9 ms·

You can self-host vaultwarden (formerly bitwarden_rs), which gives full enterprise functionality.

by gizdan 5y ago

fy20 5y ago
I do this, works perfectly for sharing common passwords among my family (streaming services and utilities mainly). I moved from 1Password, and my main gripe with Bitwarden are the apps aren't as polished. If it's not too expensive I'd consider switching back (1Password family is $60 per year, so I assume this will be less).
- afavour 5y ago
  I had the exact same experience. I don’t want to care about the app UI etc but when you use a password manager as often as you do it really matters. Not to mention selling the idea to less tech-savvy family members, it really does have to be as simple as can be.
  - hanklazard 5y ago
    I self-host Bitwarden_rs and use the client apps on Windows, Linux, and MacOS. To me, the UI seems very usable, polished and attractive. It doesn’t seem that different from 1Password, which I switched from a few years ago. What exactly about the UI needs improvement?
    - afavour 5y ago
      The mobile apps were the primary problem for me. Regrettably it was long enough ago that I can’t remember all the details but I’m pretty sure at the time it didn’t support TouchID for one.
      - hanklazard 5y ago
        I'd say give it another try sometime! The mobile app (I've only used the iOS version) is very usable and has FaceID support for those that want it. Also, safari can work with the app to pull passwords quickly. I'm just really grateful this project exists. I've tried most of the major password managers out there and I feel like BW/VW is the clear winner, especially if you're willing to host your own server. If not, their pricing for an annual personal account is incredibly reasonable.
    - gizdan 5y ago
      Personally the UI itself is fine. The UX on the other hand not so much. - Firefox Extension doesn't work fully in a private window in Firefox. - Extension loses data when you click away from it. - Extension is hard to navigate using keyboard - e.g. there is no way to copy specific username/password/otp code. There is lots more issues.
      - hanklazard 5y ago
        Good to know, extensions always feel like the weak link in password manager security (again, not a developer so happy to be proven wrong here) so I don't use them. I always just copy out of the desktop app (Ctrl + P), still a really fast keyboard-only workflow once you get used to it.
    - ValentineC 5y ago
      I'm a 1Password user right now, but I've tried self-hosting Bitwarden_rs and like it very much. The one killer feature which is preventing me from switching is the ability to use multiple self-hosted servers at once (so I can separate family vaults from business) [1], but "client profiles" are likely to be implemented some time soon [2]. Now that I've learnt that local vaults are going away in 1Password 8 [3], I'll probably make a move to Bitwarden sooner rather than later. [1] https://community.bitwarden.com/t/log-in-with-multiple-bitwarden-user-accounts/716 https://community.bitwarden.com/t/log-in-with-multiple-bitwa... [2] https://community.bitwarden.com/uploads/default/original/2X/3/33a8081bedd264f44e9a404d1c223e1260a86852.png https://community.bitwarden.com/uploads/default/original/2X/... [3] https://news.ycombinator.com/item?id=28107225 https://news.ycombinator.com/item?id=28107225
      - tw04 5y ago
        I thought there were some features missing from vaultwarden compared to bitwarden. I think the one that stuck out to me was lack of AD integration. Any chance you’ve seen a list of what is and isn’t in vaultwarden? My search hasn’t turned anything up. Maybe they’re at feature parity now?
  - karmanyaahm 5y ago
    my less savvy family members all use bitwarden with sharing and don't see any major problems fwiw ymmw
- ibdf 5y ago
  I find this surprising. I’ve been using Bitwarden for a few years now… the mobile app is easy to use. They even make MFA painless by automatically copying the code after the password is entered. The browser extensions seem to work fine too. Perhaps the web app is not as clean, but I rarely use it.
- j1elo 5y ago
  I'm paying for a Bitwarden subscription because I want to support their product and their vision. But I don't know, time passes and some much needed improvements don't seem to arrive. The most glaring issue (for me, anyway; I fully understand I'm just a sample size of 1!) they have is relying on the pop-up UI of the browser, which I guess is stateless (state is lost when the popup closes, it seems?). The decision of using this UI was already wrong from its inception, IMHO, not sure why they thought it would be a good idea. But more surprising is that they haven't yet moved to the much more reliable and user friendly method of opening their UI on a new tab, which was a no brainer when using LastPass. Oh well. They said to have this in the backlog, so hopefully it gets some attention sooner than later... but in the meantime the end users are faced with silly issues like this, software that loses user data should not be a concern in the first place, and for sure they won't care about some technical explanation about how the browser handles pop-up windows. (for anyone interested: https://community.bitwarden.com/t/persist-bitwarden-ui-and-maintain-entered-data-previously-unsaved-changes-are-lost-when-move-to-another-item/5470/20 https://community.bitwarden.com/t/persist-bitwarden-ui-and-m...)
  - gizdan 5y ago
    It gets worse. Their browser extension doesn't work when using a private window in Firefox. The GitHub issue[0] around it was raised in 2017. They've been blaming Mozilla for deprecating and subsequently removing an API. It's pretty ridiculous. [0] https://github.com/bitwarden/browser/issues/136 https://github.com/bitwarden/browser/issues/136
    - decrypt 5y ago
      I thought it was just me where Bitwarden didn't work on the private window.
  - bruckie 5y ago
    Tavis Ormandy (of Google Project Zero) has a pretty convincing post arguing that relying on browser extensions that modify the DOM (which includes [almost?] all password managers) is a bad idea: https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html (he recommends using your browser's built-in password manager, which isn't as convenient but is much more secure)
- ziml77 5y ago
  That lack of polish and lack of improvement over the couple years I used Bitwarden are why I switched back to 1Password. Being open-source is not a free pass to ignore issues like that.
8fingerlouie 5y ago
You can indeed, but only if you accept what follows. You will be in charge of maintaining critical infrastructure, as well as keeping it safe from attackers. My biggest complaint about the 1Password8 situation is that i've been "self hosting" version 7 for years using iCloud sync, and it has worked perfectly. I have my 1Password vault on every device for "free". With family sharing in iTunes, i had it for every family member for "free" as well. With version 8 they're taking that away, and instead trying to push me to a $5/month subscription that essentially does the same thing. I have faithfully purchased every version up until now, and had they kept local vaults/iCloud sync i would have purchased the next one as well. As it is now, self-hosted or not, i will be looking for something else. Afterall, all i really need is an encrypted file on a cloud share. Unix Pass would be great if it didn't leak information about which sites you have logins for. "Easily" fixable by using Pass Tomb, but sadly that's not available on iOS.
- gizdan 5y ago
  Totally agree, and I notice a lot of people just blindly go down the hosting Vaultwarden route. There's a trade-off that everyone needs to consider, and much of it depends entirely on their skill level. Having said, I'm all for self-hosting and I hope it continues to become prevalent.
  - 8fingerlouie 5y ago
    I'm also all for self-hosting, but there's a difference between hosting things for your LAN, and hosting things available on the internet. Most people have no clue about the amount of work required to runs things in a secure, redundant and resilient way. And no, a RaspberryPi in the corner, running on your LAN probably won't cut it. At least not for me.

You can self-host vaultwarden (formerly bitwarden_rs), which gives full enterprise functionality.

by gizdan 5y ago

You can self-host vaultwarden (formerly bitwarden_rs), which gives full enterprise functionality.

fy20 5y ago

I do this, works perfectly for sharing common passwords among my family (streaming services and utilities mainly). I moved from 1Password, and my main gripe with Bitwarden are the apps aren't as polished. If it's not too expensive I'd consider switching back (1Password family is $60 per year, so I assume this will be less).

afavour 5y ago
I had the exact same experience. I don’t want to care about the app UI etc but when you use a password manager as often as you do it really matters. Not to mention selling the idea to less tech-savvy family members, it really does have to be as simple as can be.
- hanklazard 5y ago
  I self-host Bitwarden_rs and use the client apps on Windows, Linux, and MacOS. To me, the UI seems very usable, polished and attractive. It doesn’t seem that different from 1Password, which I switched from a few years ago. What exactly about the UI needs improvement?
  - afavour 5y ago
    The mobile apps were the primary problem for me. Regrettably it was long enough ago that I can’t remember all the details but I’m pretty sure at the time it didn’t support TouchID for one.
    - hanklazard 5y ago
      I'd say give it another try sometime! The mobile app (I've only used the iOS version) is very usable and has FaceID support for those that want it. Also, safari can work with the app to pull passwords quickly. I'm just really grateful this project exists. I've tried most of the major password managers out there and I feel like BW/VW is the clear winner, especially if you're willing to host your own server. If not, their pricing for an annual personal account is incredibly reasonable.
  - gizdan 5y ago
    Personally the UI itself is fine. The UX on the other hand not so much. - Firefox Extension doesn't work fully in a private window in Firefox. - Extension loses data when you click away from it. - Extension is hard to navigate using keyboard - e.g. there is no way to copy specific username/password/otp code. There is lots more issues.
    - hanklazard 5y ago
      Good to know, extensions always feel like the weak link in password manager security (again, not a developer so happy to be proven wrong here) so I don't use them. I always just copy out of the desktop app (Ctrl + P), still a really fast keyboard-only workflow once you get used to it.
  - ValentineC 5y ago
    I'm a 1Password user right now, but I've tried self-hosting Bitwarden_rs and like it very much. The one killer feature which is preventing me from switching is the ability to use multiple self-hosted servers at once (so I can separate family vaults from business) [1], but "client profiles" are likely to be implemented some time soon [2]. Now that I've learnt that local vaults are going away in 1Password 8 [3], I'll probably make a move to Bitwarden sooner rather than later. [1] https://community.bitwarden.com/t/log-in-with-multiple-bitwarden-user-accounts/716 https://community.bitwarden.com/t/log-in-with-multiple-bitwa... [2] https://community.bitwarden.com/uploads/default/original/2X/3/33a8081bedd264f44e9a404d1c223e1260a86852.png https://community.bitwarden.com/uploads/default/original/2X/... [3] https://news.ycombinator.com/item?id=28107225 https://news.ycombinator.com/item?id=28107225
    - tw04 5y ago
      I thought there were some features missing from vaultwarden compared to bitwarden. I think the one that stuck out to me was lack of AD integration. Any chance you’ve seen a list of what is and isn’t in vaultwarden? My search hasn’t turned anything up. Maybe they’re at feature parity now?
- karmanyaahm 5y ago
  my less savvy family members all use bitwarden with sharing and don't see any major problems fwiw ymmw
ibdf 5y ago
I find this surprising. I’ve been using Bitwarden for a few years now… the mobile app is easy to use. They even make MFA painless by automatically copying the code after the password is entered. The browser extensions seem to work fine too. Perhaps the web app is not as clean, but I rarely use it.
j1elo 5y ago
I'm paying for a Bitwarden subscription because I want to support their product and their vision. But I don't know, time passes and some much needed improvements don't seem to arrive. The most glaring issue (for me, anyway; I fully understand I'm just a sample size of 1!) they have is relying on the pop-up UI of the browser, which I guess is stateless (state is lost when the popup closes, it seems?). The decision of using this UI was already wrong from its inception, IMHO, not sure why they thought it would be a good idea. But more surprising is that they haven't yet moved to the much more reliable and user friendly method of opening their UI on a new tab, which was a no brainer when using LastPass. Oh well. They said to have this in the backlog, so hopefully it gets some attention sooner than later... but in the meantime the end users are faced with silly issues like this, software that loses user data should not be a concern in the first place, and for sure they won't care about some technical explanation about how the browser handles pop-up windows. (for anyone interested: https://community.bitwarden.com/t/persist-bitwarden-ui-and-maintain-entered-data-previously-unsaved-changes-are-lost-when-move-to-another-item/5470/20 https://community.bitwarden.com/t/persist-bitwarden-ui-and-m...)
- gizdan 5y ago
  It gets worse. Their browser extension doesn't work when using a private window in Firefox. The GitHub issue[0] around it was raised in 2017. They've been blaming Mozilla for deprecating and subsequently removing an API. It's pretty ridiculous. [0] https://github.com/bitwarden/browser/issues/136 https://github.com/bitwarden/browser/issues/136
  - decrypt 5y ago
    I thought it was just me where Bitwarden didn't work on the private window.
- bruckie 5y ago
  Tavis Ormandy (of Google Project Zero) has a pretty convincing post arguing that relying on browser extensions that modify the DOM (which includes [almost?] all password managers) is a bad idea: https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html (he recommends using your browser's built-in password manager, which isn't as convenient but is much more secure)
ziml77 5y ago
That lack of polish and lack of improvement over the couple years I used Bitwarden are why I switched back to 1Password. Being open-source is not a free pass to ignore issues like that.

8fingerlouie 5y ago

You can indeed, but only if you accept what follows. You will be in charge of maintaining critical infrastructure, as well as keeping it safe from attackers. My biggest complaint about the 1Password8 situation is that i've been "self hosting" version 7 for years using iCloud sync, and it has worked perfectly. I have my 1Password vault on every device for "free". With family sharing in iTunes, i had it for every family member for "free" as well. With version 8 they're taking that away, and instead trying to push me to a $5/month subscription that essentially does the same thing. I have faithfully purchased every version up until now, and had they kept local vaults/iCloud sync i would have purchased the next one as well. As it is now, self-hosted or not, i will be looking for something else. Afterall, all i really need is an encrypted file on a cloud share. Unix Pass would be great if it didn't leak information about which sites you have logins for. "Easily" fixable by using Pass Tomb, but sadly that's not available on iOS.

gizdan 5y ago
Totally agree, and I notice a lot of people just blindly go down the hosting Vaultwarden route. There's a trade-off that everyone needs to consider, and much of it depends entirely on their skill level. Having said, I'm all for self-hosting and I hope it continues to become prevalent.
- 8fingerlouie 5y ago
  I'm also all for self-hosting, but there's a difference between hosting things for your LAN, and hosting things available on the internet. Most people have no clue about the amount of work required to runs things in a secure, redundant and resilient way. And no, a RaspberryPi in the corner, running on your LAN probably won't cut it. At least not for me.