6 ms·

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replace

So I've been happily using LastPass for a long time, but it looks like it's time to migrate off this dumpster fire. What's the HN consensus on the best replacement (which must be usable by my entire family) and, at least as importantly, is there a reasonably painless migration path?

CraigJPerry 4y ago
Bitwarden migration was flawless for me. Impressive given how mangled the csv export i got from lastpass was! I really dig the 2FA auto-copy to clipboard feature in bitwarden.
- messutied 4y ago
  Does Bitwarden support a keyword shortcut that brings up the password search? (outside of browser preferably), couldn't find one.
  - mdaniel 4y ago
    It appears not, since there's a feature request for it: https://community.bitwarden.com/t/global-keyboard-shortcut/33458 https://community.bitwarden.com/t/global-keyboard-shortcut/3... (and their keyboard shortcuts doc doesn't mention any such thing) Yet another fine reason to use 1Password, which puts a lot of time and attention into user experience stuff like this. I know Bitwarden is the Internet's darling, but holy hell the user experience is so aggressively bad
    - messutied 4y ago
      Thanks! Any idea of how 1password compares with bidwarden in terms of security?
      - mdaniel 4y ago
        I would give 1Password the advantage if for no other reason than they've been at it longer, and thus have seen more crazy stuff. I believe Bitwarden claims to have multiple security audits, so I do believe they take it seriously, but (and this part is just my opinion) they execute so much other stuff so poorly that alone lowers my trust in them. For clarity, 1Password also has multiple security audits, and have done a very good job of publishing the specifications for their formats, which further contributes to my trust in their execution Bitwarden's previous(?) on-premises deployment script was a raging tire fire, which I openly admit is not exactly a _security_ issue, but it further lowers my lack of faith in them With all that said, I think both Bitwarden and 1Password are miles and miles ahead of LastPass, so one will for sure be better off just picking one and trying it out. It seems to be a reversible decision, if you wanted to switch again
      - mdaniel 4y ago
        In other threads about this I was reminded that 1Password also has a security key that is known only to the client, and thus would not be leaked in the event of a cloud breach. In order to unlock the vault, one needs both pieces of information: the secret key and the master password. The secret key is cached on the client, which is why I had forgotten about it, but it is required for unlocks nonetheless Thus the advantage goes to 1Password here, since Bitwarden does not require that "second factor" known only to the client (and I'm not talking about 2FA for logins, I mean for the vault)
- lamontcg 4y ago
  > the 2FA auto-copy to clipboard feature in bitwarden is that if you're using bitwarden's 2FA authenticator instead of e.g. authy?
  - ewenjo 4y ago
    Correct. It auto copies the code if the TOTP secret key has been set for that item.
    - lamontcg 4y ago
      bitwarden's TOTP only runs on android/ios and not the mac app?
SinParadise 4y ago
Probably Bitwarden or KeepassXC. I just use KeepassXC with the db stored on pCloud.
- dicknuckle 4y ago
  KeePassXC with the DB stored in Resilio Sync for me. It's just convenient that way because I've got a home server that everything gets synced with so I don't have to rely on devices being awake at the same time.
  - michaelcampbell 4y ago
    Same here but with syncthing, so no "central cloud" storage. I've used various clients with the keepass db format for years now and have not yet been disappointed. Browser integration, Windows, Linux, Mac, and Android clients, open source, encryption I (naievely) trust... ticks all the boxes for me.
lopkeny12ko 4y ago
I have been self-hosting bitwarden_rs for many years now, and am very happy with it. It's free as in freedom, open source, and designed to be run and operated and secured by you exclusively, so you have full control over your data and don't need to rely on a third party being available.
- bpye 4y ago
  I do the same but FYI it's called Vaultwarden now.
- dividedbyzero 4y ago
  > designed to be run and operated and secured by you exclusively Which means you have to secure it. That's something a lot of people will not know how to do properly, and an insecure server with Bitwarden exposed to the public internet may turn out to be worse than trusting e.g. 1Password. Just something to keep in mind when making that decision.
  - simooooo 4y ago
    The official bit warden self host runs something like 13 docker containers. Good luck securing that as a normal person
    - renonce 4y ago
      Vaultwarden uses just 1 docker container so I am using that.
    - seized 4y ago
      There is a beta test of a new all in one container option as of earlier this month: https://bitwarden.com/blog/new-deployment-option-for-self-hosting-bitwarden/ https://bitwarden.com/blog/new-deployment-option-for-self-ho...
      - rmnclmnt 4y ago
        Ooooh that’s some very good news! And Postgres support is natively included too!
xyst 4y ago
Probably not the “HN consensus”, but if you have apple devices the built in password manager works great for me. Can even setup totp with each site and safari will auto fill
- screamingninja 4y ago
  > if you have apple devices Does it work if you have apple devices and also non-apple devices?
  - sofixa 4y ago
    Of course it doesn't, that's not how Apple operate.
    - alphabettsy 4y ago
      Not completely true, https://support.apple.com/guide/icloud-windows/set-up-icloud-passwords-icw2babf5e03/icloud https://support.apple.com/guide/icloud-windows/set-up-icloud...
salil999 4y ago
1Password is my personal choice. I can easily share passwords with my family and create separate vaults. There's a nice migration guide here: https://support.1password.com/import-lastpass/ https://support.1password.com/import-lastpass/
r00fus 4y ago
1Password or Bitwarden
jason2323 4y ago
Bitwarden. I’ve been using them ever since Lastpass discontinued their free version. I simply made a text file export of all my pw’s on lastpass and imported them into Bitwarden. Just make sure you delete your text file!
csomar 4y ago
Bitwarden. Period. They are open source, written in Rust and you can very easily run your own instance. They also have incredible support (browsers, iOS, apps, etc...)
- sofixa 4y ago
  Bitwarden is not written in Rust, it's a C#.NET with MSSQL beast, so self-hosting is not for the faint of heart. However there's an open source reverse engineered server, called vaultwarden (previously bitwarden-rs) that is indeed in Rust and quite slim. Both can be used with the official clients (which are also open source). Besides that, yes, Bitwarden is amazing.

CraigJPerry 4y ago

Bitwarden migration was flawless for me. Impressive given how mangled the csv export i got from lastpass was! I really dig the 2FA auto-copy to clipboard feature in bitwarden.

messutied 4y ago
Does Bitwarden support a keyword shortcut that brings up the password search? (outside of browser preferably), couldn't find one.
- mdaniel 4y ago
  It appears not, since there's a feature request for it: https://community.bitwarden.com/t/global-keyboard-shortcut/33458 https://community.bitwarden.com/t/global-keyboard-shortcut/3... (and their keyboard shortcuts doc doesn't mention any such thing) Yet another fine reason to use 1Password, which puts a lot of time and attention into user experience stuff like this. I know Bitwarden is the Internet's darling, but holy hell the user experience is so aggressively bad
  - messutied 4y ago
    Thanks! Any idea of how 1password compares with bidwarden in terms of security?
    - mdaniel 4y ago
      I would give 1Password the advantage if for no other reason than they've been at it longer, and thus have seen more crazy stuff. I believe Bitwarden claims to have multiple security audits, so I do believe they take it seriously, but (and this part is just my opinion) they execute so much other stuff so poorly that alone lowers my trust in them. For clarity, 1Password also has multiple security audits, and have done a very good job of publishing the specifications for their formats, which further contributes to my trust in their execution Bitwarden's previous(?) on-premises deployment script was a raging tire fire, which I openly admit is not exactly a _security_ issue, but it further lowers my lack of faith in them With all that said, I think both Bitwarden and 1Password are miles and miles ahead of LastPass, so one will for sure be better off just picking one and trying it out. It seems to be a reversible decision, if you wanted to switch again
    - mdaniel 4y ago
      In other threads about this I was reminded that 1Password also has a security key that is known only to the client, and thus would not be leaked in the event of a cloud breach. In order to unlock the vault, one needs both pieces of information: the secret key and the master password. The secret key is cached on the client, which is why I had forgotten about it, but it is required for unlocks nonetheless Thus the advantage goes to 1Password here, since Bitwarden does not require that "second factor" known only to the client (and I'm not talking about 2FA for logins, I mean for the vault)
lamontcg 4y ago
> the 2FA auto-copy to clipboard feature in bitwarden is that if you're using bitwarden's 2FA authenticator instead of e.g. authy?
- ewenjo 4y ago
  Correct. It auto copies the code if the TOTP secret key has been set for that item.
  - lamontcg 4y ago
    bitwarden's TOTP only runs on android/ios and not the mac app?

SinParadise 4y ago

Probably Bitwarden or KeepassXC. I just use KeepassXC with the db stored on pCloud.

dicknuckle 4y ago
KeePassXC with the DB stored in Resilio Sync for me. It's just convenient that way because I've got a home server that everything gets synced with so I don't have to rely on devices being awake at the same time.
- michaelcampbell 4y ago
  Same here but with syncthing, so no "central cloud" storage. I've used various clients with the keepass db format for years now and have not yet been disappointed. Browser integration, Windows, Linux, Mac, and Android clients, open source, encryption I (naievely) trust... ticks all the boxes for me.

lopkeny12ko 4y ago

I have been self-hosting bitwarden_rs for many years now, and am very happy with it. It's free as in freedom, open source, and designed to be run and operated and secured by you exclusively, so you have full control over your data and don't need to rely on a third party being available.

bpye 4y ago
I do the same but FYI it's called Vaultwarden now.
dividedbyzero 4y ago
> designed to be run and operated and secured by you exclusively Which means you have to secure it. That's something a lot of people will not know how to do properly, and an insecure server with Bitwarden exposed to the public internet may turn out to be worse than trusting e.g. 1Password. Just something to keep in mind when making that decision.
- simooooo 4y ago
  The official bit warden self host runs something like 13 docker containers. Good luck securing that as a normal person
  - renonce 4y ago
    Vaultwarden uses just 1 docker container so I am using that.
  - seized 4y ago
    There is a beta test of a new all in one container option as of earlier this month: https://bitwarden.com/blog/new-deployment-option-for-self-hosting-bitwarden/ https://bitwarden.com/blog/new-deployment-option-for-self-ho...
    - rmnclmnt 4y ago
      Ooooh that’s some very good news! And Postgres support is natively included too!

xyst 4y ago

Probably not the “HN consensus”, but if you have apple devices the built in password manager works great for me. Can even setup totp with each site and safari will auto fill

screamingninja 4y ago
> if you have apple devices Does it work if you have apple devices and also non-apple devices?
- sofixa 4y ago
  Of course it doesn't, that's not how Apple operate.
  - alphabettsy 4y ago
    Not completely true, https://support.apple.com/guide/icloud-windows/set-up-icloud-passwords-icw2babf5e03/icloud https://support.apple.com/guide/icloud-windows/set-up-icloud...

salil999 4y ago

1Password is my personal choice. I can easily share passwords with my family and create separate vaults. There's a nice migration guide here: https://support.1password.com/import-lastpass/ https://support.1password.com/import-lastpass/

r00fus 4y ago

1Password or Bitwarden

jason2323 4y ago

Bitwarden. I’ve been using them ever since Lastpass discontinued their free version. I simply made a text file export of all my pw’s on lastpass and imported them into Bitwarden. Just make sure you delete your text file!

csomar 4y ago

Bitwarden. Period. They are open source, written in Rust and you can very easily run your own instance. They also have incredible support (browsers, iOS, apps, etc...)

sofixa 4y ago
Bitwarden is not written in Rust, it's a C#.NET with MSSQL beast, so self-hosting is not for the faint of heart. However there's an open source reverse engineered server, called vaultwarden (previously bitwarden-rs) that is indeed in Rust and quite slim. Both can be used with the official clients (which are also open source). Besides that, yes, Bitwarden is amazing.