clarify: the issue is that autosaving works only some of the time, not that it doesn't exist. From observation, it seemed to be overly keen at one point (prompting excessively) and now is very shy (not prompting even when it really should). At least that's my experience on Firefox. Seems to work better on FF/Mac than FF/Win.
- tchalla 6y ago
  In my case, the some of time is almost never - macOS /Safari and macOS / Firefox.

francis-io 6y ago

I setup bitwarden_rs recently on my own server with traefik in front. I use the android app and browser plugin which point to my own instance. Currently it's only working on my home network, but I'm working from home. This setup seems fine for me. It seems faster and snappier than Lastpass, but that might just be down to the fact it's hosted on my LAN. All in all, I'm happy I moved and happy I'm now in control of such sensitive information as my passwords.

pizza234 6y ago

Bitwarden is a reasonable alternative, but it's important to be aware of the weak points compared to Lastpass (which IMO, makes it a good-enough-but-no-great-choice). Autofill is relatively poor (it fails even on HN!). Also, Lastpass has a convenient timed expiry that doesn't work (well) on Bitwarden (BW will expire the login when the browser is closed). All in all though, I do support the recommendation, in particular, because Lastpass works extremely poorly on Firefox (at least, that's what caused my switch some time ago).

rsa25519 6y ago
> it fails even on HN! Huh, weird, it works fine for me in Firefox.
- toyg 6y ago
  Same here. I reckon some people set up their passwords manually, or didn't pay attention when creating the item, and now their URL-based autofill is screwed up.
juriansluiman 6y ago
> Autofill is relatively poor (it fails even on HN!). Autofill is much more customizable than LastPass afaik. You can both define how (domain)name matching should occur as you can have multiple entries to match. This means you can have instagram.com (as website) and androidapp://com.instagram.android (as app) which will use the same autofill entry. If you configure name matching correctly, any site should be able to provide autofill. My HN entry does match with news.ycombinator.com with default matching settings. But matching settings include hostname / domain name / starts with and even regex! > Also, Lastpass has a convenient timed expiry that doesn't work (well) on Bitwarden (BW will expire the login when the browser is closed). You can specify BW timeout settings. Even further, you can define if BW should lock the session (only a password is required to unlock) or if a sign-out is required. With a sign-out, you also need to provide your MFA if applicable. Time outs can happen directly (after autofill), after an amount of time (1/5/15/30 minutes or 1/4 hours) or upon closing the browser. So tbh, there is plenty to configure Bitwarden to suit your needs.
6y ago

aquir 6y ago

I done the same after the first breach and when they almost doubled the yearly sub free. Bitwarden is open source and works just fine. Had no issues with it

int_19h 6y ago

https://lesspass.com/ https://lesspass.com/ is another interesting option.

sneak 6y ago

Bitwarden grants full remote access to your computer to the Bitwarden developers if you use the desktop app. https://github.com/bitwarden/desktop/issues/552 https://github.com/bitwarden/desktop/issues/552 The issue has been reported and they refuse to fix it. This bug renders the Bitwarden encryption irrelevant, as the Bitwarden devs can always access your passwords regardless if they choose.

codys 6y ago
For those just scanning the comments, "full remote access" is just being used to mean "has an automatic update system" here
- sneak 6y ago
  An interaction-free automatic update system is, by definition, RCE, which is equivalent to full remote access. The Bitwarden devs can always access your passwords at any time if they choose to do so, as a result. This, to me, is as serious a vulnerability as lacking encryption in the first place.
  - brigandish 6y ago
    How do they decrypt the vault without the master password?
    - sneak 6y ago
      By replacing the client code with code that exfiltrates the password the next time you enter it. Alternately, brute forcing the client password is straightforward due to their use of a too-fast KDF and low iteration count. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589 https://github.com/bitwarden/server/issues/589
      - brigandish 6y ago
        I agree that automatic updates should have a toggle, Signal desktop is another client where the devs won't provide one and have even taken egregious steps to prevent blocking it. Run in a reduced-privilege account though and either client will still require your assent via the admin rights to install. You're also right about the KDF but to be fair to them the devs say they'll accept work from a fork[0] to Argon2, if and when it's done (properly). [0] https://community.bitwarden.com/t/switch-to-argon2/350/24 https://community.bitwarden.com/t/switch-to-argon2/350/24

simias 6y ago

I'm using pass as my password manager but I heard a lot of good about bitwarden so I decided to give it a try, that would be one fewer thing to administrate for me. One very important feature for me is having a command line interface because I have a bunch of scripts that need to be able to query the password manager. Fortunately bitwarden provides a first party CLI that seems pretty fully featured, so I was optimistic. Anyway, I try to install bitwarden-cli through AUR and I see that one of the dependencies is nodejs. Oh no. Right so it's a javascript thingy. I'm a bit shocked, but then I decide that I'm being silly and it's what all the kids use these days and it's just a programming language and who cares. So I decide to push forward and install the binary version of the program (installed size is 65MB, as a comparison point lastpass also provides a CLI tool written in C that's 0.2MB installed). Since I don't know how the tool works, I decide to launch it without argument to get the usage. It takes 0.6 seconds to display the usage. That's with a hot cache. Oh no. So that's the story of how I kept using pass. I know that some people will say that it's not that big of a deal, and I know that for bitwarden's devs it might make sense to implement their client that way because it lets you reuse some code and get good portability, but I just can't even. I'm running on an overclocked desktop computer capable of executing billions of instructions per second, I can play 4K videogames at 60 fps but apparently I get 1.6 UPS (usages per second) with this tool. It unironically makes me sad that this is the state of software engineering nowadays. Reading this thread it seems like it's a mess when it comes to privacy too, so I suppose I dodged a bullet.

jeroenhd 6y ago
I've never had a use for a command line password manager so I've got to ask: how does this fit into your workflow? I'm honestly mostly using a password manager in my browser and on my phone; I don't need command line authentication all that often. I didn't even know LastPass had a CLI, but it seems like it's a rewrite of the algorithm and surrounded toolset in C. I can understand why the Bitwarden devs didn't want to go through the effort, though. The tiny minority of Linux-users that want a command-line password manager is not exactly worth a lot of development time, so I figured they just put their JS library in a NodeJS application and called it a day.
- 6y ago

chronolitus 6y ago

Love bitwarden and use it every day (paid user). I like almost every part of the experience except an annoying issue where the autofill doesn't work on firefox android (everything latest version). it shows up 10% of the time, for a few milliseconds. I've seen similar issues dating back from a year ago (https://github.com/bitwarden/mobile/issues/784 https://github.com/bitwarden/mobile/issues/784). Makes me wonder how such commonly used things can be so broken for so long (see also https://news.ycombinator.com/item?id=26296339 https://news.ycombinator.com/item?id=26296339).

behringer 6y ago
Lastpass is the same way.