16 ms·

I have been using Bitwarden for some time now. It’s an open source password manager. There are apps for all major platforms and extensions to all major browsers

by spv 8y ago

I have been using Bitwarden for some time now. It’s an open source password manager. There are apps for all major platforms and extensions to all major browsers. Checkout https://bitwarden.com/ https://bitwarden.com/

ringshall 8y ago
To be precise, their base software is Free software, licensed under the AGPLv3. The also distribute non-Free (and non-Open Source, and non-gratis) software. Their base software has an artificial limit in terms of number of users and number of 'collections', which goes contrary to the ethics of Free software.
- mitchty 8y ago
  Boo, I was looking for something that had a cli and integrated with every browser as well as had an ios app. I've not looked again recently but lastpass is the only thing I've found that fits those bills.
  - xxkylexx 8y ago
    - https://github.com/bitwarden/browser https://github.com/bitwarden/browser - https://github.com/bitwarden/cli https://github.com/bitwarden/cli
    - mitchty 8y ago
      I saw all that but it looks like you've got to pay a monthly fee for full access for their cloud storage. Not sure its worth the hassle of migrating to in this case.
      - mitchty 8y ago
        Asked my buddy what he was using and he pointed me to this: https://www.enpass.io https://www.enpass.io Seems to fit the bill a bit better. And might mean $12/year less though thats not a huge problem.
        fapjacks 8y ago
        Maybe, but Bitwarden is open source, and Enpass is not. It's not important for people unless it is important for them, and in that case it's usually very important.
      - frio 8y ago
        It's $1/month to support open source software. That's not a bad price. You can also choose to use their hosting for free too; I was doing that for a few months before fully adopting it.
        mitchty 8y ago
        I already pay lastpass $12/year. Not sure its worth the hassle to convert all my login information.
- shadowmint 8y ago
  How can this be an issue if their base software is open source? Just recompile it with the numbers upped, surely?
  - ringshall 8y ago
    Gah, you're right. Their paid services and limits seem to be related to their SAS offerings.
  - daveFNbuck 8y ago
    Your passwords are stored on their server. You'd have to compile and run your own server, which is more expensive than the $1/month they're asking for.
    - codetrotter 8y ago
      > You'd have to compile and run your own server, which is more expensive than the $1/month they're asking for. For people like me that already rent a VPS for their mail and website the marginal cost is $0 except for the time it would take for me to perform the installation and setup. If the system is good and stable then the "cost" of the time that I would spend installing it on my server would be close to $0 when divided over the amount of time I use the software in the future.
      - woolvalley 8y ago
        I think another plus of buying their service is your supporting development of the software and saving yourself time, while a critical piece of your security software remains open source.
    - Xylakant 8y ago
      So you’re paying for the service they offer: a hosted version. You do so because it’s cheaper than hosting your own. There’s no conflict at all with any open source ethic.
      - 8y ago
- xxkylexx 8y ago
  This is not correct. All of Bitwarden source code is 100% open source. Even the few features that are paid. https://github.com/bitwarden https://github.com/bitwarden
- tajen 8y ago
  > which goes contrary to the ethics of Free software. No it doesn’t. Free software doesn’t have to be free: Even on the GPL page it’s written that it’s even ok to sell free software. It’s only unethical if you equate OSS to software communism, but that’s another topic. So anything that encourages the user to either use the freemium, then either dive into the code or either pay, is ethically correct. After all, you can download their AGPL, knock the limit, and redistribute. At which point you’ll be a contributor and while you’re at it, you’ll probably make a few other improvements: it means effectively free for contributors, which is awesome. See, it articulates quite well gratis, contributors and funding. It’s only designed to make enterprises pay, which is good because they can “donate” huge sums for good software, so it funds the open-source community quite well. And it retains the qualities of OSS: You know what you install, you’re not tied to the editor if he dies, and if they stop improving the software, a contributor can take over their code and become more famous. Win-win-win.
hannibalhorn 8y ago
Interesting in that you can host your own instance of their cloud server, but I really prefer something that uses standard cloud storage mechanisms (Dropbox, iCloud, etc.) for sync and works on top of that. Like others here, I'll probably be reevaluating my choice when it feels like it's time to upgrade. For me, some of the open source solutions are perfect as far as the underlying storage format and sync technology, but lack good browser extensions that already understand all the quirks of various sites. That's the kind of thing that a commercial product can tend to do a better job at.
- byproxy 8y ago
  It's simple enough to do with some version of KeePass. I'm currently using https://keeweb.info/ https://keeweb.info/ and Keepass2Android.
  - GordonS 8y ago
    I use the same. The only PITA is unlocking it with my, rather long, pass phrase. I just find it really fiddly on mobile.
    - Splines 8y ago
      You can get it to recognize fingerprints or a short version of your password if it's even been fully unlocked for the current phone session. It's a little fiddly and may not meet the level of security you're looking for, but it's an option.
      - GordonS 8y ago
        I knew about the short password, but hadn't seen the fingerprint option - that's just what I need to make it "secure enough" while being usable!
  - steve19 8y ago
    What do you use to fill browser login/passwords? There seem to be so many plugins for keepass
slig 8y ago
+1 for bitwarden. Recently I've become a subscriber because I love their service and I wanted to support them.
toyg 8y ago
I've been an early adopter and really they are coming in leaps and bounds. The only complaint I have is that integration with iOS apps is very very spotty, but I believe that's an issue with Apple muscling 3rd-parties away from that field (and to a certain degree, an issue with developers not following best practices in their apps).
DavideNL 8y ago
Looks awesome. The only drawback i see is it doesn't support iCloud. Personally i wouldn't want to store my passwords with the same company that creates the (encryption)software. And i definitely wouldn't self-host (why burden yourself with the management of data-backups/updates/etc. when iCloud is available for free...)

by spv 8y ago

ringshall 8y ago

To be precise, their base software is Free software, licensed under the AGPLv3. The also distribute non-Free (and non-Open Source, and non-gratis) software. Their base software has an artificial limit in terms of number of users and number of 'collections', which goes contrary to the ethics of Free software.

mitchty 8y ago
Boo, I was looking for something that had a cli and integrated with every browser as well as had an ios app. I've not looked again recently but lastpass is the only thing I've found that fits those bills.
- xxkylexx 8y ago
  - https://github.com/bitwarden/browser https://github.com/bitwarden/browser - https://github.com/bitwarden/cli https://github.com/bitwarden/cli
  - mitchty 8y ago
    I saw all that but it looks like you've got to pay a monthly fee for full access for their cloud storage. Not sure its worth the hassle of migrating to in this case.
    - mitchty 8y ago
      Asked my buddy what he was using and he pointed me to this: https://www.enpass.io https://www.enpass.io Seems to fit the bill a bit better. And might mean $12/year less though thats not a huge problem.
      - fapjacks 8y ago
        Maybe, but Bitwarden is open source, and Enpass is not. It's not important for people unless it is important for them, and in that case it's usually very important.
    - frio 8y ago
      It's $1/month to support open source software. That's not a bad price. You can also choose to use their hosting for free too; I was doing that for a few months before fully adopting it.
      - mitchty 8y ago
        I already pay lastpass $12/year. Not sure its worth the hassle to convert all my login information.
shadowmint 8y ago
How can this be an issue if their base software is open source? Just recompile it with the numbers upped, surely?
- ringshall 8y ago
  Gah, you're right. Their paid services and limits seem to be related to their SAS offerings.
- daveFNbuck 8y ago
  Your passwords are stored on their server. You'd have to compile and run your own server, which is more expensive than the $1/month they're asking for.
  - codetrotter 8y ago
    > You'd have to compile and run your own server, which is more expensive than the $1/month they're asking for. For people like me that already rent a VPS for their mail and website the marginal cost is $0 except for the time it would take for me to perform the installation and setup. If the system is good and stable then the "cost" of the time that I would spend installing it on my server would be close to $0 when divided over the amount of time I use the software in the future.
    - woolvalley 8y ago
      I think another plus of buying their service is your supporting development of the software and saving yourself time, while a critical piece of your security software remains open source.
  - Xylakant 8y ago
    So you’re paying for the service they offer: a hosted version. You do so because it’s cheaper than hosting your own. There’s no conflict at all with any open source ethic.
    - 8y ago
xxkylexx 8y ago
This is not correct. All of Bitwarden source code is 100% open source. Even the few features that are paid. https://github.com/bitwarden https://github.com/bitwarden
tajen 8y ago
> which goes contrary to the ethics of Free software. No it doesn’t. Free software doesn’t have to be free: Even on the GPL page it’s written that it’s even ok to sell free software. It’s only unethical if you equate OSS to software communism, but that’s another topic. So anything that encourages the user to either use the freemium, then either dive into the code or either pay, is ethically correct. After all, you can download their AGPL, knock the limit, and redistribute. At which point you’ll be a contributor and while you’re at it, you’ll probably make a few other improvements: it means effectively free for contributors, which is awesome. See, it articulates quite well gratis, contributors and funding. It’s only designed to make enterprises pay, which is good because they can “donate” huge sums for good software, so it funds the open-source community quite well. And it retains the qualities of OSS: You know what you install, you’re not tied to the editor if he dies, and if they stop improving the software, a contributor can take over their code and become more famous. Win-win-win.

hannibalhorn 8y ago

Interesting in that you can host your own instance of their cloud server, but I really prefer something that uses standard cloud storage mechanisms (Dropbox, iCloud, etc.) for sync and works on top of that. Like others here, I'll probably be reevaluating my choice when it feels like it's time to upgrade. For me, some of the open source solutions are perfect as far as the underlying storage format and sync technology, but lack good browser extensions that already understand all the quirks of various sites. That's the kind of thing that a commercial product can tend to do a better job at.

byproxy 8y ago
It's simple enough to do with some version of KeePass. I'm currently using https://keeweb.info/ https://keeweb.info/ and Keepass2Android.
- GordonS 8y ago
  I use the same. The only PITA is unlocking it with my, rather long, pass phrase. I just find it really fiddly on mobile.
  - Splines 8y ago
    You can get it to recognize fingerprints or a short version of your password if it's even been fully unlocked for the current phone session. It's a little fiddly and may not meet the level of security you're looking for, but it's an option.
    - GordonS 8y ago
      I knew about the short password, but hadn't seen the fingerprint option - that's just what I need to make it "secure enough" while being usable!
- steve19 8y ago
  What do you use to fill browser login/passwords? There seem to be so many plugins for keepass

slig 8y ago

+1 for bitwarden. Recently I've become a subscriber because I love their service and I wanted to support them.

toyg 8y ago

I've been an early adopter and really they are coming in leaps and bounds. The only complaint I have is that integration with iOS apps is very very spotty, but I believe that's an issue with Apple muscling 3rd-parties away from that field (and to a certain degree, an issue with developers not following best practices in their apps).

DavideNL 8y ago

Looks awesome. The only drawback i see is it doesn't support iCloud. Personally i wouldn't want to store my passwords with the same company that creates the (encryption)software. And i definitely wouldn't self-host (why burden yourself with the management of data-backups/updates/etc. when iCloud is available for free...)