5 ms·

That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due

That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.

oefnak 2y ago
Except the search function of bitwarden is totally broken. Searching for A B shows everything with A or B, not even with A and B at the top.
- hu3 2y ago
  This could be a good first contribution to Bitwarden for me or anyone really. Do you mean the browser extension search feature? Thanks for pointing it out.
  - Normal_gaussian 2y ago
    Just checked, and its indeed doing this nonsense in the browser extension (on firefox). Its implemented sensibly in the Android app, and I haven't tested the website vault viewer or the desktop app.
    - hu3 2y ago
      Thank you for checking and reporting back. I never touched Bitwarden project but I hope I or someone could contribute to a better search in the extension.
- bluemax 2y ago
  There is a syntax you can use to search for entries that contain both A and B: >+A +B It is annoying but it works.
ZuLuuuuuu 2y ago
We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated with your SSO which means 3600$ per year.
- MrDrMcCoy 2y ago
  Why not self-host Vaultwarden? It implements most functionality and supports the standard Bitwarden clients with virtually no resource requirements.
  - ZuLuuuuuu 2y ago
    I'll look into it, thanks!
  - teekert 2y ago
    Was going to suggest the same, of course you're taking matters into your own hands, so know what you are doing, but it's free, very light weight and supports "organizations" as a way of sharing passwords between people. I have hosted it for my family for years and was very happy with it (until I switched to Proton Family, now doing ProtonPass). And you get all the excellent Bitwarden apps and extensions to go with it.
    - trinsic2 2y ago
      You trust Proton with that data?
      - teekert 2y ago
        I certainly do, I have not seen anything yet that makes me reconsider. They have always answered to concerns well. They pass security audits. Sure I'd prefer a Linux Proton Drive client over a BTC wallet, but nobody's perfect.
lostlogin 2y ago
> LastPass There was the time they lost customer data in a hack and then lots of customers data was exploited. https://en.m.wikipedia.org/wiki/LastPass https://en.m.wikipedia.org/wiki/LastPass
- runjake 2y ago
  The thing about the LastPass Wikipedia article is that someone keeps editing it to reduce the number of really bad security issues LastPass has had over the years. You can Google almost any year, along with "lastpass security incident" and get results. Nobody with the goal of security should be using LastPass. Nobody.
- dayjah 2y ago
  I’m still suffering from this; somehow in this hack <<something>> happened to my LastPass account and login/unlocking it became impossible. LastPass support (rightly) can’t help, so 3 or so years later I’m still stumbling into sites that I can no longer access. Many sites have forgotten password flows, they’re easy, but many other sites related to municipal services, etc, require hours on calls, often on hold, proving my identity and getting access reinstated.
- imglorp 2y ago
  Not once but multiple breaches. Just no.
  - gpvos 2y ago
    I'm surprised they still exist.
noname120 2y ago
I was first using 1Password and then I really tried to love Bitwarden for two entire years (paid user). But it was riddled with bugs and UX mishaps. I gave them detailed feedback by email, they acknowledged it, but nothing changed and my frustration grew over time. I eventually switched back to 1Password one year ago and I'm delighted. For example here some issues I flagged to the team. Note that some of them may possibly have been resolved since then: – The “incorrect ciphers” error that keeps happening where you have to restart Bitwarden and lose all your changes. – Basic searches take multiple seconds if you have more than 400 entries. – Editing items is awkward. Whenever I scroll down an item and want to edit a specific entry, I have to find the edit button and then WOOSH a new panel appears and I don’t know where the field I wanted to edit ended up in the new panel. – Bitwarden doesn’t automatically categorize login items by type and it's not possible to exclude items from the “All Items” list. So it's a big mess and when you try to search a massive amount of irrelevant auto-generated entries pop up. – Scrolling is super laggy on Android. – Android logins don't have icons (they could very easily extract them when Bitwarden automatically creates an entry when logging on an Android app). – Phone numbers are not formatted. Same for many other data types. – Credit/debit cards show a generic icon rather than Mastercard, Visa, American Express, etc. – The whole interface is marked as selectable in CSS and when you try to move the window around it keeps selecting irrelevant text from the UI such as “Search Vault” and “Item Information” instead of moving the window. Likewise, if I try to select actual text the selection isn't constrained to the field I'm selecting from so I often select a bunch of crap I didn't mean to select. – Clicking on a password field doesn't offer the option to generate a password. – Password generation settings don't synchronize between Bitwarden instances. Every time you install the app or the browser extension you have to reconfigure the length, symbols, letters, casing, etc. Again. By default it uses Bitwarden's default basic (and pretty insecure) criteria. – Bitwarden frequently doesn't detect password fields, and frequently doesn't offer to automatically save the password. – Can’t drag & drop an item from the list to a folder. I have to manually edit the item entry and select the folder from the dropdown. Every time. – When editing an item, the ‶Attachments″ entry is a tiny line hidden below ‶Master password re-prompt″ so it's incredibly easy to miss and hard to find. – Attachments don’t have previews and you can't rename them. You have to manually download a given item and open it in order to see what it's about. – Can't copy attached images to the clipboard. Instead you have to press the download button, pick a folder, find it, copy the file (or possibly open it with an image editor when you need to copy the image itself), and then paste it where you want. – Automatic entry names are dumb. For example for Android apps it just picks the package name (e.g. com.voyagerx.scanner) instead of the name of the app (in this example the corresponding app's name is vFlat, so not clear from the package name!). And this is only the tip of the iceberg. I had many more issues than those with Bitwarden. None of these issues happen on 1Password.

oefnak 2y ago

Except the search function of bitwarden is totally broken. Searching for A B shows everything with A or B, not even with A and B at the top.

hu3 2y ago
This could be a good first contribution to Bitwarden for me or anyone really. Do you mean the browser extension search feature? Thanks for pointing it out.
- Normal_gaussian 2y ago
  Just checked, and its indeed doing this nonsense in the browser extension (on firefox). Its implemented sensibly in the Android app, and I haven't tested the website vault viewer or the desktop app.
  - hu3 2y ago
    Thank you for checking and reporting back. I never touched Bitwarden project but I hope I or someone could contribute to a better search in the extension.
bluemax 2y ago
There is a syntax you can use to search for entries that contain both A and B: >+A +B It is annoying but it works.

ZuLuuuuuu 2y ago

We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated with your SSO which means 3600$ per year.

MrDrMcCoy 2y ago
Why not self-host Vaultwarden? It implements most functionality and supports the standard Bitwarden clients with virtually no resource requirements.
- ZuLuuuuuu 2y ago
  I'll look into it, thanks!
- teekert 2y ago
  Was going to suggest the same, of course you're taking matters into your own hands, so know what you are doing, but it's free, very light weight and supports "organizations" as a way of sharing passwords between people. I have hosted it for my family for years and was very happy with it (until I switched to Proton Family, now doing ProtonPass). And you get all the excellent Bitwarden apps and extensions to go with it.
  - trinsic2 2y ago
    You trust Proton with that data?
    - teekert 2y ago
      I certainly do, I have not seen anything yet that makes me reconsider. They have always answered to concerns well. They pass security audits. Sure I'd prefer a Linux Proton Drive client over a BTC wallet, but nobody's perfect.

lostlogin 2y ago

> LastPass There was the time they lost customer data in a hack and then lots of customers data was exploited. https://en.m.wikipedia.org/wiki/LastPass https://en.m.wikipedia.org/wiki/LastPass

runjake 2y ago
The thing about the LastPass Wikipedia article is that someone keeps editing it to reduce the number of really bad security issues LastPass has had over the years. You can Google almost any year, along with "lastpass security incident" and get results. Nobody with the goal of security should be using LastPass. Nobody.
dayjah 2y ago
I’m still suffering from this; somehow in this hack <<something>> happened to my LastPass account and login/unlocking it became impossible. LastPass support (rightly) can’t help, so 3 or so years later I’m still stumbling into sites that I can no longer access. Many sites have forgotten password flows, they’re easy, but many other sites related to municipal services, etc, require hours on calls, often on hold, proving my identity and getting access reinstated.
imglorp 2y ago
Not once but multiple breaches. Just no.
- gpvos 2y ago
  I'm surprised they still exist.

noname120 2y ago

I was first using 1Password and then I really tried to love Bitwarden for two entire years (paid user). But it was riddled with bugs and UX mishaps. I gave them detailed feedback by email, they acknowledged it, but nothing changed and my frustration grew over time. I eventually switched back to 1Password one year ago and I'm delighted. For example here some issues I flagged to the team. Note that some of them may possibly have been resolved since then: – The “incorrect ciphers” error that keeps happening where you have to restart Bitwarden and lose all your changes. – Basic searches take multiple seconds if you have more than 400 entries. – Editing items is awkward. Whenever I scroll down an item and want to edit a specific entry, I have to find the edit button and then WOOSH a new panel appears and I don’t know where the field I wanted to edit ended up in the new panel. – Bitwarden doesn’t automatically categorize login items by type and it's not possible to exclude items from the “All Items” list. So it's a big mess and when you try to search a massive amount of irrelevant auto-generated entries pop up. – Scrolling is super laggy on Android. – Android logins don't have icons (they could very easily extract them when Bitwarden automatically creates an entry when logging on an Android app). – Phone numbers are not formatted. Same for many other data types. – Credit/debit cards show a generic icon rather than Mastercard, Visa, American Express, etc. – The whole interface is marked as selectable in CSS and when you try to move the window around it keeps selecting irrelevant text from the UI such as “Search Vault” and “Item Information” instead of moving the window. Likewise, if I try to select actual text the selection isn't constrained to the field I'm selecting from so I often select a bunch of crap I didn't mean to select. – Clicking on a password field doesn't offer the option to generate a password. – Password generation settings don't synchronize between Bitwarden instances. Every time you install the app or the browser extension you have to reconfigure the length, symbols, letters, casing, etc. Again. By default it uses Bitwarden's default basic (and pretty insecure) criteria. – Bitwarden frequently doesn't detect password fields, and frequently doesn't offer to automatically save the password. – Can’t drag & drop an item from the list to a folder. I have to manually edit the item entry and select the folder from the dropdown. Every time. – When editing an item, the ‶Attachments″ entry is a tiny line hidden below ‶Master password re-prompt″ so it's incredibly easy to miss and hard to find. – Attachments don’t have previews and you can't rename them. You have to manually download a given item and open it in order to see what it's about. – Can't copy attached images to the clipboard. Instead you have to press the download button, pick a folder, find it, copy the file (or possibly open it with an image editor when you need to copy the image itself), and then paste it where you want. – Automatic entry names are dumb. For example for Android apps it just picks the package name (e.g. com.voyagerx.scanner) instead of the name of the app (in this example the corresponding app's name is vFlat, so not clear from the package name!). And this is only the tip of the iceberg. I had many more issues than those with Bitwarden. None of these issues happen on 1Password.