6 ms·

I'm paying for a Bitwarden subscription because I want to support their product and their vision. But I don't know, time passes and some much needed improvement

by j1elo 5y ago

I'm paying for a Bitwarden subscription because I want to support their product and their vision. But I don't know, time passes and some much needed improvements don't seem to arrive. The most glaring issue (for me, anyway; I fully understand I'm just a sample size of 1!) they have is relying on the pop-up UI of the browser, which I guess is stateless (state is lost when the popup closes, it seems?). The decision of using this UI was already wrong from its inception, IMHO, not sure why they thought it would be a good idea. But more surprising is that they haven't yet moved to the much more reliable and user friendly method of opening their UI on a new tab, which was a no brainer when using LastPass. Oh well. They said to have this in the backlog, so hopefully it gets some attention sooner than later... but in the meantime the end users are faced with silly issues like this, software that loses user data should not be a concern in the first place, and for sure they won't care about some technical explanation about how the browser handles pop-up windows. (for anyone interested: https://community.bitwarden.com/t/persist-bitwarden-ui-and-maintain-entered-data-previously-unsaved-changes-are-lost-when-move-to-another-item/5470/20 https://community.bitwarden.com/t/persist-bitwarden-ui-and-m...)

gizdan 5y ago
It gets worse. Their browser extension doesn't work when using a private window in Firefox. The GitHub issue[0] around it was raised in 2017. They've been blaming Mozilla for deprecating and subsequently removing an API. It's pretty ridiculous. [0] https://github.com/bitwarden/browser/issues/136 https://github.com/bitwarden/browser/issues/136
- decrypt 5y ago
  I thought it was just me where Bitwarden didn't work on the private window.
bruckie 5y ago
Tavis Ormandy (of Google Project Zero) has a pretty convincing post arguing that relying on browser extensions that modify the DOM (which includes [almost?] all password managers) is a bad idea: https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html (he recommends using your browser's built-in password manager, which isn't as convenient but is much more secure)
- j1elo 5y ago
  I guess it makes sense, but it's a very very unhelpful suggestion... we're painfully and slowly moving in the direction of teaching users how passwords are less and less useful as long as they are not random, so the ideal alternative is having all random passwords and using a vault that remembers them for us. But this whole proposition totally breaks if I store my Amazon password in Chrome at work, and then later I cannot access it in Firefox at home, or the native app in my Android phone.
- ronnier 5y ago
  I only open the webui, log in, copy paste my usernames and passwords. I don't trust that my passwords are safe otherwise.
  - tcoff91 5y ago
    The clipboard is not exactly a secure channel. Browsers need to catch up to mobile and provide dedicated APIs for password managers to hook into so they don’t have to interact with the DOM.
  - ziml77 5y ago
    I don't trust the safety of passwords going through my clipboard and me having to manually verify the URL.
- kemayo 5y ago
  It'd be ideal if browsers offered standard hooks into their password-filling mechanisms. Let the password managers volunteer "I know a password for this site!" and fill it through the browser's standard UI. Basically, I want the browsers to implement something close to what Apple has for password management on iOS. Ideally go a bit further and expose hooks for creating/saving a new login, too. Unless they already do this, and nobody has actually taken them up on using it?
  - j1elo 5y ago
    That's an amazing idea! Do you know if any browser vendor has this concept even in the radar? It would be very cool that password managers were able to do that: manage passwords, and not have to deal with each browser's idiosyncrasies which if you think about it, is just a distraction from their actual mission of being a password storage.
addicted 5y ago
I use Bitwarden in the Firefox sidebar. That provides a persistent state experience.
- j1elo 5y ago
  Good idea! I'm however limited here by the fact that (Firefox at least) only one sidebar can be open at the same time. And for me that's occupied full-time by the fantastic Tree Style Tab extension. I would definitely find it useful if more sidebars could be open at the same time.
- gizdan 5y ago
  Which also doesn't work when using a private window.

by j1elo 5y ago

gizdan 5y ago

It gets worse. Their browser extension doesn't work when using a private window in Firefox. The GitHub issue[0] around it was raised in 2017. They've been blaming Mozilla for deprecating and subsequently removing an API. It's pretty ridiculous. [0] https://github.com/bitwarden/browser/issues/136 https://github.com/bitwarden/browser/issues/136

decrypt 5y ago
I thought it was just me where Bitwarden didn't work on the private window.

bruckie 5y ago

Tavis Ormandy (of Google Project Zero) has a pretty convincing post arguing that relying on browser extensions that modify the DOM (which includes [almost?] all password managers) is a bad idea: https://lock.cmpxchg8b.com/passmgrs.html https://lock.cmpxchg8b.com/passmgrs.html (he recommends using your browser's built-in password manager, which isn't as convenient but is much more secure)

j1elo 5y ago
I guess it makes sense, but it's a very very unhelpful suggestion... we're painfully and slowly moving in the direction of teaching users how passwords are less and less useful as long as they are not random, so the ideal alternative is having all random passwords and using a vault that remembers them for us. But this whole proposition totally breaks if I store my Amazon password in Chrome at work, and then later I cannot access it in Firefox at home, or the native app in my Android phone.
ronnier 5y ago
I only open the webui, log in, copy paste my usernames and passwords. I don't trust that my passwords are safe otherwise.
- tcoff91 5y ago
  The clipboard is not exactly a secure channel. Browsers need to catch up to mobile and provide dedicated APIs for password managers to hook into so they don’t have to interact with the DOM.
- ziml77 5y ago
  I don't trust the safety of passwords going through my clipboard and me having to manually verify the URL.
kemayo 5y ago
It'd be ideal if browsers offered standard hooks into their password-filling mechanisms. Let the password managers volunteer "I know a password for this site!" and fill it through the browser's standard UI. Basically, I want the browsers to implement something close to what Apple has for password management on iOS. Ideally go a bit further and expose hooks for creating/saving a new login, too. Unless they already do this, and nobody has actually taken them up on using it?
- j1elo 5y ago
  That's an amazing idea! Do you know if any browser vendor has this concept even in the radar? It would be very cool that password managers were able to do that: manage passwords, and not have to deal with each browser's idiosyncrasies which if you think about it, is just a distraction from their actual mission of being a password storage.

addicted 5y ago

I use Bitwarden in the Firefox sidebar. That provides a persistent state experience.

j1elo 5y ago
Good idea! I'm however limited here by the fact that (Firefox at least) only one sidebar can be open at the same time. And for me that's occupied full-time by the fantastic Tree Style Tab extension. I would definitely find it useful if more sidebars could be open at the same time.
gizdan 5y ago
Which also doesn't work when using a private window.