13 ms·
As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of t
by AdmiralAsshat 4y ago
As a recent convert to Bitwarden from LastPass, I start to get a bit nervous when I see acquisitions happening. LastPass getting acquired was the beginning of the end for it, IMO, before stagnating into criminal negligence.
Granted this is Bitwarden acquiring rather than being acquired, but I still worry it leads to a trend of building "portfolio value" rather than focusing on the product. I sincerely hope I'm wrong.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- allochthon 4y agoI had a similar reaction. Acquisitions can be a signal that there's a go-to-market strategy being pursued.
- gagabity 4y agoAlso Bitwarden recently raised 100M from VC so yeah, the clock is ticking now.
- afavour 4y agoThey did? Oh JFC I just switched from 1Password to avoid using a VC backed service. At least there's always Vaultwarden, now all I need is a service I can pay to host an instance for me. ...and to not take VC funding. https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden Though I fear it’s only a matter of time before the VC gods demand the client apps remove compatibility and they have to be forked too.
- mfer 4y agoNot to totally burst your bubble but 1Password took funding a few years ago [1]. I say this as a 1Password user. [1] https://www.wsj.com/articles/password-manager-1password-raises-first-round-of-venture-capital-11573740060 https://www.wsj.com/articles/password-manager-1password-rais...
- afavour 4y agoOh I know, I switched from 1Password to Bitwarden for exactly that reason.
- jorvi 4y agoI switched from 1Password to Bitwarden, imported my vault, and then realized that their client doesn’t even support drag ‘n drop. I’ve been wanting to switch from 1Password to Bitwarden for years, but each year I try it I’m just flummoxed by how atrociously behind the UX / UI still is. Unless you (or whoever you’re getting to switch) are an absolute open source absolutist: do yourself a favor and go for 1Password.
- afavour 4y agoI did try to switch a year or so ago and got really frustrated. Tried again a week ago and Bitwarden does seem a little better. It helps that it feels like 1Password's app has been getting more bloated over time (though I have no data to support that assertion).
- Liquidor 4y agoI'm of the opposite opinion in this case. If someone creates new tech and it fits with Bitwarden then I'm more than happy to see what they can do together.
- sschueller 4y agoLike docker? They made huge profits but docker itself has made practically no improvements. It's still using iptables when many distros switches to nftables causing a huge mess and the documentation is still really poor.
- paulryanrogers 4y agoBitWarden is open source on both ends. So worst case one can self host then fork clients. (Server has already been reimplemented independently.)
- Macha 4y agoSo too have some clients (e.g. rbw CLI). So just need an independent browser extension and then my use of Bitwarden does not need Bitwarden LLC (and the browser extension is not great, so that's not a high bar)
- cdev_gl 4y agoThis is true, but LastPass proved that by the time the worst case occurs it's already too late. A security breach means, at minimum, redoing all your passwords, and these sites are a very compelling target. OTOH I wouldn't want to self-host because I know I'm not going to spend the same amount of time and effort a full security staff would, even if my self-hosted box would make a much less attractive target. It's quite a pickle.
- vorpalhex 4y agoYou have security options self hosting that a big host does not. Want to just encrypt everything on a node with no network access? Sure. That doesn't work for a "real" host but that is fine if you mostly use your phone and need to just occasionally sync your passwords back at home. You don't need the things that make hosting hard. You can have a few hours of downtime. You password vault is gigabytes, not hundreds of terabytes. You don't need to arm guard your backups, just pass them (encrypted) to a friend with a safe.
- lewantmontreal 4y agoDoes bitwarden work if server is offline? I know the client works without internet connection but server outage had an issue earlier last year https://news.ycombinator.com/item?id=32782386 https://news.ycombinator.com/item?id=32782386
- 4y ago
- rvz 4y agoI'd like to remind you that Bitwarden is becoming completely VC backed with the way it is going [0] and there is always a possibility that it can be acquired to give investors a return. The same happened with Keybase as soon as they took VC cash. It is now growth at all costs until an eventual acquisition of Bitwarden. So I won't be surprised to see price increases on some plans soon. [0] https://bitwarden.com/blog/accelerating-value-for-bitwarden-users-bitwarden-raises-usd100-million/ https://bitwarden.com/blog/accelerating-value-for-bitwarden-...
- sirsinsalot 4y agoThe keybase pivot was so ugly and sad. Their pre VC product was really nice.
- kjfarm 4y agoA good note for bitwarden is that it has a self hosting open source version, vaultwarden that is easy to switch to: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden I see this as downside protection, as I can quickly migrate if I disagree with bitwarden's direction with minimal changes to my clients. I do worry about VC pressure on Bitwarden for hypergrowth. However in my personal opinion, the benefits outweigh the cons (for now).
- omnicognate 4y agoVaultwarden's great. I use it. I use the Bitwarden Android client, though. Not sure what there is to replace that.
- princevegeta89 4y agoIs it not possible to point BW Android to your Vaultwarden instance?
- cube00 4y agoIt's fragile if you do that. Bitwarden updated their API last month on the clients so you couldn't connect to Vaultwarden at all until the Vaultwarden team could reverse engineer the change and produce a new release.
- BrandoElFollito 4y agoThis is interesting. I use BW daily (many times) on Android against my self-updating VW instance. I did not notice anything, maybe the break happened during the night in Europe. Or the Android app did not want about problems.
- cube00 4y agoIn my case I could continue to use the app, it broke the ability to sign into the vault. If you only lock your vault and not fully logout you may not have noticed it. https://github.com/dani-garcia/vaultwarden/issues/3082 https://github.com/dani-garcia/vaultwarden/issues/3082
- switch007 4y agoI’d bet on KeePass 2 longer term. KeepPassCX has been around 10 years (forked from a project started 8 years before that). Actively developed, cross platform. There are decent apps for android and iOS (eg Strongbox) I’m going to migrate off 1Password to it soon
- princevegeta89 4y agoWhat is the best client for Keepass on Android? How is the autofill functionality?
- ESchack 4y agoI did this some time ago when 1Password announced switching from having native apps to being containerized web apps. Have not regretted it one bit.
- velhartice 4y agoBingo, me too. I like that keepass is file based so I can use any storage medium to make multiple layers of security to access the vault. Even if cloud providers have access to the file or my cloud storage account gets hacked they still have to crack the file to get the passowrds. Also I have been using strongbox pro for a few years now and been very happy, in fact I like it better than what 1password used to be. Worth every penny. KeepassXC has also been great.
- aheckler 4y agoI've been considering a switch from 1Password to KeepassXC myself, but the last time I tried it, I couldn't find if KeepassXC has some equivalent to the "quick access" feature of 1Password.[0] In short, a way to open a small window, search for a service name or URL, and then quickly copy username, password, or a TOTP code. As far as I could tell, I had to open the entire KeepassXC app every time to find something. Has this changed, or did I miss something somehow? [0] https://support.1password.com/quick-access/ https://support.1password.com/quick-access/
- bluSCALE4 4y agoThe concern with Bitwarden started a few months back when they did a round of venture capital funding. Now, they have to turn profits instead of just being great.
- sirsinsalot 4y agoNot being a non profit or charity, I'm fairly sure profit was a need for sustaining the business before investment.
- sngz 4y agonot just turn profit. But ridiculous unsustainable amounts of profit at the expense of the users until its bled dry then it will be sold off
- babypuncher 4y agoI know this dead horse has probably been beaten beyond recognition, but I think the safest option that still preserves some convenience for password management is to stick a keepass database in your cloud storage provider (icloud/dropbox/whatever). Some keepass compatible apps even offer full iOS integration (FaceTime unlock, Password AutoFill), so you don't lose these features you're used to with LastPass.
- WheatMillington 4y agoCriminal negligence? Explain?
- AdmiralAsshat 4y agohttps://www.grc.com/sn/sn-905-notes.pdf https://www.grc.com/sn/sn-905-notes.pdf There are multiple users who, post-breach, are checking the Iteration Count the number of PBKDF2 iterations for their vault, and discovering that even though LastPass had been slowly increasing the number of iterations for new customers in line with industry best practices, they were never going back and upgrading the old users. So if you created a LastPass account in the past few years, your iteration count was 100,000. But if you were an older user, it may have only been 5,000. Or 500. Or, in the case of many old users: 1. One iteration. That's all that was protecting their encrypted vault--now in the hands of attackers--from brute forcing.
- dcow 4y agoSeems like Bitwarden is successful enough to have the cash to make a strategic acquisition. That seems like a good thing for users.
- KyeRussell 4y agoI’ve never used Bitwarden, but I’ve used LastPass in the past, and I’ve used 1Password for ages. AgileBits took on a big chunk of VC some time ago. This upset a bunch of people, too. Slightly different circumstances due to the different user base and source availability, but whatever. I can say with certainty that I’ve continued to get value out of 1Password both personally and professionally. I can even say with a degree of certainty that I’ve gotten value out of the changes that have come post-acquisition. Were I starting from scratch, I’d still probably pick 1Password. This isn’t me arguing that 1Password is better. More saying that it’s been a…little bit of time now, and I’m still happy with the product and how it’s improved. I appreciate that acquisitions or taking on funding feels like more of a kick in the teeth because it’s a distinct event, is publicised, and even publicised as a good thing. Having just gone through my first acquisition (as an employee in an entirely bootstrapped small business) I’ve realised that this has to be weighed up against the risks associated with whatever was in the no-funding no-acquisition future, i.e. the thing just going away entirely, which happens slowly (and then all at once) and mostly in private. I’ve little doubt that over time 1Password will get comparatively worse than whatever else is around. Either because it’s neglected or because it gets juiced and dark patterned by VC incentives. Ignoring the VC bit, I’m just as sure the same will still happen to Bitwarden obviously. But this shifting playing field just feels like an inevitability regardless of which path any product takes.
- brynjolf 4y agoHonestly since I bought bitwarden premium two years ago, there hasn't been a single relevant improvement to the client. It is basically not getting any UX love. No autocomplete on username, slow initial load, search function is sticky on desktop client but not on the rest. No way to easily add folders or reorganise multiple items. I won't renew my subscription, not that they care anymore