630
Concerns Raised Over Bitwarden Moving Further Away From Open-Source (www.phoronix.com)
submitted 2 years ago by to c/technology@lemmy.world
188 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 31 points 2 years ago (7 children)

Vaultwarden is a nice self hosted bitwarden alternative
https://github.com/dani-garcia/vaultwarden

Some prefer using KeepassXC and sync the database between devices
https://www.ctrl.blog/entry/keepass-vs-bitwarden-server.html

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 23 points 2 years ago (5 children)

    +1 For KeePassXC and the KeePass ecosystem. Yes, you need to sync the database yourself, but you can use any file sharing service you like, e.g. google drive, dropbox... or selfhost something like nextcloud (like I do), which for me is actually a point in its favor.

    Based on this news, I think I made the right choice back then when I decided to go with KeePass.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 7 points 2 years ago (4 children)

    As someone who used to use KeePass, went to LastPass, and then Bitwarden (Vaultwarden), I finally got my non-tech literate wife to use Bitwarden. I’m concerned that KeePass might end up being more difficult if it comes down to it. I believe that KeePass had some sort of browser integration but it really has been a long time since I used it so who knows the current state. Curious how browser integration is today.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 2 years ago* (2 children)

    The big issue isn't using it, it's syncing it.

    User A used KeePass to order pizza and changed the Papa John's(heaven forbid) password while they were at it, on their desktop.

    syncing: "oh! This file changed! Neat!"

    User B picks up their phone and wants to order Papa John's at work. They try, but the password isn't right. Huh. They check KeePass. No issues. They go to change the password because they think something is wrong.

    (All the while, they never thought to see if syncthing had been woken up in the background lately)

    They change the password, update KeePass,

    syncthing opens later, goes: "Oh, hi, User B's phone! I have a ne- Oh! You have a new password file too!!? Small world! I'll take both!

    Now there's two files, two users who think they both made corrections to a password, syncthing thinking nothing is wrong, and someone has to now merge the newer KeePass file over the old ones by hand and realize what happened, but the bigger problem is, no one knows anything is wrong yet and it doesn't even take two users. This can just be you ordering on your phone after modifying on your desktop.

    well, it's just pizza.

    As an example. Imagine an insurance app, or a banking app, or the DMV... And you won't know for months down the line. It gets old.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago

    Ah yeah, the fun of how that works. I recall that I had previously set up WebDAV to try to simplify my source of truth but I think that was just with the original KeePass app, not KeePassXC. I also wasn't trying to share passwords among multiple people but I do recall having issues when I was using Dropbox to sync to my phone since I would have to actually make sure Dropbox had updated the copy of the file which required me opening the app at the time.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 years ago

    I use KeePassXC on desktop and Keepass2Android on, well, android, and sync via nextcloud. They all seem to handle syncing correctly, merging changes made on one side, or showing a notification about a conflict, and KeePassXC can definitely merge the two "conflicted copies" together reliably with a couple of clicks (yes, a no-click solution would be better, I know, but it's not "manual"). Keepass2Android integrates directly with nextcloud and seems to handle it fine.

    The situation can definitely be improved but it's not so bad for me. Also, two different people should probably use two different database files and not share passwords ;)

    Not sure how syncthing handles conflicts, it's been many years since I tried it.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 2 years ago

    I use KeePassXC's browser integration daily and it works pretty well with Firefox (linux), well enough that I'm not complaining, but I cannot compare it with Bitwarden cause I never used it. On Android I use Keepass2Android and works well with autofill, but again, I can't really compare it.

    Something tells me Bitwarden works better, just by virtue of being a commercially supported product, but I have no complaints with KeePassXC & Keepass2Android (KeePassDX works well on android too). Original KeePass desktop client was never great though.

  • permalink
  • fedilink
  • source
  • parent