4 ms·

I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I al

I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.

kevincox 5y ago
I would argue it is trust. I trust my password manager to validate the website I am entering my password into more than I trust my eyes. I know that I can't be perfectly vigilant every single time I enter my password. The risk of the password manager betraying me is roughly an order of magnitude below the risk of my falling for a phishing attack. Plus I use the password manager baked into my browser, so I'm basically trusting it anyways.
antihero 5y ago
I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.
- fsflover 5y ago
  > because it’s a company that happily makes money from that trust You could also say this about Microsoft, except they've been breaking such trust for a long time.
  - rewgs 5y ago
    That's a pretty obviously bad take. You're comparing a company whose single product is about keeping one kind of thing secure, and another company that makes dozens of products, most of which don't explicitly have to do with security.
    - arepublicadoceu 5y ago
      I’m not an expert by any means but I have a layman sense that keeping Windows safe is a way more gargantuan task than keeping an encrypted vault safe inside my computer (before 1password moved to this cloud nonsense to milk subscription money). If my windows is compromised no amount of tech wizardry can protect my 1password credentials.
  - throw10920 5y ago
    Microsoft exists in an effective duopoly for desktop computing - the vast majority of desktop computers run Windows, and only a small fraction run MacOS, and an even tinier fraction run anything else. That, combined with a host of other lock-in factors (the strong emotional attachments that people have to being a "PC person" and not a "Mac person", the relative expensiveness of devices that run MacOS, the software that only runs on Windows, the UX difference between platforms) put Windows in an entirely different class than password managers. Password managers are a commodity. Operating systems are not. Microsoft knows this, and they abuse it accordingly.
- lotsofpulp 5y ago
  Lastpass made money the same way, and look at what happened to Lastpass users.
  - antihero 5y ago
    Yeah but anyone could tell LastPass were extremely lax as a business, their software has always seemed poor quality and their communication is terrible as well. 1Password nails both of these things.
tobylane 5y ago
Because it’s a crime for them to make use of the passwords, and I’d be able to claim back any financial loss. I picked Bitwarden because it’s widely trusted, it’s trusted because it’s open source and widely assumed to be casually audited by many _other_ people. There’s a weak point here in how many of us are relying on others to do the audit, in a bystander effect sense. I don’t think either of these are BW specific, which just shows there’s a large family of wise options.
- ipaddr 5y ago
  But so is wordpress. Open source and a lot of eyes can find bugs but not everyone reports
- rainbowzootsuit 5y ago
  They've published the results code audits and network audits here: https://bitwarden.com/blog/bitwarden-network-security-assessment-2020/ https://bitwarden.com/blog/bitwarden-network-security-assess...
andrewaylett 5y ago
If I'm accessing my passwords via the clients that BitWarden the company distributes, then I'm still putting my trust in the company. Where the encrypted data is stored is in many ways less important. And the irony is that the one website I can't trust my password manager to protect me from phishing attacks on is the password manager's own web interface. So I always want to log in with one of the non-web clients, and only trust the web vault if I reached it via a known-good link (like the one in the settings panel of the browser addon and mobile apps).
andreareina 5y ago
What's the alternative to trusting BW? If it's reusing credentials then you just have to trust them more than any other authenticated service. I'd say that's the model that applies to most people, they're not going to self-host or manually sync between devices. Why trust BW over other providers? Because of third-party audits and signals of good-faith like open source. Why trust BW over self-hosting? Well, I don't. Or rather I have more confidence in being able to recover from a failure on my part, nevermind that they're probably less likely to suffer from technical issues.

kevincox 5y ago

I would argue it is trust. I trust my password manager to validate the website I am entering my password into more than I trust my eyes. I know that I can't be perfectly vigilant every single time I enter my password. The risk of the password manager betraying me is roughly an order of magnitude below the risk of my falling for a phishing attack. Plus I use the password manager baked into my browser, so I'm basically trusting it anyways.

antihero 5y ago

I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.

fsflover 5y ago
> because it’s a company that happily makes money from that trust You could also say this about Microsoft, except they've been breaking such trust for a long time.
- rewgs 5y ago
  That's a pretty obviously bad take. You're comparing a company whose single product is about keeping one kind of thing secure, and another company that makes dozens of products, most of which don't explicitly have to do with security.
  - arepublicadoceu 5y ago
    I’m not an expert by any means but I have a layman sense that keeping Windows safe is a way more gargantuan task than keeping an encrypted vault safe inside my computer (before 1password moved to this cloud nonsense to milk subscription money). If my windows is compromised no amount of tech wizardry can protect my 1password credentials.
- throw10920 5y ago
  Microsoft exists in an effective duopoly for desktop computing - the vast majority of desktop computers run Windows, and only a small fraction run MacOS, and an even tinier fraction run anything else. That, combined with a host of other lock-in factors (the strong emotional attachments that people have to being a "PC person" and not a "Mac person", the relative expensiveness of devices that run MacOS, the software that only runs on Windows, the UX difference between platforms) put Windows in an entirely different class than password managers. Password managers are a commodity. Operating systems are not. Microsoft knows this, and they abuse it accordingly.
lotsofpulp 5y ago
Lastpass made money the same way, and look at what happened to Lastpass users.
- antihero 5y ago
  Yeah but anyone could tell LastPass were extremely lax as a business, their software has always seemed poor quality and their communication is terrible as well. 1Password nails both of these things.

tobylane 5y ago

Because it’s a crime for them to make use of the passwords, and I’d be able to claim back any financial loss. I picked Bitwarden because it’s widely trusted, it’s trusted because it’s open source and widely assumed to be casually audited by many _other_ people. There’s a weak point here in how many of us are relying on others to do the audit, in a bystander effect sense. I don’t think either of these are BW specific, which just shows there’s a large family of wise options.

ipaddr 5y ago
But so is wordpress. Open source and a lot of eyes can find bugs but not everyone reports
rainbowzootsuit 5y ago
They've published the results code audits and network audits here: https://bitwarden.com/blog/bitwarden-network-security-assessment-2020/ https://bitwarden.com/blog/bitwarden-network-security-assess...

andrewaylett 5y ago

If I'm accessing my passwords via the clients that BitWarden the company distributes, then I'm still putting my trust in the company. Where the encrypted data is stored is in many ways less important. And the irony is that the one website I can't trust my password manager to protect me from phishing attacks on is the password manager's own web interface. So I always want to log in with one of the non-web clients, and only trust the web vault if I reached it via a known-good link (like the one in the settings panel of the browser addon and mobile apps).

andreareina 5y ago

What's the alternative to trusting BW? If it's reusing credentials then you just have to trust them more than any other authenticated service. I'd say that's the model that applies to most people, they're not going to self-host or manually sync between devices. Why trust BW over other providers? Because of third-party audits and signals of good-faith like open source. Why trust BW over self-hosting? Well, I don't. Or rather I have more confidence in being able to recover from a failure on my part, nevermind that they're probably less likely to suffer from technical issues.