Cool.
I just started using Bitwarden almost a year now. I don't know how I lived without it before? It's nice to know I wont have to switch to something else.
this post was submitted on 26 Oct 2024
160 points (97.1% liked)
Technology
58895 readers
3553 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
top 40 comments
sorted by:
hot
top
controversial
new
old
Why would anyone trust any company with their passwords??
Just use keepass and not bother with BS
Bitwarden can be fully self hosted, I'm doing it. My Bitwarden server doesn't (and can't) talk to them at all as it has no way to access the internet. They know nothing about my deployment except that I signed up for a free license key.
Because most people need a cloud solution for synchronization across devices. Unless you’re spinning up your own service like Nextcloud or similar for this, relying on a commercial cloud storage service for storing the file is just as dangerous (perhaps more so, as your attack surface is now across two third party services) as relying on someone like Bitwarden or Lastpass.
There's a big difference. You trust entities like bitwarden/lastpass/etc to properly encrypt the data, protect your master key, and trust their entire architecture behind the scenes.
When you encrypt the keepass DB that's all done by you locally with a open source client. No one knows your master key, and you get a simple encrypted file. You can hand that file to hackers if you want, will be useless without the key.
I put one of the copies of my keepass on onedrive, and syncs perfectly across all devices.
Companies can enshiffity at a moments notice.
I do not trust bitwarden to encrypt my data anymore than anyone trusts keypass to encrypt my data.
They're both open source and they both do the encryption locally; you're plainly mistaken.
Lol, imagine ridiculing users for trusting an FOSS company to handle their password management, and then storing your encrypted password DB in Microsoft's OneDrive 😆
I knew a comment like this was coming, but unless you can show how microsoft can decrypt my kdbx I stand fully by my current setup.
I don't think Microsoft can decrypt your DB file, neither do I think Bitwarden can. Encryption happens locally on their open source clients too.
But I'm not the one disparaging trusting an open source program to securely encrypt passwords, you are.
Are you a software developer ? Because you are way out of touch with what users want.
I used to use Keepass and sync thing and would consistently run into conflicts between my desktop and mobile entries. Maybe there's a better way to do it that I'm missing, but that was very annoying
First Winamp and now Bitwarden. The open source ecosystem is truly dead /s.
You didn’t read it then.
Wow, /s has really lost its meaning on the internet 😂
If you thnk they accidentally made a proprietary module, I have a bridge to sell you
If you don’t understand how easily this happens, you don’t understand how licenses work or the interplay involved in licensing packages, frameworks, and miscellaneous dependencies.
If that wasn't on purpose than that was a big fuckup. I was sometimes thinking about testing Bitwarden but with this volatile license situation I'm not interested anymore.
Something tells me you're the kind of person who sees a car turn the same direction as you twice and starts freaking out that you're being followed...
That's a poor understanding of the situation. Nothing in the licensing changed. The SDK has always been the proprietary business to business secrets management product. The client integrates with and can use that SDK to provide the paid service to businesses. The client and the server side management of password has always been and still is FOSS.
This was apparently an accidental change in the build code (not the client code, just the building scripts) that required the inclusion of the SDK to build the client when actually it has never and doesn't really need any of that code. It prevented building the client without accepting the SDK license. Which it shouldn't.
This was fixed and some things will be put in place so it doesn't happen again. Nothing in the licensing scheme changed, at all. This is not a catastrophic enshittification event. A Dev was just being lazy and forgot to check the dependencies on the build chain before their commit.
Thank you for bringing some sanity. I get that people experience capitalist enshittification on a regular basis, but sometimes people make honest mistakes.
Bullshit. Developers never make mistakes. N.E.V.R.
Okay, I actually laughed at that one! I guess us QA folks can just pack up and go home 😆
Thanks for the summary, it adds great clarity to seeing how it could happen
“I only read the headline and the comments from the threads a week ago, I am truly disappointed in Bitwarden’s stance against FOSS as I’ve misunderstood it.”
You can do what you like, but the change is sane, and they've now separated their Secrets Manager, which is their proprietary software for businesses, from their primary client, which is GPL.
IMO, the internet is doing that thing again where they invent villains.
If they tried once, there will be a second, but more subtle.
They didn’t try anything. Stop inventing. Go read an actual article on the subject instead of feeding the scarebait frenzy.
That's called "paranoia." You're inventing conspiracy theories.
tbh I don't think any of the 2 sides here could know that their opinion is the truth. we can't say that it's intentional, but can't either that it's just a honest mistake, so far everyone saying that just sounds to apply wishful thinking. let's see what happens in a few years, and then we may be able to judge future incidents better.
I wish it's just pananoia though I think that statement only in the skeptical realm, and I wish nothing substantial changed. I'm hosting vaultwarden currently for my family. To them the app on their phone is paramount. However, it is proven some will go that route, like Android. After all, a for -profit company goal is to make money.
There is a risk and a probability one need to evaluate. Nothing wrong to plan for an exit, but abandoning the software right now is simply overreaction.
As long as I can use it with a self-hosted server with features they expect, I'm don't think I will move away from it.
This is a much more level take than your first comment.
It is not always I want to write this long to explain what in my thoughts. The conclusion remains the same as my first comment.
I always maintain a healthy dose of skepticism on anything. Not that they would do it again and it is highly probable that's only a mistake but no one can tell except Bitwarden themselves. However, all the outsiders like us can only take their statement at face value and some skepticism will keeps eyes sharp.
If this were done by MS or Apple, who lack any shred of respect left, sure. If it were a material change on how the code works, certainly it would be most concerning. But what happened was blown entirely out of proportion for who Bitwarden has been and how they've acted in the past. They are still ethically very solid. And it was an immaterial change in the build tools, that could very well have been neglectful or accidental.
You are correct, but the way people reacted is certainly conditioning from the rug-pulling enshittification going on daily in the tech world. (What are we all using instead of redis, again?)