12 ms·

Thank you to Bitwarden for relicensing a thing to Free/Open License! Unfortunately, I no longer recommend Bitwarden for normal people because the built-in passw

• lxgr 2y ago
  Can it store TOTPs and passkeys as well? These are two things encountered even by "regular people" more and more. Especially keeping passkeys platform-independent is a huge advantage, in my view.
  • Uvix 2y ago
    Yes, Bitwarden can store both.
    • lxgr 2y ago
      I was referring to Firefox with that question.
      • odo1242 2y ago
        It can't, you need a browser extension for that.
      • Uvix 2y ago
        Ah, sorry for misunderstanding.
  • freedomben 2y ago
    There will always be different opinions, but my opinion is that storing your TOTPs in your password manager is at best a reduction in security because you're reducing your 2 factors down to 1 factor. If the password manager gets compromised (even phished! It needn't involve the password manager's servers getting hacked), then you gain nothing by having 2FA enabled. I would strongly advise using something like Aegis on Android, or Gnome Authenticator on desktop (or both). I like to duplicate/backup my seeds so that I'm not SOL if my phone breaks, but I do it by having them on my laptop, desktop, and phone. That way as long as I have one of the three devices, I can always get in, and then they're not "in the cloud." Though, "in the cloud" is still better than "in the cloud alongside all my passwords."
    • magackame 2y ago
      Doesen't having the seeds available on all of the devices make it not 2FA? You now need only one device to login at any given time.
      • mason55 2y ago
        The second factor isn’t a second device, it’s the TOTP code.
        • AStonesThrow 2y ago
          No, factors are supposed to have different qualities, such as: "Something you know"; "something you have"; "something you do"; "something you are [biometrics]"; "somewhere you are [geolocation]". Passwords are in your head - "something you know". TOTP codes are generated by a hardware token - "something you have". If the TOTP codes are crammed into your password manager, then the factors are no longer distinguished by these qualities, but they're now the same factor, and it's not true MFA anymore, whether or not they're split up across devices, or apps.
          • akho 2y ago
            2FA via TOTP implies two things: 1) you know a password; 2) you know the seed. This is why people criticize that approach. In practice, knowing a password and having a file (seed) seem different enough, and work against some phishing threats. Logging in through a password manager requires that you know a password (your master password), and have a file (your vault).
            • KPGv2 2y ago
              Or alternatively something you are (fingerprint) alongside something you have.
          • ivanfilhoz 2y ago
            Actually, they are pretty much split up. To get access to my passwords and TOTP secrets, the attacker needs one of my devices (something I have) and its password (something I know) or my face/fingerprint (something I am). The whole point of a fully featured password manager like 1Password or Bitwarden is to rely on it instead of the security of the service you're using. And that implies that you must trust the security of the vault itself. Of course, each device you have is an additional (an equally dangerous) attack surface. However, most people should be more worried if someone hacks into their devices than their Facebook accounts anyway.
  • odo1242 2y ago
    Yes, through TOTPs will run you a (worth it imo) $10/year subscription. Passkeys have been supported for a while (free) on all major platforms, and I haven't seen any issues with it.
• bigfatfrock 2y ago
  > because KeepassXC + syncing is way too difficult for normal people I've been debating for ages if this is a hurdle that can be overcome by packaging or even hand-holding support. When I show "normal people" my pass+sync setup they beg me to implement it for them. Once it's running it's near-zero maintenance.
  • przmk 2y ago
    Where did you manage to find "normal people" that begged you to install a password manager for them? I have yet to come across one person who wanted one.
    • archi42 2y ago
      There are normal people out there who have been hacked, or knew someone who was. Also, some normal people are computer-smart enough to understand problems like credential-stuffing, if someone explains it to them.
  • lie07 2y ago
    Would love to know how you have it setup.
  • peterpans01 2y ago
    can you share how do you set this up?
    • freeone3000 2y ago
      I store the password vault in dropbox. Done.
      • dcow 2y ago
        100% serious question: how is using dropbox (one cloud) to sync passwords any better or more secure than using a password manager that syncs your vault for you (another cloud)? I see so many "I don't trust <insert pw manager> so I use dropbox" comments around these parts and I just don't understand what real or perceived threat is being mitigated.
• danpalmer 2y ago
  > Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good Interesting, I've always felt that browser-based password managers provided remarkably little value for most people. Using them on mobile is tricky and platform dependent, it's easy to have local-only, non-synced data and then lose it, and being multi-device is trickier, especially in a work context. On the other hand, people generally understand installing an app on each device they own and that app doing it for them.
  • mrwm 2y ago
    I'm not sure how it is on iOS, but I've been using firefox as my password maanger on android. It's a trivial change in the settings and works across all apps as well. I also recommend it to my friend group, as they can use firefox with uBlock Origin, and also have their passwords synced.
    • deleted 2y ago
      [deleted]
    • tetris11 2y ago
      Yep, since Android 12 I think you can set Firefox as your main password manager. It's genuinely delicious
  • simfree 2y ago
    Firefox password sync just works. It's one of those things I never think about. Watching friends and family struggle with bespoke, poorly integrated password managers makes me cringe and is one of the big reasons I enjoy the seamless experience of the built-in Firefox password manager.
    • mikae1 2y ago
      But does it work for non-website passwords like the PIN for the door at your workplace or the usernames and passwords for your computers?
• Thaxll 2y ago
  Keepass file on Google drive is kind of trivial though.
  • throwuxiytayq 2y ago
    Never store anything remotely important on a Google service.
    • arnavpraneet 2y ago
      I know we are kidding but damn the news Google Drive is being sunsetted by December would ruin a lot of people's days
      • ClassyJacket 2y ago
        At this rate they'll sunset google search and their advertising business just because.
    • teo_zero 2y ago
      Never store the only copy of anything remotely important on any online service. Storing copies is ok, though, provided that sensitive information is encrypted.
• gertop 2y ago
  Firefox's password manager stores passwords in clear text unless you use a master password (very few people do). This means that any process on the computer can read them. It also means that, unless you also use full disk encryption, a stolen device means you're fucked. Chrome and Safari use the OS's keychain at least, so there is some level of security. And a standalone password manager has its own encryption.
  • mikehotel 2y ago
    This has been the case for a long time, and has not changed even in 2024. Please use a Primary Password if you are storing passwords in Firefox. https://support.mozilla.org/en-US/kb/where-are-my-logins-stored https://support.mozilla.org/en-US/kb/where-are-my-logins-sto...
  • sublimefire 2y ago
    Browser password managers and their related files are the usual targets of the sophisticated malware creators. Not many people use good master passwords either if any.
• deleted 2y ago
  [deleted]
• twilo 2y ago
  Is the Firefox one better than the one Edge has? I've been using that for a while and it seems quite good overall.
  • odo1242 2y ago
    It's not end-to-end encrypted (if you enable account sync), so Microsoft can technically see your passwords. Feel free to switch or not switch based on that information.
    • notpushkin 2y ago
      Firefox isn't end-to-end encrypted either anymore, IIRC.
      • morsch 2y ago
        They say it is: https://support.mozilla.org/en-US/kb/sync https://support.mozilla.org/en-US/kb/sync
        • notpushkin 2y ago
          I stand corrected! https://support.mozilla.org/en-US/kb/reset-your-firefox-account-password-recovery-keys#w_why-does-resetting-my-password-reset-my-data https://support.mozilla.org/en-US/kb/reset-your-firefox-acco... > Mozilla accounts uses your password to encrypt your data (such as bookmarks and passwords) for extra security. When you forget your password and have to reset it, this data could be erased. To prevent this from happening, generate your unique account recovery key before forgetting or resetting your password.
      • odo1242 2y ago
        It still is, as is all Firefox Account data
• throwuxiytayq 2y ago
  Does the FF password manager still irrecoverably nuke your password with no versioning/undo when you accidentally or intentionally use the „forget this website” option in the history panel?
• Ayesh 2y ago
  I used Firefox password manager for years, and moved to Bitwarden for: - Passkey syncing - Bitwarden on Android works properly, compared to Firefox's dedicated password app that's abandoned. - TOTP support (to use with some apps I don't want the strongest security) But you are maybe right, if the only browsers you use are Firefox desktop/mobile.
• ezst 2y ago
  What finally brought me to using BW was that I simultaneously needed to backup/sync my TOTPs across mobile/desktop devices, and came to have the need for sharing an increasing number of passwords with my SO. It delivered beautifully on all of that.
  • CaptainNegative 2y ago
    This isn't an area I know much about, but wouldn't there be a security risk involved with storing the TOTP seeds alongside the passwords? Or is that not a real concern?
    • 3np 2y ago
      It's a valid concern. Especially if you use the same BW for password and TOTP for the same service, you've effectively reduced 2 factors to 1. If you really must sync both your TOTP secrets and your passwords, those should be completely separate systems.
    • ezst 2y ago
      Totally correct, the lame excuse being that it didn't make the situation worse for the reason that those factors were anyway authenticated using the same device previously already. But at least I am now in much less trouble in case this device gets lost/broken/stolen/…
• SPBS 2y ago
  Built-in password managers don’t work across apps. They only work for the browsers they’re built into.
• conradev 2y ago
  It’s also the only browser that doesn’t support Passkeys yet :(
• frenkel 2y ago
  Does it support sharing passwords with family members?
  • Yodel0914 2y ago
    This (along with syncing on iOS) is what made me switch from `pass` to Bitwarden. Password sharing (and self-hosting sync with vaultwarden) are killer features for me.
• techwizrd 2y ago
  I'm glad that Bitwarden moved quickly to resolve this. At least for me, Firefox's password manager isn't really a replacement. Bitwarden is approved by my employer, self-hostable, and supports logins for the litany of apps across my browsers and mobile devices. Whether it's the mobile app, mobile website, or site in my browser, Bitwarden just works for the most part. It's also quite nice that Bitwarden can store arbitrary information like CCs, secure notes, and how I capitalized the answers to security questions and other account recovery/login information.
  • ValentineC 2y ago
    > It's also quite nice that Bitwarden can store arbitrary information like CCs, secure notes, and how I capitalized the answers to security questions and other account recovery/login information. +1. I use my password manager (currently 1Password, but I have been looking at self-hosting Bitwarden/Vaultwarden) more for storing credit card information and security questions. Most built-in password managers don't cut it on that front.
  • psd1 2y ago
    It's more than self-hostable! There's at least one API-compatible alternative (vaultwarden) which works with the official client. Yay to breaking down walls.
    • seabrookmx 2y ago
      Vaultwarden is great! I've been running it for years (since it was bitwarden-rs) on a free-tier GCP VM. I use a cronjob to back up the DB to Backblaze B2 with rclone.
  • trinsic2 2y ago
    Its Bitwarden only for personal use. Do they have a solution for Multi-use password sharing?
    • leshenka 2y ago
      in Vaultwarden you can have "organizations" that are like groups of people and you can have passwords there that are accessible by members No idea how this maps into Bitwarden's own offerings though but all clients support this kind of thing
• elric 2y ago
  I recommend Bitwarden family plans to non-technical people. It's pretty user friendly, and you can give people emergency access. A couple of recent deaths in my life have made me painfully aware that this is something that many people really need.
  • bloopernova 2y ago
    Gen X and boomer techies are getting older. It's kind of funny to see how gen x in particular deals with aging. For example, menopause memes as gen x women hit perimenopause. We're supposed to be all nonchalant and cynical, and it's interesting to see those attitudes hit the immovable object of aging.
• xnzakg 2y ago
  I actually switched from Firefox's password manager to Bitwarden. There used to be a bug on Android where the autofill button sometimes would stop doing anything.
• sph 2y ago
  > the built-in password manager in Firefox is too good Too good in what way that according to you "normal" people shouldn't be using Bitwarden? Or do you just like the Firefox one but are overselling it a bit too much? I use Firefox, but I do not trust the Mozilla products. Bitwarden costs me $10/year so I wonder what is so amazing and groundbreaking about Firefox password sync, and does it work across browsers?
• ahiknsr 2y ago
  > Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. I use both Bitwarden and Firefox and I would strongly encourage everyone to not use the password manager in Firefox. Do you know the tab sync across devices is broken in firefox? It was broken since Aug 24 and it is still not fixed https://bugzilla.mozilla.org/show_bug.cgi?id=1913795 https://bugzilla.mozilla.org/show_bug.cgi?id=1913795 . If they can't sync tabs across devices, i wouldn't trust them to sync my passwords.
  • digital_voodoo 2y ago
    Interestingly, password syncing is one of the most reliable things I've seen Firefox doing during the last years. If you don't even have to think about it, that means it "just works"
• Anunayj 2y ago
  Can someone also comment on how secure the built in password in manager in Firefox is to unsophisticated malware attacks that simply copy your browser extension data and such. Compared to bitwarden which requires a password to unlock it, and as I understand stores everything encrypted on disk.
  • slightwinder 2y ago
    If you don't use a master password, it's unsafe. And even with master password, I vaguely remember it's not that safe either, but that might be outdated info. This was going around the last days: https://github.com/Sohimaster/Firefox-Passwords-Decryptor https://github.com/Sohimaster/Firefox-Passwords-Decryptor
• vitro 2y ago
  > because the built-in password manager in Firefox is too good If only they could add labels to the name/password combination. I have several accounts stored for a website, with generated gibberish logins that I cannot change and sometimes it takes me multiple tries to get to the correct account. Also, sometimes a site has two password fields - two secret codes - and for this usecase the password manager doesn't work very well either and remembers only one field. Other than that, I love how it just works, you add a password on one device and have it seamlessly available on the other with a very little setup. It's a nice experience.
  • vitro 2y ago
    > have several accounts stored for a website Another usecase for named logins are those multiple routers that you administer for your friends and family that all have http://192.168.1.1 http://192.168.1.1
• Shorel 2y ago
  > Unfortunately, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. I don't doubt the quality of Firefox's password manager, or your honesty. But normal people just don't use Firefox.
  • blendergeek 2y ago
    Normal people don't use Bitwarden either. And I suppose I don't know any normal people which isn't too surprising. Normal people use Apple's built-in password manager.
• kwanbix 2y ago
  The problem with the Firefox (or Chrome) password managers is that they only work on their browsers. Bitwarden works on any browser, on windows, macos, linux, ios, android.
• wrasee 2y ago
  If Mozilla released a separate passwords app so you could manage and access your passwords outside of Firefox I think the two would be more comparable. That would promote your passwords as part of your Mozilla account, not just Firefox. Bitwarden excels here, and i think is the model to beat. However, Mozilla would have the advantage since their browser integration would essentially be built-in and first class. Otherwise, unless you use Firefox exclusively for everything I just don't think a single browser is the right place to manage passwords. I would say that's true even for a broad audience, given the importance of passwords and security in the modern age. Bitwarden is also nice in that you can "lock" access to your passwords while keeping the browser open. That way, for the 99% of the time you're just browsing the internet you essentially don't have access to all your passwords "open". The last time I looked at this I had to enter my master password on opening Firefox, even if I didn't need access to my passwords. That meant that "unlocking your vault" is essentially tied to opening the browser. That alone was enough for me to bail on it.
  • greensh 2y ago
    there used to be an android/ios app by mozilla called lockwise which did exactly that iirc. https://support.mozilla.org/en-US/kb/end-of-support-firefox-lockwise https://support.mozilla.org/en-US/kb/end-of-support-firefox-...
    • wrasee 2y ago
      Ah yes I remember that now, I had forgotten about that! Funny, especially now that I see Apple are now going the other way with a dedicated "Passwords" app on iOS 18 and macOS 15. And for Apple to do this - against their instinct for featureless simplicity and implicit integration - to give passwords their own "shop front" as a dedicated app I think really does acknowledge the first-class importance that passwords now have, even for a broad audience. It's a shame as I think Mozilla could really compete well in this space. They are both cross-platform, have their their own browser and have a good reputation on privacy. It's a killer combo. Bitwarden is evidence you can make it work and you don't need massive big-tech budgets to make a difference.
  • 2y ago
• t0bia_s 2y ago
  Syncthing android app is not developed anymore. Hopefully syncthing-fork will be. https://old.reddit.com/r/Syncthing/comments/1g7zpvm/syncthing_android_app_discontinued/ https://old.reddit.com/r/Syncthing/comments/1g7zpvm/syncthin...
• alerighi 2y ago
  I think that the Firefox password manager is good, however, relying on the browser is a terrible form of vendor lock-in. You need to use another browser (for any reason), you also need to switch password manager. Also, Firefox on Android is not great, and Bitwarden has a better integration. Finally, Bitwarden (the payed version) manager also passkeys and OTP codes, the Firefox password manager not.
  • klabb3 2y ago
    I use both, and I agree, even if I’m very happy with Firefox. There are lots of apps outside of browsers that need passwords. It’s very common these days. Besides, does it support passkeys? That’s getting increasingly common as well.
• slightwinder 2y ago
  > I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good I wouldn't say it's good, but it does its job, if you can live with the insecurity and limitations. It's very comfortable, which is the only reason I'm still using it over KeePass and Bitwarden. KeepPass has no reliable Browser-integration, and Bitwarden is hard to selfhost. Firefox Passwordmanager is just there, always works, syncs without hassle, usability at it's peak (for this job).
  • seabrookmx 2y ago
    Have you tried vaultwarden (formerly bitwarden-rs)? It's trivial to self host. I've been running it in a GCP free tier VM for years.
    • slightwinder 2y ago
      Yes, I know vaultwarden. And it's indeed simple to start the docker-container. But no every use case can be satisfied with docker.
      • seabrookmx 2y ago
        Unless you only have non-Linux hosts available, this use case can :)
• jasode 2y ago
  >, I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good. But a lot of "normal people" actually need a secrets manager which is larger in scope than just a "websites urls passwords manager". This means a password manager with extra metadata fields for users to add notes, associated email aliases, etc. E.g. if a website has an extra step of "Confirm your identity by answering this question : What was your childhood pet's name?", users want a place to save the answer ("BugsBunny") in the "notes" field of a password manager.) Another example would be the secret PIN unlock code for the spouse's phone. That's not a website url, it's just a "secret" that needs to be stored in an encrypted file. Firefox password manager is too bare-bones with the only 2 fields being "Username" & "Password". The better UI/UX for normal people is to have a unified app to store all their secrets instead of having some secrets in the Firefox password manager and other non-web-url secrets saved separately in yet another app.
  • cryptos 2y ago
    I completely agree with you! Almost everyone needs to store more than only usernames and passwords for websites. Think of PIN for credit cards and the like.
    • throwaway984393 2y ago
      [dead]
  • qwertyuiop_ 2y ago
    This ^ passwords just don’t live in Firefox when you are using apps that need passwords across platforms (mac ios windows) and apps. This is where Bitwarden shines.
    • jvdvegt 2y ago
      I don't know about iOS, but Firefox syncs my passwords between my Linux machine and Android phone just fine.
• ants_everywhere 2y ago
  Given that Mozilla just acquihired a bunch of Meta advertising execs, I think the prudent plan would be to cautiously diversify away from putting sole trust in Firefox.
• angra_mainyu 2y ago
  For me, the reason bitwarden is excellent is sharing account login data with my family (I have an org account w a few members) for next to no money / year. Also, I regularly hop between 3 machines + a personal phone and a work phone, and I love being able to have access to my logins + secure notes across all 5 devices. All for the cost of a coffee/month.
• deleted 2y ago
  [deleted]
• pmontra 2y ago
  What if you want to use a password where you don't have Firefox installed or from somebody's else computer? The same applies to the password manager any other browser. I carry with me my keepass db inside my phone and I can use it anywhere at any time.
• rnewme 2y ago
  I enjoy Ecrypted Fossil SCM instance (encryption over sqlite extension)
• Klaphark 2y ago
  All the browser password managers are not really secure enough and give a false sense of security.
• BrandoElFollito 2y ago
  > because the built-in password manager in Firefox is too good I just checked it and it looks really basic, right? No OTP, no multiple URLs, no special URL matching? Where is its "goodness" (I may have missed something entirely)
• SV_BubbleTime 2y ago
  > built-in password manager in Firefox is too good. lol, sorry but this is a ridiculously narrow opinion and wouldn’t even apply to my SO and me as a two person team. Hmm, maybe I want my passwords on my phone?