4 ms·

Nice to see Bitwarden make a course correction here. I wasn't looking forward to switching to another password manager, so I'm quite happy.

ryukafalz 2y ago
Yeah, likewise. I'm a Bitwarden subscriber but I'd been looking into alternatives recently because of the licensing kerfuffle. But switching password managers is a pain, so I'm glad to not feel like I have to now.
- creesch 2y ago
  Are there other alternatives that are 1) open source 2) offer the same integration to begin with and finally 3) have been audited or are popular enough to be under constant scrutiny? There is of course the KeePass ecosystem, but that is why I included my second point, as with KeePass you are responsible for vault syncing, having clients for all platforms, etc. I suppose that it is good to be aware of other options. At the same time, jumping ship so easily also doesn't seem realistic or ideal behavior to me.
  - Glazui 2y ago
    I‘ve recently learned about PassBolt, but it doesn’t meet criteria 3 I’m afraid
  - KPGv2 2y ago
    The audited part is going to be tough to meet because it's a very niche skill people generally won't do constantly for free.
  - zie 2y ago
    I have no affiliation, just found them this week, but https://psono.com/ https://psono.com/ exists. So 1 and 2 are met and 3 is half-way there maybe? It's a self-audit but they have been around a while. Apache2 licensed. Again, I literally found them the other day, and other than a cursory check to make sure the UI/UX is friendly enough to compete with BW or 1P, I haven't had a chance to look through their code at all yet. I have no idea if the promises they document are met.
    - chickahoona 2y ago
      Hi, Sascha here, the main developer behind Psono. Psono has been audited multiple times so far, usually on a yearly bases. The last one here https://psono.com/blog/security-audit-2024 https://psono.com/blog/security-audit-2024 (you will also find a link to the audit itself)
      - zie 2y ago
        Thanks! I missed that!
  - g19fanatic 2y ago
    i use the keepass ecosystem with app.keeweb.info. Its an open source webclient that can directly pull from your google drive (and other places!). I use a google drive through keeweb for syncing, 2 clicks and its syncd. Auto pulls when past pw. keepass works in browser (how I use it on a computer), can work offline (which is good in air-gapped instances, one of my reqs) and works directly on my android phone without issue.
    - creesch 2y ago
      It is actually sort of how I used it as well, though through nextcloud. It did still remain a hassle. It also requires all different apps to be maintained and equally safe. Keeweb for example has not had an active maintainer since 2022 https://github.com/keeweb/keeweb/issues/2022 https://github.com/keeweb/keeweb/issues/2022
  - WD-42 2y ago
    https://www.passwordstore.org/ https://www.passwordstore.org/
  - hedora 2y ago
    I decided that vaultwarden should not have an internet accessible port. Are there any that meet those requirements and also let you (reliably!) edit/create passwords when offline? Also, sometimes the bitwarden client decides to blow away my local copy of the password database. I'd like it to store it pesistently on all machines so I have to lose my phone, my laptop, my vaultwarden server and its two backups before I get locked out of everything. Currently, the phone + laptop don't count as backup copies.
    - BrandoElFollito 2y ago
      > I decided that vaultwarden should not have an internet accessible port So how does your browser extension work when outside your LAN? via Tailscale or similar VPN mesh? And for people who use it outside of the LAN entirely?
      - hedora 2y ago
        The app (and iOS keyboard integration) degrades to read only mode. It works about 95% of the time. I'd rather it work 100% of the time, and be read-write. I don't run the browser extension. (There have been too many other password managers with exploitable password bugs.)
- sirdvd 2y ago
  Switching is decisively a pain. But apparently this episode was what I needed to start looking seriously into VaultWarden.
  - horsawlarway 2y ago
    Huge VaultWarden fan here. It's been running absolutely unattended for about 3 years from a machine in my basement now, and it's great. I back things up fairly often, but otherwise I would have no idea I'm not just using the enterprise grade Bitwarden license. Things just work, features are there. Side-note - VaultWarden is incredibly reliable for a self-hosted free solution (I have 1 pod restart 27 days ago due to a power outage, but otherwise it basically does not fall over. No memory leaks, no high cpu consumption, no reliability problems)
    - idonttalkenough 2y ago
      Tacking onto this comment as another thumbs up for vaultwarden. "incredibly reliable" is exactly the way to describe it, in the world of tech headaches the password manager is the last thing you want to be worrying about and I can say with confidence that vaultwarden is a reliable well-oiled machine. Backups are also fairly easy so if need be a DR can be done (and automated) with very little hassle. The vaultwarden backend does depend upon the bitwarden apps for client devices but also features it's own web UI.
      - cmeacham98 2y ago
        Your comment was marked dead FYI, I vouched for it. Normally this would mean you are shadow banned, but I don't see any other comments in your history getting this treatment - perhaps this comment caught the ire of some anti-spam algorithm.
        xelamonster 2y ago
        I mean it reads like ad copy, and the entire first paragraph takes so many words to say nothing more than "I agree." As comments go, I have to say I've seen better.
- spl757 2y ago
  KeePassXC (and I assume the other versions) can import an encrypted JSON Password Protected (NOT Account Restricted) export from Bitwarden. I use them both. I have KeePassXC for my local machine, and Bitwarden for things I may need out and about. With the browser plugins for both it's not that hard to manage them both, at least in my opinion. I was hoping to see some course correction on this from Bitwarden, even if the over-stated impact was really just to the SDK. They appear to understand the look of their licensing move was going to cost them more than it probably should have. Most companies refuse to change course at all, so I at least see it as encouraging. edit to fix a typo
  - EasyMark 2y ago
    There is little chance I’ll ever move to keepassxc as that requires me to maintain it myself and take the chance on deleting something very precious. I’ll stick with the cloud solutions for now.
    - alwayslikethis 2y ago
      Synchronizing is not too difficult. You can use syncthing or any cloud-based storage solutions you are already using. You can also back stuff up. Given it has a recycle bin I wouldn't think accidentally deleting stuff is any more likely than a cloud solution. It's probably harder to back up a cloud solution as you don't have direct access to the file.
      - xigoi 2y ago
        How does Syncthing handle concurrent writes?
  - SirGiggles 2y ago
    A caveat that bears mentioning is that an export of a Bitwarden vault does not contain attachments.
- slenk 2y ago
  I found psono and spun up a self-hosted instance. I may just try to keep them in sync for a while while this business fully settles

ryukafalz 2y ago

Yeah, likewise. I'm a Bitwarden subscriber but I'd been looking into alternatives recently because of the licensing kerfuffle. But switching password managers is a pain, so I'm glad to not feel like I have to now.

creesch 2y ago
Are there other alternatives that are 1) open source 2) offer the same integration to begin with and finally 3) have been audited or are popular enough to be under constant scrutiny? There is of course the KeePass ecosystem, but that is why I included my second point, as with KeePass you are responsible for vault syncing, having clients for all platforms, etc. I suppose that it is good to be aware of other options. At the same time, jumping ship so easily also doesn't seem realistic or ideal behavior to me.
- Glazui 2y ago
  I‘ve recently learned about PassBolt, but it doesn’t meet criteria 3 I’m afraid
- KPGv2 2y ago
  The audited part is going to be tough to meet because it's a very niche skill people generally won't do constantly for free.
- zie 2y ago
  I have no affiliation, just found them this week, but https://psono.com/ https://psono.com/ exists. So 1 and 2 are met and 3 is half-way there maybe? It's a self-audit but they have been around a while. Apache2 licensed. Again, I literally found them the other day, and other than a cursory check to make sure the UI/UX is friendly enough to compete with BW or 1P, I haven't had a chance to look through their code at all yet. I have no idea if the promises they document are met.
  - chickahoona 2y ago
    Hi, Sascha here, the main developer behind Psono. Psono has been audited multiple times so far, usually on a yearly bases. The last one here https://psono.com/blog/security-audit-2024 https://psono.com/blog/security-audit-2024 (you will also find a link to the audit itself)
    - zie 2y ago
      Thanks! I missed that!
- g19fanatic 2y ago
  i use the keepass ecosystem with app.keeweb.info. Its an open source webclient that can directly pull from your google drive (and other places!). I use a google drive through keeweb for syncing, 2 clicks and its syncd. Auto pulls when past pw. keepass works in browser (how I use it on a computer), can work offline (which is good in air-gapped instances, one of my reqs) and works directly on my android phone without issue.
  - creesch 2y ago
    It is actually sort of how I used it as well, though through nextcloud. It did still remain a hassle. It also requires all different apps to be maintained and equally safe. Keeweb for example has not had an active maintainer since 2022 https://github.com/keeweb/keeweb/issues/2022 https://github.com/keeweb/keeweb/issues/2022
- WD-42 2y ago
  https://www.passwordstore.org/ https://www.passwordstore.org/
- hedora 2y ago
  I decided that vaultwarden should not have an internet accessible port. Are there any that meet those requirements and also let you (reliably!) edit/create passwords when offline? Also, sometimes the bitwarden client decides to blow away my local copy of the password database. I'd like it to store it pesistently on all machines so I have to lose my phone, my laptop, my vaultwarden server and its two backups before I get locked out of everything. Currently, the phone + laptop don't count as backup copies.
  - BrandoElFollito 2y ago
    > I decided that vaultwarden should not have an internet accessible port So how does your browser extension work when outside your LAN? via Tailscale or similar VPN mesh? And for people who use it outside of the LAN entirely?
    - hedora 2y ago
      The app (and iOS keyboard integration) degrades to read only mode. It works about 95% of the time. I'd rather it work 100% of the time, and be read-write. I don't run the browser extension. (There have been too many other password managers with exploitable password bugs.)
sirdvd 2y ago
Switching is decisively a pain. But apparently this episode was what I needed to start looking seriously into VaultWarden.
- horsawlarway 2y ago
  Huge VaultWarden fan here. It's been running absolutely unattended for about 3 years from a machine in my basement now, and it's great. I back things up fairly often, but otherwise I would have no idea I'm not just using the enterprise grade Bitwarden license. Things just work, features are there. Side-note - VaultWarden is incredibly reliable for a self-hosted free solution (I have 1 pod restart 27 days ago due to a power outage, but otherwise it basically does not fall over. No memory leaks, no high cpu consumption, no reliability problems)
  - idonttalkenough 2y ago
    Tacking onto this comment as another thumbs up for vaultwarden. "incredibly reliable" is exactly the way to describe it, in the world of tech headaches the password manager is the last thing you want to be worrying about and I can say with confidence that vaultwarden is a reliable well-oiled machine. Backups are also fairly easy so if need be a DR can be done (and automated) with very little hassle. The vaultwarden backend does depend upon the bitwarden apps for client devices but also features it's own web UI.
    - cmeacham98 2y ago
      Your comment was marked dead FYI, I vouched for it. Normally this would mean you are shadow banned, but I don't see any other comments in your history getting this treatment - perhaps this comment caught the ire of some anti-spam algorithm.
      - xelamonster 2y ago
        I mean it reads like ad copy, and the entire first paragraph takes so many words to say nothing more than "I agree." As comments go, I have to say I've seen better.
spl757 2y ago
KeePassXC (and I assume the other versions) can import an encrypted JSON Password Protected (NOT Account Restricted) export from Bitwarden. I use them both. I have KeePassXC for my local machine, and Bitwarden for things I may need out and about. With the browser plugins for both it's not that hard to manage them both, at least in my opinion. I was hoping to see some course correction on this from Bitwarden, even if the over-stated impact was really just to the SDK. They appear to understand the look of their licensing move was going to cost them more than it probably should have. Most companies refuse to change course at all, so I at least see it as encouraging. edit to fix a typo
- EasyMark 2y ago
  There is little chance I’ll ever move to keepassxc as that requires me to maintain it myself and take the chance on deleting something very precious. I’ll stick with the cloud solutions for now.
  - alwayslikethis 2y ago
    Synchronizing is not too difficult. You can use syncthing or any cloud-based storage solutions you are already using. You can also back stuff up. Given it has a recycle bin I wouldn't think accidentally deleting stuff is any more likely than a cloud solution. It's probably harder to back up a cloud solution as you don't have direct access to the file.
    - xigoi 2y ago
      How does Syncthing handle concurrent writes?
- SirGiggles 2y ago
  A caveat that bears mentioning is that an export of a Bitwarden vault does not contain attachments.
slenk 2y ago
I found psono and spun up a self-hosted instance. I may just try to keep them in sync for a while while this business fully settles