4 ms·
I Do Not Recommend Bitwarden
- lambdadelirium 6mo agoFull of skill issues
- princevegeta89 6mo agoWell, I know Bitwarden is pretty demanding and also not so straightforward to do self-hosting. But we have Vaultwarden which is ridiculously easy to deploy and also very lightweight while being immensely popular; has never had any major security incidents so far - and it has thousands of eyes on it for every single commit. I've been hosting this for three years now and I have never had a single problem with it. always worked with my Bitwarden clients on all of my devices. So if you would like to, try Vaultwarden.
- muppetman 6mo agoYou could have just posted "I didn't read the article" instead of this comment. It specifically addresses vaultwarden quite a number of times.
- prism56 6mo agoNot the original commenter. Just thought I would comment here. I'd be super interested in reading more information in why Bitwarden Lite is inadequate vs vaultwarden.
- kotaKat 6mo agoAhahahah, I am enjoying the little turn-off-your-Javascript warning that comes back when you click on a link in a new tab from the page to something linked in the article. My tab's title: "Ask HN: How could I safely contact drug cartels?"
- muppetman 6mo agoI just saw a tab with a Google search for "Zuckerberg nudes" lololol
- jbm 6mo agoFor those who were immediately curious; https://news.ycombinator.com/item?id=36731320 https://news.ycombinator.com/item?id=36731320 Spoiler: That whole thread is probably an excellent troll ("I might make this a startup"), except a ton of mid(dle brow) people had to ruin it.
- pretzellogician 6mo agoI'm a free Bitwarden user, I don't plan to self-host stuff, and... honestly I have no idea what this person is going on about. And "Aside from the aforementioned technical details, Bitwarden is (and has always been) one of the subjectively worst applications on my phones and my desktop in terms of user interface. " Really!!? How many apps has this person used?
- muppetman 6mo agoI love Bitwarden and use it every day, but I pretty much also agree with his post. I have Bitwarden for personal stuff and 1password for my, and the 1password experience is night and day better. It's just so good, it always works. Bitwarden sometimes (especially on Android) will just not autofill. On my PC sometimes it won't recognise the domain correctly even though I've got an entry set for "base domain" etc. I am ALWAYS fighting with it to get my passwords out. Look at the Bitwarden Reddit its full of similar complaints. Of course the price between 1pass and Bitwarden reflects why 1pass is so much better. And you don't really realise how clunky BitWarden is if it's all you use, until you also have to use some other password manager.
- chrisandchris 6mo agoAnd I could tell you the opposite about 1Password. About half of the time, the extension does not realize ond which domain it is and autofill is broken. To each their own (bugs).
- muppetman 6mo agoFair point - I've had no issue with it but I certainly don't use it as much as I do Bitwarden.
- Rekindle8090 6mo ago[dead]
- djyde 6mo agoThe Bitwarden Chrome extension is really bad, which is also the reason I've never been able to switch from 1Password to Bitwarden.
- sph 6mo agoComplaining about rent-seeking for $20/year? OK mate.
- muppetman 6mo agoI don't see this claim being made anywhere? They say it's usually the time the rent seeking begins, not that it's begun.
- deleted 6mo ago[deleted]
- prism56 6mo agoI don't self host Bitwarden so 90% of this doesn't really apply. I did however want to comment on the tab changing it's favicon and title everytime you change to another tab. Quite a cool "advertising" method for what javascript can do.
- muppetman 6mo agoYea that threw me too. Very clever.
- jrm4 6mo agoProbably my biggest tech hill-i'll-die-on is: Password management involving a 3rd party is dumb and should never ever have been a thing. Before two parties had the secret (or something related to it) and now three parties have it and that's objectively worse -- even taking into account "the lazy user" or whatever. I know we're past that in a lot of places for a lot of people, but nope, my dad and his printed out sheet of password next to his desk is still beating every company out there.
- baal80spam 6mo agoKeePass is a great middle-ground, which I've been using for the last decade (at least). Storing the vault is on you, it just makes it easy to keep stuff organised.
- muppetman 6mo agoI did this for years too until mobile devices became popular. I have ~4 mobile phones for various things (yes this isn't normal) and ~4 different computers/laptops I use. Trying to keep a Keypass in sync between them is a nightmare. A proper password manager (Bitwarden or other) removes all that hassle. I have fingerprint unlock on the the mobiles that support fingerprint, face unlock on the devices that support that etc. I have browser addons to make password entry quick and easy while remaining secure. Once I moved to a password manager I realised how clunky and poor dragging a Keypass vault around was.
- baal80spam 6mo agoFair enough. I don't use it on mobile (I try to do the fewest things possible on mobile so I manage without a password manager).
- mbirth 6mo agoThis! I’m using Strongbox on macOS and iOS and it’s just sooo good. It integrates with Apple’s AutoFill API and feels native - just like Apple’s Passwords app. But all the entries are in a KeePass database which I can sync via SyncThing, iCloud, Dropbox, whatever. And if the application should fail, I can use any other KeePass-compatible app or KeePass itself to get to my secrets.
- cjs_ac 6mo agoI use pass[0], and it works well for me. It's secured by PGP and passwords are shared between devices using git. [0] https://www.passwordstore.org/ https://www.passwordstore.org/
- SupLockDef 6mo agoIt's the first time I see someone else with the same setup. Each time I read about the monstrosity of an external company owning all my passwords, taking into account all the leaks and supply chain attacks these days... I feel good "self hosting" what could be the most sensitive information that I have.
- glub103011 6mo ago[dead]
- username135 6mo agoive been rather fond of keepass for the last however many years or decades now. Its all a blur.
- deleted 6mo ago[deleted]
- SamDc73 6mo agoBitwarden have in my opinion is one of the BEST business models a user can ask for. It's open-source, and I can self-host (100% free) and the free version is really, really good too, and then a premium version is $20/year which is very reasonably priced. Also for cloud hosted password manager, you're always going to have attacks no matter what, but at least they are transparent about it .. (unlike say LastPass, Norton LifeLock, Keeper and possibly others). For self-hosting it might be better security, solely because no one cares to attack it, but it's not going to be more secure form engineering best practices POV (but again I might be wrong .. I'm not a security engineer of any kind)
- Flockster 6mo agoAs a now almost 15 year long user (crazy to think about) of 1password I am unsure what attacks do you mean? Did passwords get lost and it was not disclosed or what did you mean by the lack of transparency?
- SamDc73 6mo agoThat is my bad; I was thinking of LastPass[1] where it took them months to fully disclose and explain a very serious breach of data. 1Password seem to have a good transparency track record (I edited the original comment) [1] https://news.ycombinator.com/item?id=34097142 https://news.ycombinator.com/item?id=34097142
- lyu07282 6mo agoI also don't really expect the self-hosted version to be a small self-contained go binary or something, they have millions of users their tech stack is going to be more complicated necessarily. But then vaultwarden exists too and is well maintained but is then somehow also inadequate. Who could possibly live up these unreasonable standards?
- gdmka 5mo ago>And the free version is really, really good too, and then a premium version is $20/year which is very reasonably priced. I've been paying a flat $10 since 2022. Today, I got an email saying my renewal price goes up to $20 plus tax, which totals $25. The loyal member 25% discount just eliminates the tax for me. Given that all I've used it for is password and login storage and TOTP all these years, I don't find a 200% price increase to be reasonable. I've cancelled the premium, I can run my TOTP somewhere else.
- subhobroto 6mo agoVaultwarden is a very lean implementation of Bitwarden but if you want to look into an alternative to the Bitwarden ecosystem, I recommend - AliasVault https://github.com/aliasvault/aliasvault https://github.com/aliasvault/aliasvault - check it out!
- SV_BubbleTime 6mo agoI agree that there are some goofy UX things. I don’t care about self-hosting. And the author goes to great care to write about every issue; then admits all software has issues and Bitwarden has fixed their issues as they come up. Overall their actionable advice that different types of credentials might need different software is good. The rest seems like ax grinding.
- AntonyGarand 6mo agoAs a tangent, this site will overwrite its <title> and favicon if your browser changes tab to one of many random options, as well as showing an overlay highlighting the risk of keeping javascript enabled for once you're back. I dug around and found them listed within the `kill.js` file[0]. It uses the visibilitychange[1] API and swaps it to one of the following: Official Church of Scientology: Difficulties on the Job - Online Course Ask HN: How could I safely contact drug cartels? The internet used to be fun am I boring - Google Search what is punycode - Google Search arguments for HN comment - Google Search how to hack coworker's phone - Google Search censorship on hacker news - Google Search rust programming socks - Google Shopping Adult entertainment clubs - Google Maps Pick up lines suggestions - ChatGPT Online debate argument suggestions - ChatGPT The Flat Earth Society Amazon.com: taylor swift merch Amazon.com: waifu pillow /adv/ - topple government - Advice - 4chan r/wallstreetbets on Reddit Infowars: There's a War on For Your Mind! birds aren't real at DuckDuckGo Lincoln MT Cabins For Sale - Zillow The Anarchist Cookbook by William Powell | Goodreads Fifty Shades of Grey | Netflix jeff bezos nudes - Google Image Search zuckerberg nudes - Google Image Search bigfoot nudes - Google Image Search Rick Astley - Never Gonna Give You Up - YouTube Pennsylvania Bigfoot Conference - Channel 5 - YouTube Linus goes into a real girl's bedroom - Linus Tech Tips - YouTube MrBeast en Español - YouTube FTX Cryptocurrency Exchange [0] https://xn--gckvb8fzb.com/js/kill.js https://xn--gckvb8fzb.com/js/kill.js [1] https://developer.mozilla.org/en-US/docs/Web/API/Document/visibilitychange_event https://developer.mozilla.org/en-US/docs/Web/API/Document/vi...
- rpastuszak 6mo agoI giggled but it’s dangerous as a prank (say if you were on that site during a break, then shared a screenshot of a design from your browser)
- deleted 6mo ago[deleted]
- throwuxiytayq 6mo agoThis is absolutely hilarious, and I am totally using this trick when I get to making my own porn video hosting platform (which I won't).
- sshine 6mo agoI switched to self-hosted Vaultwarden a couple of years ago because of all the bad choices of Mozilla (I was using Firefox Sync and wanted something else badly). Sadly, Bitwarden's browser clients are antiquated (they don't auto-generate and save passwords as I sign up, I kind of have to create them manually ahead of time, and if anything botches in the signup, e.g. a server-side password validation rule), I now have a password that won't work, I have to find the entry in the database and update it to something else... geez, if it would just automatically overwrite the password every time I submit with a new one. Vaultwarden's great, but the inferior browser clients just don't make up for it. I'm back on Firefox Sync until I find something that's technically sufficient.
- deleted 6mo ago[deleted]
- gmuslera 6mo agoThere are not obvious solutions for all use cases, because some of those use cases implies sharing with others under different conditions (because they are role passwords, device/software passwords and other ways to be unique even if multiple people can use and update them), while others are personal (and may or not be used from different devices). Using the same password repository for all, specially if it depends on a single player the access of the repository or the client application could be risky. Having an open format for the database, if self hosted/replicated is something good to have I agree with the suggestion of using keepass/keepassxc/etc for personal passwords and other solutions for sharing with different partners. It was a good experience in general to use pass (or some alternative UI, like gopass) to use gpg+git to securely share passwords in an environment where that was possible. But sometimes you have to adapt to what already is being used or is accepted by the other players, and not always that is the safest in your opinion, in those cases limit your exposition.
- xtiansimon 6mo agoNothing seems to draw out the ire more than pet peeves with your password manager. I still vividly recall the issue that made me leave 1Password in a huff to start using Bitwarden. I don’t self-host, and I’m satisfied with the UX—it just does what it needs to. One thing I’m not a fan of—-new features. Or the drive to add new features, without extraordinary care. I much rather use slow and boring for my password manager than deal with _woops, I did it again_ development.
- e40 6mo agoI have used 1pw since fleeing lastpass many years ago. It seems to be just what you want, functional and boring. I never had issues with the version 7 to 8 upgrade, that pissed off so many people.
- prima-facie 6mo agoYou should keep regular backups of your BW vault as a plain JSON file. KeepassXC can now import BW vaults natively (passkeys included). If anything were to happen to Bitwarden you can migrate to KeepassXC as a stop-gap measure.
- DoctorOW 6mo agoThis is such a HN blog post it's almost funny. You wanted to selfhost and you can but it wasn't easy or particularly Linux friendly, so you got a Rust server from the community, but you wanted something officially supported, so they made a specifically lightweight self-hostable version but it's in a programming language you don't like. :( Those bastards!
- pjjpo 6mo ago[dead]