6 ms·

> Why would a password manager need so much money? The money isn't for the password manager particularly. In the article they list a number of new things they

> Why would a password manager need so much money? The money isn't for the password manager particularly. In the article they list a number of new things they want to develop. I think there will come a point when most mainstream web services will require "passwordless" authentication, which means users will have to register with one of a few commercial passwordless providers. Think "login to service X with Google/GitHub/Facebook" but more integrated with your phone and biometrics, and no longer optional as email and password authentication go out of fashion. It makes sense for Bitwarden to aim to be one of those providers, if for no other reason than company survival if passwords and similar tokens become deprecated.

scarface74 4y ago
And the three companies behind the major platforms - Google, Apple, and Microsoft - have all agreed on a standard and will integrate a solution into their operating systems.
- phpisthebest 4y ago
  Yes, and what is that one like the 6th or more "auth standard" they all "agreed to" before promptly doing their own variations which then get spun into a new standard they all "agree" to before.......
  - scarface74 4y ago
    Even if that is the case, storing passwords across devices is a solved problem and not enough people are willing to pay for it to be a profitable business. “It’s a feature not a product”
    - phpisthebest 4y ago
      Given the number of businesses out there doing it I would venture to guess you are wrong. Also Bitwarden and other password managers are not just about storing the passwords. For example on a personal level I use bitwarden family to manage my Parents passwords and to assist them with issue on various service, this gives me away to setup accounts and securely share passwords with them for the services, and vice versa For business we use the Enterprise products to share passwords for everything... None of which is a "solved problem" at the OS or Browser level
      - scarface74 4y ago
        Why are large businesses “sharing passwords” between users? What happens when one user leaves? Isn’t sharing a password in a business context like “Things you shouldn’t do” 101?
        phpisthebest 4y ago
        Lots of things would not have individual passwords, Including 1. Hardware Passwords 2. BreakGlass Accounts (used if SSO Fails) 3. Vendor Passwords 4. Recovery Passwords 5. Local Admin Passwords for Servers We also use it to store Backup Encryption Keys, VPN Tunnel Keys, SSL Cert Passwords, File Encryption Passwords, License Keys, etc etc etc We also have our own Personal Vaults that are indivualized, so we can access both our Personal Passwords and Company passwords in one interface, that is Cross OS, Cross Browser, and has API for programming interfaces. none of which is possible with BrowserBased or OS Based Password Storage.
        ctvo 4y ago
        > Why are large businesses “sharing passwords” between users? What happens when one user leaves? Because not all products businesses use have fine grain authentication and authorization. For example, their registar for their domain names. And differing employees need access to it at different times. > Isn’t sharing a password in a business context like “Things you shouldn’t do” 101? What do you think Bitwarden does? It's fine grain authorization over shared resources (passwords) that control who can access them. You categorize, create roles, and give those roles access to specific passwords. When an employee leaves, you rotate the password. Every access is recorded for auditing. It solves a real business problem.
        scarface74 4y ago
        Now I’m curious and this comes from my job history is working at mostly small disorganized companies and then moving to one very large company where I work with other very large enterprises so I have no experience with mid size companies. Say I work for a large company where everything is gated via an SSO - email, Slack, internal apps, ADP for payroll, my brokerage account containing my 401K information (of course I do have a separate non SSO password for this since it is my account), and Bitwarden (I see it does support SAML). If I leave my very large organization, it’s easy enough for a manager to disable my SSO and be mostly assured that I don’t have access to anything I shouldn’t. Because “security is job 0” (How do you say where you work without saying where you work /s). Now let’s say that BitWarden stores 10 passwords to external services and I had access to those passwords through Bitwarden. Does someone then have to go in and manually change passwords to those 10 services every time someone leaves?
    - jorvi 4y ago
      > and not enough people are willing to pay for it to be a profitable business. 1Password is doing just fine..
      - scarface74 4y ago
        Now they are also raising rounds of funding “chasing after the enterprise”. Every single time a small bootstrapped company tries to “accelerate growth by going after the enterprise” the product gets worse for consumers. See also DropBox. 1Password’s desktop app is much worse than it use to be all while each platforms built in capabilities are getting better.
        blasphemers 4y ago
        That's because they did a complete rewrite of it, something they talked about on a couple podcasts before they took on funding.
        selectodude 4y ago
        >1Password’s desktop app is much worse than it use to be all while each platforms built in capabilities are getting better. I keep reading this but as a user of 1Password over the past decade or so, the functionality hasn't changed much. I'm confused as to what they're spending all the VC money on because these re-writes haven't done much but in terms of functionality, I think it's best in class. What am I missing?
        roustem 4y ago
        Thank you for using 1Password! A full rewrite takes a lot of time. We did this twice in the past and it is always painful. We had to do it again this time because the discrepancies between the platforms became ridiculous and we had to fix this. For example, the same search would produce different results on Mac and Windows and Android. We also took time to address some of the pain points that existed in 1Password 7. For example, it was technically possible to have a different Master Password on your Mac and iPhone, etc. The local database was rewritten and we made sure that everything that is possible is fully encrypted. For example, all rich icons are now stored encrypted. We also changed the logging system to make sure no personal information is ever logged. At the same time, we had to make sure the data format is backwards compatible with the old version so that both 1Password 8 and 1Password 7 can be used during the transition. We ran over 100 studies with both existing users and people who never tried 1Password before to make sure the apps are more usable by everyone. For new users we added New Item experience that made it easier to navigate through templates and understand how to use 1Password. For developers, we added CLI integration, support for SSH keys, and a built-in SSH agent that secures your ssh private keys. Brand new Linux app, more than 100 new features and improvements overall, on top of the full rewrite.
411111111111111 4y ago
Isn't there already a standard for that: webauthn ? Hasn't really caught on, despite being several years in the making already
- JshWright 4y ago
  Sure, a standard exists, but that by itself isn't a great user experience. If you actually try to use something like a YubiKey you end up having to register multiple keys with each site to deal with lost key (assuming the site allows that in the first place). The you have to remember which keys correspond to which sites, and remember to get your backup key out each time you sign up somewhere new , etc. Google, Apple, etc are building on WebAuthN in order to allow a trusted third party to "sync" the keys, solving the major usability hurdle for most people (as with all things security related, there's an obvious tradeoff in injecting a trusted third party, but for the vast majority of people that tradeoff still results in a significant net risk reduction). I assume Bitwarden is angling to build out their own version of something in this space. https://www.imperialviolet.org/2022/07/04/passkeys.html https://www.imperialviolet.org/2022/07/04/passkeys.html
  - Ajedi32 4y ago
    I'm probably more excited about passkeys than most, but I don't see why you need $100M to add support for that. It's a pretty straightforward addition to existing password managers. Might even be easier to support than it is to build a user-friendly password autofill, all things considered.
  - ensignavenger 4y ago
    I find that the essayist way to handle backup keys is with a printout of 10-20 pre-generated auth codes, which go in my safe. Much easier than having a backup hardware key I have to remove and then replace from my safe, each time I need to add a new service service.
    - JshWright 4y ago
      Which is great if you have a printer (and are near it when you're signing up for the account, and remember to do it, and remember to put it in your safe, etc...). Just because it's the easiest way currently doesn't mean there isn't substantial room for improvement in the usability of passwordless systems. Most users aren't going to go to the trouble of printing something out like that.

scarface74 4y ago

And the three companies behind the major platforms - Google, Apple, and Microsoft - have all agreed on a standard and will integrate a solution into their operating systems.

phpisthebest 4y ago
Yes, and what is that one like the 6th or more "auth standard" they all "agreed to" before promptly doing their own variations which then get spun into a new standard they all "agree" to before.......
- scarface74 4y ago
  Even if that is the case, storing passwords across devices is a solved problem and not enough people are willing to pay for it to be a profitable business. “It’s a feature not a product”
  - phpisthebest 4y ago
    Given the number of businesses out there doing it I would venture to guess you are wrong. Also Bitwarden and other password managers are not just about storing the passwords. For example on a personal level I use bitwarden family to manage my Parents passwords and to assist them with issue on various service, this gives me away to setup accounts and securely share passwords with them for the services, and vice versa For business we use the Enterprise products to share passwords for everything... None of which is a "solved problem" at the OS or Browser level
    - scarface74 4y ago
      Why are large businesses “sharing passwords” between users? What happens when one user leaves? Isn’t sharing a password in a business context like “Things you shouldn’t do” 101?
      - phpisthebest 4y ago
        Lots of things would not have individual passwords, Including 1. Hardware Passwords 2. BreakGlass Accounts (used if SSO Fails) 3. Vendor Passwords 4. Recovery Passwords 5. Local Admin Passwords for Servers We also use it to store Backup Encryption Keys, VPN Tunnel Keys, SSL Cert Passwords, File Encryption Passwords, License Keys, etc etc etc We also have our own Personal Vaults that are indivualized, so we can access both our Personal Passwords and Company passwords in one interface, that is Cross OS, Cross Browser, and has API for programming interfaces. none of which is possible with BrowserBased or OS Based Password Storage.
      - ctvo 4y ago
        > Why are large businesses “sharing passwords” between users? What happens when one user leaves? Because not all products businesses use have fine grain authentication and authorization. For example, their registar for their domain names. And differing employees need access to it at different times. > Isn’t sharing a password in a business context like “Things you shouldn’t do” 101? What do you think Bitwarden does? It's fine grain authorization over shared resources (passwords) that control who can access them. You categorize, create roles, and give those roles access to specific passwords. When an employee leaves, you rotate the password. Every access is recorded for auditing. It solves a real business problem.
        scarface74 4y ago
        Now I’m curious and this comes from my job history is working at mostly small disorganized companies and then moving to one very large company where I work with other very large enterprises so I have no experience with mid size companies. Say I work for a large company where everything is gated via an SSO - email, Slack, internal apps, ADP for payroll, my brokerage account containing my 401K information (of course I do have a separate non SSO password for this since it is my account), and Bitwarden (I see it does support SAML). If I leave my very large organization, it’s easy enough for a manager to disable my SSO and be mostly assured that I don’t have access to anything I shouldn’t. Because “security is job 0” (How do you say where you work without saying where you work /s). Now let’s say that BitWarden stores 10 passwords to external services and I had access to those passwords through Bitwarden. Does someone then have to go in and manually change passwords to those 10 services every time someone leaves?
  - jorvi 4y ago
    > and not enough people are willing to pay for it to be a profitable business. 1Password is doing just fine..
    - scarface74 4y ago
      Now they are also raising rounds of funding “chasing after the enterprise”. Every single time a small bootstrapped company tries to “accelerate growth by going after the enterprise” the product gets worse for consumers. See also DropBox. 1Password’s desktop app is much worse than it use to be all while each platforms built in capabilities are getting better.
      - blasphemers 4y ago
        That's because they did a complete rewrite of it, something they talked about on a couple podcasts before they took on funding.
      - selectodude 4y ago
        >1Password’s desktop app is much worse than it use to be all while each platforms built in capabilities are getting better. I keep reading this but as a user of 1Password over the past decade or so, the functionality hasn't changed much. I'm confused as to what they're spending all the VC money on because these re-writes haven't done much but in terms of functionality, I think it's best in class. What am I missing?
        roustem 4y ago
        Thank you for using 1Password! A full rewrite takes a lot of time. We did this twice in the past and it is always painful. We had to do it again this time because the discrepancies between the platforms became ridiculous and we had to fix this. For example, the same search would produce different results on Mac and Windows and Android. We also took time to address some of the pain points that existed in 1Password 7. For example, it was technically possible to have a different Master Password on your Mac and iPhone, etc. The local database was rewritten and we made sure that everything that is possible is fully encrypted. For example, all rich icons are now stored encrypted. We also changed the logging system to make sure no personal information is ever logged. At the same time, we had to make sure the data format is backwards compatible with the old version so that both 1Password 8 and 1Password 7 can be used during the transition. We ran over 100 studies with both existing users and people who never tried 1Password before to make sure the apps are more usable by everyone. For new users we added New Item experience that made it easier to navigate through templates and understand how to use 1Password. For developers, we added CLI integration, support for SSH keys, and a built-in SSH agent that secures your ssh private keys. Brand new Linux app, more than 100 new features and improvements overall, on top of the full rewrite.

411111111111111 4y ago

Isn't there already a standard for that: webauthn ? Hasn't really caught on, despite being several years in the making already

JshWright 4y ago
Sure, a standard exists, but that by itself isn't a great user experience. If you actually try to use something like a YubiKey you end up having to register multiple keys with each site to deal with lost key (assuming the site allows that in the first place). The you have to remember which keys correspond to which sites, and remember to get your backup key out each time you sign up somewhere new , etc. Google, Apple, etc are building on WebAuthN in order to allow a trusted third party to "sync" the keys, solving the major usability hurdle for most people (as with all things security related, there's an obvious tradeoff in injecting a trusted third party, but for the vast majority of people that tradeoff still results in a significant net risk reduction). I assume Bitwarden is angling to build out their own version of something in this space. https://www.imperialviolet.org/2022/07/04/passkeys.html https://www.imperialviolet.org/2022/07/04/passkeys.html
- Ajedi32 4y ago
  I'm probably more excited about passkeys than most, but I don't see why you need $100M to add support for that. It's a pretty straightforward addition to existing password managers. Might even be easier to support than it is to build a user-friendly password autofill, all things considered.
- ensignavenger 4y ago
  I find that the essayist way to handle backup keys is with a printout of 10-20 pre-generated auth codes, which go in my safe. Much easier than having a backup hardware key I have to remove and then replace from my safe, each time I need to add a new service service.
  - JshWright 4y ago
    Which is great if you have a printer (and are near it when you're signing up for the account, and remember to do it, and remember to put it in your safe, etc...). Just because it's the easiest way currently doesn't mean there isn't substantial room for improvement in the usability of passwordless systems. Most users aren't going to go to the trouble of printing something out like that.