I find this move concerning, and wish that the Founder had looked for a new CEO that shared his values rather than a Private Equity and Mergers Expert.
Furthermore, the change to the GRIT motto is worrying. Trust is useless without Transparency when it comes to code and security.
Is it that time when I say “oh shit!” and starts to look at alternatives? I’ve seen this scenario a hundred times already and I’m tired.
I don’t have the patience to switch to alternatives until they make a change that actually affects the usability of the tool.
This is absolutely a red flag though.
Just FYI, you can export your Bitwarden database to plain text and import that with KeePassXC
All the attachments, though… man this is going to be such a pain :/
It takes a full 3 minutes to try an alternative. Export, install new one, import. Install extensions where you need them and sync.
Same question here. What are the best alternatives?
KeePassXC is the best FOSS option, but you’ll need to figure out self hosting if you want to sync the database between devices.
As the database is encrypted in your device, you dont really need to self host. A keepass database in the Google cloud is not really problematic, although you should still choose a more private cloud provider.
Syncthing is probably a simple fix.
Assuming you have a degoogle’d phone. The syncthing-fork devs announced that they aren’t going to certify for Google Play when that’s made a requirement in a few months
Ugh, I forgot about this. Aren’t you still going to be able to install apps from third-party marketplaces? I thought the plan was just that the phone was going to hassle you and require multiple hoops.
Yes, that’s the plan
I think other apps will require ADB to install
fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck fuck
I use both KeePassXC and Syncthing for passwords. Works fine.
And you can use a keyfile separate from the database for even more security. If the database is backed up on Google Drive and the keyfile is saved on a USB or in a (non-Google) email somewhere for the rare times you add a new device, your passwords should be safe even from keyloggers or Google themselves.
make sure to use post-quantum encryption algs
Which algs would that be? ed25519 okay? Is that even an encryption alg? I’m not too hot with encryption.
I found the easiest way to sync is to use rclone. This way you can use any cloud provider like Google Drive or OneDrive or DropBox. First create the rclone remote for your cloud provider using
rclone config. Second step is to create a second remote using the encryption option (menu item 16), choosing an appropriate path<first remote>:<path to directory>. Upload your KeepassXC database to this encrypted remote usingrclone copy.On Android you can use the RoundSync app from F-droid to configure the the same remotes, then create a task to copy or sync from that encrypted remote and a trigger to run that task on a schedule. Overall, this one-time setup works really well for me. This is my backup in addition to using Bitwarden for several years. Bitwarden is not going to get my money any more.
I use Vaultwarden
But you still use the official BW client apps, correct?
Unless you forego usage of the clients and access Vaultwarden through the browser (removing accessibility and convenience especially on mobile), it is not an e2e replacement solution.
Are there any alternative FOSS clients/apps that work with Vaultwarden?
Edit: I see further down that the official client is open source, and would get forked in the event of any fuckery. So I’m sticking with Vaultwarden + Official client app approach for now.
I just use the webapp UI and don’t bother with the clients/extensions. Easy enough to just log in, copy/paste from there.
But yeah, the official client (and probably browser extension as well) would probably be forked if/when needed.
What about passkeys?
For now
Proton Pass.
I’m pretty sure that isn’t self hostable.
That’s true.
Coincidentally, I moved to self-hosting Vaultwarden last night, which is open source but compatible with Bitwarden. If you want a simple transition and are capable of hosting it yourself, that would be my recommendation.
I’ve been hosting it for a couple years now and question why it took me so long.
I use keepassxc. It does the job.
Alias vault seems the most feature complete and self hostable https://www.aliasvault.net/
Sigh. This will be a huge pita. I have probably over 100 things saved into bitwarden. Where’s a good foss alternative.
GabeN, please don’t die before me.
I’ve been pretty happy with Apple passwords
Why the fuck does everything that’s good turn to shit? This world sucks. This timeline sucks.
it’s all motivated by the accumulation of wealth = capitalism
Accumulation of power is a common motive regardless of political system. Money is just one way power gets expressed.
Not claiming our system is perfect by any means. But this thought, to me, always felt like kicking the can down the road.
That might qualify as an argument but the enshittification of everything hasn’t gained anyone power, only money. Cuba was curing cancer before we started more war crimes in order to prove socialism doesn’t work, while we’re financing fast food.
I think there’s a difference though, in that capitalism rewards this kind of innate motive, while socialism doesn’t, so I think it would be much easier to build a system based on that that’s not fucked from the foundations like capitalism is. The societal benefits of capitalism always feel like an accidental side effect at most, when it should be at a heart of any economy system.
Also it definitely seems that holding power over others warps the human mind, so I would definitely advocate for distributing policy-making power as evenly across the population as possible.
Kicking the can down the road implies you have a better solution?
A solution that stops evil people from being greedy for all of future society, gaming whatever our system is to hoard resources? No, I don’t.
Whether under capitalism or socialism, either system would need frequent attention and intervention by thoughtful, socially responsible people to watch for abusers of the system.
Right, but Capitalism incentivises this behaviour, thus making the checks and balances required both more robust and needing to be applied for regularly - while the powerful are capable of preventing this.
On the other hand, Socialism has incentives that are completely different - managing the abusers would be a much simpler task.
It’s not a timeline. It’s just the world we keep making. The only one.
VC ruins everything
This is literally a product where a hobbyist tried to fix a niche, and now the VCs arrive.
reading this as someone who migrated the rest of the household to Bitwarden literally yesterday: 😒
It took me years after the lastpass breach to get my wife and 1/3 of my kids to switch to Bitwarden. I am not looking to having to migrate again.
but exporting is easy with bitwarden. this is annoying. after the age check laws, i have been moving off big companies because it will be bad snd i know my migration will take a bit. i finalized bitwarden a couple weeks ago and was just about to assist my family.
i would not be as upset if ram and harddtives didnt cost a mortgage right now.
It does not matter how easy exporting is, the difficulty is going someone who really does not understand why they should be using a password locker to use one, much less change to a different one.
What do you use it for?
passwords and secure notes of recovery codes and the like
Luckily BW is open source, and VaultWarden exists. If they enshitify, all it takes is a fork of the browser extensions and apps with a rebrand.
Yeah, this here is exactly the reason why anytime I have to migrate from any piece of software I’m migrating to something open source and standards compliant.
How would network hosting work, though? Like… do I need to pull my passwords down now?
You can export from any of the BW clients. Then import into sepf-hosted BW or VW.
Short-term, yes. Maintaining the client integrations is a ton of work. If BW ever breaks selfhosted integrations, it’s gonna be a shitshow.
1Password took investor funding, moved to subscription and focusing on corporate.
Bitwarden heading the same way. Great…
This is troubling and I am going to accelerate my migration to Vaultwarden. I’m not going to leave Bitwarden yet but I saw how this played out with LastPass, and I was a happy LastPass customer until I wasn’t.
Docker and caddy make this pretty easy. Even easier if you have a static ip and go to porkbun for a domain.
And that’s only if you wanna access it outside your network. Mostly you can get away with syncing before you leave.
Or just use ZeroTier/Tailscale/NetBird/Wireguard and you can access your server from anywhere without exposing it to the imternet directly.
Yeah I know but I’d rather just expose the services I want.
And I’d rather not deal with extra, unnecessary security concerns.
Cool. You do you and I’ll do me.
I should get a cheap laptop and start self hosting…
Why does every good thing always have to go to shit. Sigh.
because capitalism
Nothing good ever lasts. Guess that’s entropy for you.
From the article
Update: After publication, an employee on the Bitwarden subreddit said that “Always free” had been restored on its pricing page, calling it an “oversight” by the marketing team. The product page for Bitwarden’s personal password manager remains unchanged.
Sounds someone was caught doing silly stuff… it will be interesting how this will develop in the future.
i guess unregulated capitalism is inherently entropic… since its utlimately a system that consumes itself until everything is gone and it dies and returns to background radiation.
It’s the investor obsession with forever growth. It ruins everything.
“You either die the hero, or you live long enough to become the villain”
hope this does not fuck up my vaultwarden hosting.
Narrator: …but it did.
I’m amazed that vaultwarden has maintained such fantastic compatibility with bitwarden. …but all it takes is one api with an obfuscated “signed request” to bring it all down.
No?
I get that clients might break, but the web portal running inside vaultwarden isn’t gonna suddenly stop working.
Vaultwarden itself is self-contained. An API change won’t do anything to it.
Then it creates the opportunity (need) for an open sourced client, if that ever happens, I’m confident the community will come together and make one using the currently known API calls.
The current (at least android) client for bitwarden is already open source (GPL 3).
I wasn’t certain what the bitwarden clients were licensed under.
…but if they’re all GPL, then yeah - it’ll just get forked. Just like terraform vs opentufu. Just like MySQL vs MariaDB - it’s a tale as old as time (unfortunately).
Vaultwarden has a backend encrypted db and web server, with it’s own API. The bitwarden clients are currently opensource so there could be a fork for the browser extension, and desktop client. Unlike 1Password, there is a good opensource base.
Same
Ah shit, here we go again…
If you’re looking for alternatives and you don’t care about automatic device syncing, I have been enjoying using keepassxc
If you have a cloud storage provider, and you save your keepass database to it, then you also get automatic syncing for all devices that can connect to that cloud.
Sure, i’ll put my password db somewere I have zero control over, just for convenience
You would’ve already been doing that with BitWarden.
Pretty sure I don’t. I don’t have bitwarden.
Just keepass. On two pc’s and backup to my nas.
Its like you have your own cloud storage provider.
One device on the lan … would not call that cloud.
It does a similar function though. Your devices are able to connect to it and sync a keepass db between the two. You have a solid solution IMO.
my nas.
Wow, talk about missing the point.
your nas is your cold storage provider
Isn’t the keepass db file encrypted?
Not everyone can self-host
I know. Keepass is a stand alone app. It does not need hosting.
You made me think about this a little bit, why couldn’t someone self host?
They don’t own the network, or don’t even have a network to connect to. I probably vastly underestimate the people who do not control their internet connection, or simply use devices that are on cell networks.
There are quite a few people that have a phone and/or tablet, and no WiFi. Not many who would care about this situation, but still
https://keepassxc.org/docs/KeePassXC_UserGuide#_storing_your_database
You can keep it on a USB too
You can sync between devices securely with syncthing.
That being said, the syncthing-fork devs are refusing to get certified with Google Play (which I support) so by the end of the year you’ll need a deGoogle’d phone
Keepassxc DB has strong encryption.
I’m the weirdo with the tin foil hat, but thats how I feel about ALL of these services. I don’t care how secure anyone says they are.
It’s incredibly inconvenient, but I have all my passwords saved as documents written in a cryptic and incomplete way so that only I know what they mean on my pc. It sucks that if I don’t remember one I have to wait until I get home, but I’ll never trust any of these services. EVERYTHING gets hacked eventually.
If you are happy with cloud services, please, go ahead. But not for me … True. I’m having close to zero trust however safe they say it is. My choice is to have my data on my hardware that i own and control and can access 24/7.
Ps: You can’t hack me, i carry around my stack of post-it’s on my skin and they have medic style hand written passwords /s
Nextcloud, syncthing, sftp can all be self hosted
You can selfhost your cloud storage, for instance using Nextcloud, if you want to maintain complete control
I do care about automatic device syncing
Run.
ProtonPass is run by a non-profit if you have to move to another hosted solution.
Otherwise there’s multiple self-hostable options, including plain file sync options.
Use this example as learning experience that the type of the firm you’re buying a service from is very important as it changes whose interests it puts first, second and last.
Non-profits do not always remain non-profits, and can become for-profit entities. Being a non-profit is not a reason to move to proton IMO, but Proton should be a decent temporary option if Bitwarden becomes aggressive to the open-source ecosystem.
My health insurer is a non-profit but they’re still a bag of money hungry dicks.
They took the VC money
They all do, eventually.
Id take it, too.
People need to understand that if they wait for everyone to do the right thing we are all going to be fucked.
Update: After publication, an employee on the Bitwarden subreddit said that “Always free” had been restored on its pricing page, calling it an “oversight” by the marketing team. The product page for Bitwarden’s personal password manager remains unchanged.
Oversight
We’re sorry we got caught
