16 ms·
Bitwarden Send - A trusted way to securely share information with anyone
- contravariant 6y agoHas anyone figured out how to do this from the firefox browser extension yet? Also does anyone know what the difference between 'deletion date' and 'expiration date' is?
- BiteCode_dev 6y agoI assume the sender (but not the receivers) can still access the file in their vault after the expiration date, but not after the deletion date.
- forcer 6y agoI have the same question. I am logged in FF extension and see no link to use this. To open web vault is too time consuming and clunky
- loginatnine 6y agohttps://github.com/bitwarden/browser/releases/tag/v1.49.0 https://github.com/bitwarden/browser/releases/tag/v1.49.0 I had to update my chrome extension manually but there's now a new "Send" button in the extension. Should be similar with firefox.
- Corrado 6y agoYea, I wasn't seeing the "Send" feature on my Firefox extension either, but forcing an update did the trick. It looks like some of the other distribution channels are a bit behind still. The macOS App Store version has not updated and there doesn't seem to be a way to force it.
- xxkylexx 6y agoBrowser extension updates are still rolling out
- BiteCode_dev 6y agoI like the feature, but if it requires somebody to creates an account, it's a hard sell. If they got a signal account, which is more likely than a bitwarden account, I'll ask them to use that. If they don't, then something like 0bin.net will likely be easier to use (no account necessary, just copy/paste). Now, bitwarden allows you to send any type of file, which is better than 0bin, being very limited in size, and to text and pictures. But you need a pro account for this. So I'm not sure how it's better than the competition. Although I'm posting this comment so that someone on HN can show be I'm missing something.
- contravariant 6y agoI just checked, you don't need an account to open the generated link. Though the documentation could use some work.
- BiteCode_dev 6y agoAh, that's good, I missed that, thx. And the bitwarden trademark is also a selling point. Although it still requires the other party to create an account if they want to send me something. Maybe I should make a PR to add passwords to 0bin though.
- nelsonenzo 6y agoOh, so if someone uses this wrong (no exp, no password), than these vault links are open to the public?
- contravariant 6y agoWell yeah, but you already had the possibility to share passwords with groups of other Bitwarden users so that's kind of the point.
- killingtime74 6y agoBitwarden can be self hosted as well
- shrew 6y agoThe promise of this is great and being a feature of Bitwarden, which is already fairly well trusted, is a plus in terms of peace of mind. But did anyone else find the demonstration a bit underwhelming? I've used sites like One Time Secret[0] before and one of the big benefits is that it's pretty fast to store the sensitive data, grab the link and send back to the colleague. Bitwarden Send looks as though you need to be logged in to the Bitwarden site, dig out the feature page among the rest of your password manager and fill out a whole form in order to get a link to send, which would add a barrier to entry for the whole process that wouldn't encourage its use. Maybe it's just me. It certainly looks like a good feature either way. [0] https://onetimesecret.com/ https://onetimesecret.com/
- addicted 6y agoWell, most people use Bitwarden through apps, and this is present in their apps. I think it’s a mistake to think of Bitwarden send as a stand-alone product, but rather as a convenient feature add to their existing (free and open source) password manager.
- windthrown 6y agoThat barrier to entry may reduce the amount of nafarious users uploading files, which is what led to Firefox Send's demise.
- swiley 6y agoIs it really more trusted and secure than onionshare?
- xerxesaa 6y agoOnionshare, to the best of my knowledge, requires you to have your computer running while the recipient downloads the file. It's a web server. It also requires you to download software. In this way, it's less convenient than a hosted service which can run in any browser. But yeah, the security of onionshare is good and the fact that you don't need to create an account makes it even better.
- okamiueru 6y agoI find it interesting how many business models and ideas are obsolete if there was a wider and easier adoption of gpg. It's over two decades old, but not aged in a bad way. I wonder why it isn't integrated better in OS-es, or part of education, as it's such a useful tool. I get why these products pop up, because they solve the initial inertia and make it accessible. Maybe it's OSS licensing, maybe US laws regarding crypto, hm. Does anyone have thoughts on this? Edit: my ability to communicate seems to be pretty bad today, so let me clarify. The question is about enhancement/integration in terms of usability, and not lack of adoption "as is". I'm well aware that the reason why it's not more adopted is because it isn't easy to use, otherwise these services wouldn't be popping up that makes it more user friendly. Hence the "... obsolete if there was a wider and easier adoption of gpg"
- nindalf 6y agoI have thoughts. It's very similar to why dropbox is a thing. In the original Show HN for Dropbox, the top comment assured the founder that it could easily be replaced with sshfs and a version control system. For some reason, the average consumer found Dropbox easier to use.
- okamiueru 6y agoI mean, I'm not asking why something easy to use is used more than something not easy to use. That would be silly. Maybe someone thought that, and that's why I got downvoted? What you've replied can be reduced to "because it's easier to use". These are not the thoughts I'm after, so let me clarify / reiterate. I'm asking why a highly usable technology that has been in existence for two decades has not found its way into a accessible easy to use implementation. Seemed like an interesting thing to get an opinion on, but I also don't care enough to offend anyone.
- nindalf 6y ago> a highly usable technology I think the consensus is that GPG isn't easy to use. Perhaps it only seems easy to use for you because you're used to it? Kinda like git. Git's UX is objectively bad but it doesn't bother me because using it is second nature now. I don't think it would be easy for a non-programmer to pick up. That's why people use document versioning provided by Google/Microsoft/Apple/Dropbox/Adobe rather than using git from the command line. It's the same with GPG.
- lxgr 6y agoMaybe I'm missing something, but how can this be end-to-end encrypted when the password is optional, and there is no fragment in the shared URL? Update: Turns out fragments are used for key sharing after all. This (in my opinion crucial to anyone aware about the difference between query parameters and fragments) bit is left out from the promotional video.
- nelsonenzo 6y agoWhat's a url fragment? How is it more secure?
- rakoo 6y agoURL fragments are the part after the hash symbol (#) like this: https://en.wikipedia.org/wiki/Donald_Trump#Books https://en.wikipedia.org/wiki/Donald_Trump#Books the original use case (still used today) is to be able to jump to the first DOM element with such an ID; typically title elements, such as the "Books" above. It is only used by the client, so is never sent to the server. Now with web applications, thanks to javascript, you can retrieve and use it. So now instead of using it as a locator inside of a page filled with content, you can use it as a string that you know isn't shared with the server: it's perfect for a secret key. You can send the receiver a link with that key, they will put it in their browser, receive the javascript from the server and use that javascript to decode content thanks to the key.
- pnt12 6y agoAs I understand it, a fragment is just read by the browser, a parameter is sent to the server. A common fragment is when you click some section of a website oagr and it changes the link to include #section-x, and if you bookmark it you browser will scroll to the right place automatically.
- ollybee 6y agoThere are number of open source projects that do the same thing such as https://privatebin.info https://privatebin.info Adding some marketing on top seems like a good thing as pasting passwords in chat happens too often in many organisations.
- nindalf 6y agoI'm probably going to have to leave LastPass later this month. Bitwarden seems like it ticks all my boxes, especially around self hosting. There's a Rust server implementation made by the community that doesn't require much resources so I could stuff it on an existing crowded server I rent.
- shafyy 6y agoI've tried LastPass and 1Pass before, and switched to Bitwarden 2 years ago. It's the best!
- tuxone 6y agoToo bad Bitwarden does not support sync to folder/iCloud/Dropbox/whatever. I prefer not to deal with self hosted environment but I also am worried about depending on someone else hosting for accessing my passwords.
- TumorousJoker 6y agoThen you're better off using KeyPass or one of its derivatives.
- thedanbob 6y agoI currently use Enpass which supports syncing via many services including those. I’ll probably switch to Bitwarden eventually because I’m a magpie but I haven’t so far because Enpass does everything I need.
- deleted 6y ago[deleted]
- tryptophan 6y agoAFAIK the bitwarden apps hold a local copy of your database. So if the servers go down you just use the local database, from which you can also export from to csv as well.
- 6y ago
- huhtenberg 6y agoUsing "trusted" in a description of their own product doesn't look right, especially when it's the only occurrence of "trust" on the whole page. It's just a marketing spin, rather than a meaningful technical description.
- dastx 6y agoI understand what you mean, though, to me, it read more along the lines of "you already trust Bitwarden, now you can use it to also send stuff" or something like that. Could be just be.
- throw14082020 6y agoPerfect timing. Just used this to send personal information across email. I still included the password in the email, but the expiry date means my personal data won't be collected through passive email logging. Also added max 2 read attempts: one for me test it, and another for the accountant. And of course, the accountant at my company still insists on passing personal information through email. Another example, Monese bank asking me to submit all sorts of pdf scans of personal documents to close an account with them.
- alias_neo 6y agoIt's such a battle. When my wife and I were buying our home, we needed to send our entire lives in paperwork form to the solicitors. I asked if they have a secure mechanism for file uploads and they responded "email is fine". No, email is not fine. They _really_ struggled to understand why I wouldn't just email them every document they asked for (from birth certificates, marriage certificates, 6 months of financial data, 12 months of pay slips, and a host of other things). In the end I hosted them myself and phoned them with a password, then deleted them once I'd seen they'd been accessed. Unfortunately, I have no confidence that they have, did nor will handle all of that information appropriately once they receive it. How is it not complete insanity to require _that much_ information on someone and _not_ have strict training and liability for managing it? Between then and now, Firefox Send has come and gone, but fortunately it's open source, so I'll host that if I find myself in a similar situation in the future.
- monkeydust 6y agoYou have to assume anything you send can become compromised and then game out what would be the ramifications of that. Its good you de-risked this somewhat by avoiding email thought, that's a good first step and I wish there was a standard for this.
- blub 6y agoAnd after they downloaded your secured file, they probably sent them between themselves over e-mail. This is why laws like the GDPR are needed.
- FourthProtocol 6y agoSo the basic package says you can share passwords with one other. But it also says core features and sharing are 100% free. But when you click on that box that mentions core features you (I mean me) expect to see what core features are. Instead I'm asked to create an account. For a thing that's supposedly free. So no sell. I'm really sorry because I want to like software like this, but not like this.
- sofixa 6y agoHow do you expect a password manager, which is what Bitwarden is at its base, to work without an account?
- yepguy 6y agoBitwarden Send, the feature under discussion, could certainly work without an account. (It's nearly the same thing as Firefox Send, which didn't require one. Although using accounts probably helps prevent abuse, which I think is what forced Firefox Send to shut down.)
- JustSomeNobody 6y agoIt _could_, but the entire point is that it is an _added feature_ for those _with_ an account.
- waheoo 6y agoThe links it generates does.
- neogodless 6y agohttps://bitwarden.com/pricing/ https://bitwarden.com/pricing/ You don't click "Create Free Account" to see the list of features. Just scroll down. (on mobile)
- FourthProtocol 6y agoI'm using a desktop. And nowhere on the page are core features described. So you're ok creating an account when you don't fully understand the scope of the app?
- hackeraccount 6y agoI use a combination of wireguard and never sending anyone anything for this use case.
- Osiris 6y agoFor just sending plain text that gets destroyed after it's seen, like sending passwords, etc., I've used https://foxcry.pt https://foxcry.pt
- alistaira 6y agoInteresting project! Great to see new features coming out of BitWarden. One concern that is going to put me off using the feature though is that sharing my password manager account email with the person I've sent the file/text to seems unnecessary. Not everyone we share data with (particularly in the world of messaging) should be privy to the sender's email address.
- tweetle_beetle 6y agoI appreciate that it's always good to question how much data, of any kind, is exposed, but what's the scenario where you want to share a secret with a specific person, but it's really important that they don't have the email address you use for Bitwarden? There are alternatives like https://onetimesecret.com https://onetimesecret.com which don't, but I can see the value in making it clear that this is a legitimate user to avoid phishing type scenarios.
- joseluisq 6y agoGreat feature, happy Bitwarden user BTW. Off-topic: For Rocket Chat users if you want temporary-encrypted messages exchange you could try OTR https://docs.rocket.chat/guides/user-guides/messaging/off-the-record-otr-messaging-guide https://docs.rocket.chat/guides/user-guides/messaging/off-th... We are using it in one-to-one chat context to exchange temporary data like passwords, keys, etc.
- trinovantes 6y agoWhat are some other secure ways to send varying file sizes from my computer to one/many others e.g. how would you securely send 1MB, 1GB, 1TB? I'm thinking once you're past 1TB, you're better off mailing an (encrypted) physical drive but I'm curious about other solutions especially if you have gigabit internet at home
- Taek 6y agohttps://skysend.hns.siasky.net/ https://skysend.hns.siasky.net/ is a neat way to send up to 8 GB. Handles smaller files just fine as well. We've transferred as much as 250 GB I believe using scp over the local network. But that was obviously between roommates. You're probably right that once you're in the TB range, actually sending a drive is the way to go. Egress on Amazon is more expensive than buying and then shipping physical disks.
- mcny 6y agoWhat is sia sky doing differently from Mozilla send? My understanding is that Mozilla send got overwhelmed by malware?
- Taek 6y agoIt's decentralized. For example, the exact same service exists at https://skysend.hns.skyportal.xyz https://skysend.hns.skyportal.xyz, which is operated by a completely unrelated party. Links created on one will work on the other. And you can run your own portal, code and instructions here: https://github.com/NebulousLabs/skynet-webportal https://github.com/NebulousLabs/skynet-webportal (roughly a weekend of work to set one up at this point)
- rozab 6y agocroc is my favourite way of transferring files between computers I control. https://github.com/schollz/croc https://github.com/schollz/croc It's similar to magic wormhole if you've heard of that, but a bit more polished. I think for me it offers the best possible UX. transfer.sh is also good if you can't install these for whatever reason.
- GordonS 6y agoI use http://transfer.sh http://transfer.sh for sending large files between machines on different networks - you don't even need an account to use it. I presume there must be a maximum file size, but I haven't hit it (yet). Still, nice to have another option incase transfer.sh goes away!
- sodality2 6y agoSeems like 10GB according to their site.
- pbronez 6y agoWhat’s the business model for transfer.sh? It looks like a free service that hosts your files on their servers temporarily. That sounds like a variant on the image hosting problem, where it’s unsustainable if it gets popular. You also have to trust them with your encrypted data. The nice thing about magic wormhole is that the hosted service only provides NAT busting / initial connection set up. Yes, this means you have to do direct, real time transfers, but it’s also much more secure and cheaper for the bridge host.
- GordonS 6y agoThere used to be a notice on the site explaining that it was hosted by Storj.io, but it appears to be gone now. I should have also mentioned that it's an OSS project, so you can self-host if you want: https://github.com/dutchcoders/transfer.sh/ https://github.com/dutchcoders/transfer.sh/ Oh, and there is also https://keep.sh https://keep.sh, which is free for files less than 500MB - they have a commercial offering too.
- GordonS 6y agoIIRC, Firefox Send shutdown because it was getting abused - I see you need an account to use Bitwarden Send, which I imagine helps mitigate against that, but it's also a barrier to use. Would be interesting to know what other anti-abuse mechanisms are in place.
- addicted 6y agoBitwarden Send is a feature add for existing users. It solves a very real problem of sharing passwords (and other sensitive information) with others. Before Send, the way Bitwarden recommended sharing data was by creating a group account of some sort (family, business), and using a shared collection.
- GordonS 6y agoAh, for some reason I assumed it was a separate product, but that makes much more sense. I've never been keen on cloud-hosted password safes, but this is a pretty nice addition for Bitwarden users.
- selykg 6y agoBitwarden does have a 100mb limit. Which I think will prevent a good chunk of abuse. I would love to see them increase the limit for paid accounts, though.
- justathroway77 6y agoI recently (2 days ago) had an attempted login into one of my accounts. The password was randomly generated by bitwarden and not reused anywhere. Luckily I had 2fa which alerted me to the attempt. This is beyond puzzling to me as there is no possible way someone could have guessed or downloaded this password from a DB leak. Can anyone suggest what this could be? (The attempt came from a country that is not my own)
- Snawoot 6y agoMaybe your local system is compromised? I don't see much of other options.
- kitkat_new 6y agoMessengers are not per se insecure. Sending via Matrix should be fine as well - why use another tool?
- cooperadymas 6y agoBecause you don't use Matrix? Because the person you're sharing with doesn't use Matrix?
- cpach 6y agoI know lots of people who use Whatsapp, Signal and iMessage. I’m not aware of anyone in my friend circle who use Matrix.
- MrGilbert 6y agoI love the fact that it's not just a seperate product, but it's also included in the existing bitwarden password safe. That's just awesome. I can't wait for v1.40 to be released on monday for self-hosted instances. Best 10 bucks I spend annually, tbh...
- FirstLvR 6y agoi like the "Emergency access" that Roboform has, it can handle this sharing very well https://help.roboform.com/hc/en-us/articles/115005664827-What-is-Emergency-Access-and-how-does-it-work- https://help.roboform.com/hc/en-us/articles/115005664827-Wha... Roboform is not recognized in the industry, but gets the job done, plus, it has secure notes, identities, markers, etc... all encrypted, and hasnt fail to me for over 4 years
- xerxesaa 6y agoBitwarden has this too https://bitwarden.com/help/article/emergency-access/ https://bitwarden.com/help/article/emergency-access/
- guerby 6y agoMight be related: https://github.com/pglombardo/PasswordPusher/ https://github.com/pglombardo/PasswordPusher/ Password Pusher - Open source secure password transfer Review by Crosstalk Solutions here: https://www.youtube.com/watch?v=0mpBLRaHtQo https://www.youtube.com/watch?v=0mpBLRaHtQo
- upofadown 6y agoThis claims to be end to end encrypted. One hard requirement for effective end to end encryption is that a user has a method to confirm that they are actually exchanging data with who they think they are exchanging data with (e.g. Signal's safety numbers). I don't see anything like this here. So unless I have missed something, the E2EE claim is bogus and Bitwarden ends up being a trusted third party in this system. The identity management seems to work on the basis of an email address verification entirely under the control of Bitwarden.
- atleta 6y agoWhile you are correct that sender authentication is an important requirement, I think you are mixing two things. Having end-to-end encryption is one thing, sender authentication is another. It does matter what you trust BitWarden with. If you just rely on them for sender authentication it doesn't mean it's not encrypted E2E. They won't be able to look at your data, but are right, they could forge messages. However, even then you can do the authentication yourself, inside the message. E.g. send a hash through an alternate channel, or if it's too complicated (because you may argue that you could just use PGP with people who know how to verify a hash) then include an agreed upon password in the encrypted message. It's not ideal of course and their app could support these (like you say) but it doesn't mean you have to trust them or that the message is not encrypted end-to-end.
- upofadown 6y ago>They won't be able to look at your data, They totally could. All they have to do is trick you into sending a properly encrypted message to an endpoint under their control. Then they can decrypt the message, read it, properly reencrypt it for the entity you think you originally sent it to and then send it along. Because they control the entire infrastructure and user experience this sort of thing would be trivial for them to do. An unsigned, anonymous PGP message (the equivalent) would actually be better.
- atleta 6y agoThe thing works by encrypting a file using a password derived key (if I understand correctly) which then gets uploaded to their infrastructure. You get the url, containing the password (used to derive the key). There's no point and no way tricking you into sending it to them, i.e. setting up a MITM attack. The client could just leak the key, but as far as I can understand, it's open source so you can prevent it by building it yourself (and either trusting others or auditing the code yourself too). As the password is in the URL and you'll send the url through another channel, there is no way to MITM it (decode and then recode for the recipient). And wouldn't make sense anyway, since there was no key exchange, the recipient does not provide the sender with a key to use. So yeah, they can absolutely look into your files - if they steal your key. (They could do it on the receiving side too, BTW.) But you can't sidestep this with any encryption software: you have to trust at least the encoding and decoding app. (Also, I think you can self host this.)
- Legogris 6y agoAs a self-hosted alternative if one already has Vault (or is OK with a provided single-node installation), this[0] is great. I use it when sharing private stuff over unsecured channels regularly. [0] https://github.com/algolia/sup3rS3cretMes5age https://github.com/algolia/sup3rS3cretMes5age
- waheoo 6y agoDoes bitwarden self hosting not include this feature yet? https://bitwarden.com/help/hosting/ https://bitwarden.com/help/hosting/
- tyingq 6y agoMore detail: https://bitwarden.com/help/article/about-send/ https://bitwarden.com/help/article/about-send/
- trzeci 6y agoTwo feedback points: * Password field for creating new sends should be named differently, as by default Firefox autocompletion puts there my account's password there. Potentially should be exposed from OPTIONS panel. Alternatively it can be generated by default, and then once the message is created, will be shared to the creator - or stored in options menu of my sends * Missing an option to expire message after first opening. It's like a self destroyable notification that can be read only once. Why? For the instance if I share some confident information with someone that I know is going to open very soon, then once he/she opens the message it will be destroyed, so that if somebody accesses either my or my friend's machine, it will be impossible to read the secret message. Another aspect is that if my friend will try open the secret message, and it will show that message doesn't exist / was destoryed - then we know that message was compromised.
- xxkylexx 6y agoRe point #2 - You can set a max access count to 1.
- trzeci 6y agoOh! Right! I think this is a ripple effect of #1 for me, this is how I see the panel for creation a message: https://i.imgur.com/IBVinx4.png https://i.imgur.com/IBVinx4.png So Firefox put my account password there automatically, and color coded that, but also did this for Max Access Count. And to be frank I filtered out that field when I was looking for relative option to solve #2 problem.
- HappyDreamer 6y agoWhat about an option to expire the message X hours or days after the first access? So that if one forgets to save / make-use-of the secret thing, and accidentally reload the browser tab, or power off the computer -- it'll still be there, an hour later. But not a week later. Or if you share the message with a tech illiterate person, who doesn't realize what "expires after first access" means. Then, instead, you can say to him/her: "After you've read my message, you need to use it within two days, thereafter it disappears automatically". And it won't matter if he or she accidentally reloads the browser tab (with the message in it -- trying to access it for a 2nd time), or leaves for lunch and powers off the computer and wants to continue handling your message, after lunch. (Could be combined with expiring the message after Y days, without any access.)
- tim333 6y agoI just tried it. Here's one saying Hi HN: https://send.bitwarden.com/#aSBOPtnJT0qjwqzpAOZM_w/Moum7wc6kXEetYMc1OX8Ng https://send.bitwarden.com/#aSBOPtnJT0qjwqzpAOZM_w/Moum7wc6k...
- julianlam 6y agoIs that a phishing link? Are you going to follow up with a company-mandated training seminar on not clicking random links on the internet? ;)
- tim333 6y agoWell you can check the link is bitwarden.com but I guess in the message I could have said something iffy.
- tim333 6y agoUpdate - I see the similar Firefox Send was closed down due to people putting iffy stuff (phishing, malware) in the messages.
- Spivak 6y agoRunning a public service like this is a genuine commitment to fight spam, malware, phishing, cp, and various other oogy boogies simply because if you don't people will take advantage and your links will start getting flagged as sketchier and sketchier. It's a hard laborious problem to solve when you have to prevent and suss out bad content while also not being able to see it. Bitwarden is gonna be leaning hard into the account requirement and the reputation of the sender.
- surround 6y agoSo the decryption key contained in the url after the “#”? Is it never sent to the server, and instead only used to decrypt the message in-browser?
- 6y ago
- dartharva 6y agoYou'd think such a thing should have been directly implemented in Chat apps and related communication channels long ago considering how much demand there is in the industry, but nope. Signal is the only one among popular texting apps that implements disappearing messages correctly.
- jgtrosh 6y agoWhat makes you say that Telegram doesn't?
- skrowl 6y agoTelegram deleting messages appear to work for me. Likely this guy is just buying into Signal FUD that Telegram is somehow worse encryption, despite Signal's encryption being used by Facebook and funded by the US Govt.
- ziddoap 6y agoWhat does using the same encryption algorithms of a government or business have to do with the conversation? Are you implying that the algorithm is unknowingly back-doored, with the evidence being that Facebook uses the same algorithm? Or am I misunderstanding your point?
- kissickas 6y agoThe claim isn't that Telegram's encryption is worse, it's that Telegram's closed-source backend is unauditable. Your other points are a great example of FUD. edit: changed clients to backend
- julianlam 6y agoThis is very exciting news for the Bitwarden team, if only beacuse Firefox Send went away and there's not really been a suitable replacement since. There was onetimesecret, but I never really trusted it... However, FF Send was shut down because keeping up with nefarious users uploading illegal content was a full-time job in and of itself... I wonder what Bitwarden will be doing to solve the problem.
- matheusmoreira 6y agoWhy would these services have to care about illegal data? The data is end-to-end encrypted, they don't know what is being sent. There is no reason to even store it on their servers.
- rndgermandude 6y agoIt gave you a link to be shared, that essentially embedded the cryptographic key to decrypt. It's basically the same scheme that e.g. mega.nz uses too (their "share link" feature), and similar encrypted services. These links weren't just shared one-on-one in some private channels, but people posted the links in (semi-)public places as well. If it was something actually bad or at least "bad", a lot of times other users, law enforcement, or copyright owners would report these links back to mozilla, requesting the link be disabled and the content taken down.
- orev 6y agoIf the service is being used to distribute malware, then they do need to care. It causes reputation issues, could get the site added to block lists, and may carry legal liability. This is why Firefox Send was shut down.
- timvisee 6y agohttps://send.vis.ee/ https://send.vis.ee/ https://github.com/timvisee/send https://github.com/timvisee/send :)
- wtmt 6y ago
- USNetizen 6y agoI don't know about anyone else, but I'm leery of apps that say "proven security and compliance" and then don't offer any obvious details, or proof, about what that "compliance" is. ISO 27001, SOC2, what?
- whoisburbansky 6y agoClicking through on the link under that section explains that they're compliant with GDPR, Privacy Shield, CCPA, and HIPAA on the privacy side. In addition, they've completed SOC 2 Type 2 and SOC 3 compliance, have a link to security assessments/penetration tests/cryptographic analysis done in 2020 and 2018 by third party pentesting firms. For each of their claims, they've got links explaining details, and if none of that is enough, it's completely open source, so you can go code spelunking yourself to verify their claims.
- dethos 6y agoInteresting, it seems to work very similarly to Firefox Send. For communications in the other direction, such as when you want to make sure the other person sends you the content securely, there is https://github.com/whitesmith/hawkpost https://github.com/whitesmith/hawkpost (disclaimer, this was an hackathon project I participated some years ago). Hawkpost doesn't even store the encrypted content. I wonder if there is a solution that would correctly deal with both situations (never requiring the other end to sign up or know anything about encryption).
- garettmd 6y agoThanks for the link to Hawkpost, it looks really cool!
- hathym 6y agoyou might also be interested in https://github.com/magic-wormhole/magic-wormhole https://github.com/magic-wormhole/magic-wormhole
- fernandotakai 6y agoone of my favorite tools, i just wish there was a good GUI for it.
- bj0 6y agoThere's a webapp version (clone?) of it: https://webwormhole.io/ https://webwormhole.io/ There's also a nice go port (single binary) of it: https://github.com/schollz/croc https://github.com/schollz/croc
- Klonoar 6y agoI've been building a Rust macOS app for it, actually - could use testers in a week, I think. Let me know if you're interested? https://twitter.com/ryanmcgrath/status/1368027469068963843/photo/1 https://twitter.com/ryanmcgrath/status/1368027469068963843/p...
- _nhh 6y agoNice way for browser plugins and script to access sensible information via dom! Even with a title suggestion the applications it is for! No more context sensitive chats i have to spy on
- hedora 6y agoRegarding the self-hosted version: ARM support would be nice. I dug in a bit more, and bitwarden is written in .NET core and SQL Server T-SQL. .NET core is open source these days, but not SQL Server from what I can tell. I wonder if making it portable (to other architectures/BSD) would be a complete rewrite, or if there’s some easy path forward.
- nwah1 6y agoThis issue claims they are starting work on PostgreSQL support this week. https://github.com/bitwarden/server/issues/453 https://github.com/bitwarden/server/issues/453
- hedora 6y agoThanks. It looks like .NET core works (but is unsupported) on FreeBSD. That’s future proof enough. I have a gripping day of LastPass migrations ahead of me. :-)
- wtmt 6y agoYou could also consider bitwarden_rs, an open source Rust based implementation of the BitWarden server that supports SQLite and MySQL (Postgres support is also coming). [1] [1]: https://github.com/dani-garcia/bitwarden_rs https://github.com/dani-garcia/bitwarden_rs
- legym 6y agoJust switched over from lastpass and very happy with it. Glad i made the jump
- nelsonenzo 6y agoKeybase alternative. Nice!
- bearbearbear 6y agoAny time you see an advertisement for a product whose primary function is "hey give us your super secret stuff, we totally won't do anything evil with it," you should assume that the vendor is going to do something evil with it.
- linsomniac 6y agoIt's been nice to see the recent additions to Bitwarden (share my passwords if I die, Send, ability to copy TOTP to clipboard from search list). Send is nice, we had a vendor use pwpush.com recently to send us a password. Was skeptical because I'd never heard of them before, but it seemed to work fine. I've been using Bitwarden for around 18 months for my family and a year at work. I like it, but it does have some rough edges. Was just discussing it a few days ago and one of my coworkers asserted: "It has UI issues that should probably be considered security problems." and I can't argue with that. The primary one is that when adding a new entry via Mobile, the "who owns this" is down past the bottom of the screen, and the "save" button is at the top, so you can complete the password add without selecting the account/collection portion, it's just invisible down there. Leading to the password being in the wrong place. The default is a selected value, rather than "no choice", so it won't throw an error if you don't go down there and complete it. Other than that, I'm fairly happy with Bitwarden. I do wish that there was a key to generate values into the custom fields, which I use for "security question" answers, so I have to generate them in another app and really can't use Bitwarden in mobile with sites that require setting up security questions. My wife uses it, but says it's ugly. So, that might be the thing that causes me to change to another provider... :-) (combined with my coworkers not really liking BitWarden's UI)
- kayson 6y ago> share my passwords if I die I searched around but couldn't find this feature. How do you turn it on?
- justusthane 6y agoI believe this is what GP is referring to: https://bitwarden.com/help/article/emergency-access/ https://bitwarden.com/help/article/emergency-access/
- mhdhn 6y agoI not NOT get why the demo'd and encouraged way of sending is considered secure. The email is not encrypted. It contains a link in plain text. It's not stipulated that secure email servers (TLS) are used, and if non-secure, the plain text of the link could potentially be sniffed out by anyone with access to one of the nodes along the chain of transmission of the email data. Further, if the email server on either end is gotten to, the URL is sitting there in plain text, so the attacker has it. Now, once you have the URL, you have direct access to the secret info, without any challenge. Modulo this method making it possible to shorten the time the info is available, and to take the info away after the info has been accessed, what is secure about this? Couldn't you have the same effect essentially by sending the secret through email and then mutually agreeing on both sides to delete the email message immediately after sending (by the sender) and receiving (by the receiver)?
- DistractionRect 6y ago> Add a password to further protect the Send
- justusthane 6y agoProbably the best thing to do is set the access count limit to one. That way, no one else will be able to access it after the intended recipient does. And if a 3rd party accesses it before the intended recipient, then the intended recipient will not be able to access it and at least you'll have an indication that it was intercepted.
- 6y ago
- kemonocode 6y agoA very interesting addition indeed to Bitwarden. I still personally prefer my own setup as I'm guaranteed not to run any risks of being siloed but I've started pointing others towards Bitwarden because of this and their strong commitment so far towards Open Source [0] [0] https://github.com/bitwarden https://github.com/bitwarden
- CameronNemo 6y agoSame. I use keepassxc and just sftp the database around, but I have my mom using bitwarden. Hopefully I' ll convince my sister to start using it soon too (she is not a believer in password managers, yet).
- dvdkon 6y agoIt's funny to me that I basically had the same setup, family included. My sister finally set up Bitwarden after someone logged into her Facebook account and started sending her friends a picture of Itachi. Keep hoping, security is often just a disaster away :)
- bisby 6y agoI've been using bitwarden_rs [0] because it's lighter, a bit faster, and a lot easier to set up (it's a single docker image with bitwarden in it, rather than having to reverse engineer their docker-compose "we choose where there data goes" forced deployment docker script. Being a 3rd party implementation, Bitwarden Send doesn't work. So there are pro's and cons, but you can absolutely control your own data here without needing to use their official services. [0] https://github.com/dani-garcia/bitwarden_rs https://github.com/dani-garcia/bitwarden_rs
- infogulch 6y ago> Being a 3rd party implementation, Bitwarden Send doesn't work. Seems bitwarden_rs might get it too. https://github.com/dani-garcia/bitwarden_rs/issues/246#issuecomment-796966385 https://github.com/dani-garcia/bitwarden_rs/issues/246#issue...
- aladine 6y agoAnyone knows how does it different from Firefox Send. What is the features will restrict users from abusing it. FYI, Firefox Send was discontinued due to security reason.
- selykg 6y agoIt does require that you create a Bitwarden account to create a send. I assume if abuse starts happening they will just start requiring a paid plan, which would allow some amount of additional protection.
- traeregan 6y agoThe idea of the other party needing to setup an account is off-putting to me. The way I handle this currently is to use https://onetimesecret.com https://onetimesecret.com without any added context, just the password string, and then send an email / message such as: Here are the credentials that you requested: Username: foobar Password: https://onetimesecret.com/secret/6usoxihjgv1d https://onetimesecret.com/secret/6usoxihjgv1d (this link only works one time within X days) You could even setup a separate link for the username, etc.
- uhinze 6y agoCreated a similar solution a while back that also lets you specify max views: https://pwdrop.com https://pwdrop.com Happy to hear feedback!
- justusthane 6y agoThe receiver does not need an account.
- grok22 6y agoWireDoc [1] is a service I've used a few times that has an interesting mechanism where a party with an account on the system can send or request to receive files from another party that doesn't have an account. [1] https://wiredoc.com https://wiredoc.com
- jabroni_salad 6y agoI'm a former wiredoc customer. Their service is otherwise nice, but the file size limits have not kept up with the times. I switched to Hightail for requests and delivery about a year ago and have been a pretty happy camper. https://www.hightail.com/ https://www.hightail.com/
- timwis 6y agoAny advantage to using this over pwpush.com in terms of security?
- denysvitali 6y agoI love Bitwarden, but this move is something that I don't like that much because it fragments more the way we have to share passwords between people / companies. For some reason GPG frontends (such as Keybase) aren't a trending thing, and therefore the average guy in IT doesn't even know how to deal with an encrypted gpg file - let alone creating one given my public key. Unfortunately it seems like emails are more straight forward, or encrypted e2e messages via Signal / Telegram / you name it. I would very much appreciate if somebody created something like Keybase and made it popular - this is a security improvement I would love to see in everyone's life. Things like Bitwarden Send, unfortunately, are probably not going to be the best solution to this problen and not even strong enough (e.g: not E2E encrypted). I wouldn't feel safe in using it to be honest. In any case, everything is definitely better than sharing credentials in plain text, so there is that :-)
- ImaCake 6y agoThe only time I, and probably many others, have used GPG is to install R on linux. So I guess you can thank the problematic installation procedure for R on linux for some exposure to GPG.