▲ 630 ▼ Concerns Raised Over Bitwarden Moving Further Away From Open-Source (www.phoronix.com) submitted 2 years ago by AsudoxDev@programming.dev to c/technology@lemmy.world 188 comments fedilink hide all child comments
[+] Boozilla@lemmy.world 61 points 2 years ago (10 children) [deleted] permalink fedilink source hideshow 10 child comments replies: [–] Humanius@lemmy.world 5 points 2 years ago* (last edited 2 years ago) (6 children) It shouldn't even be that complex... I might be mistaken, but ultimately a password manager is basically nothing more than a database of passwords in an encrypted zip file, right? That could entirely be self-hosted with off the shelf open source applications stringed together. All you'd need is a nice UI stringing it all together. Edit: I'm not sure why people are downvoting me. Is that not what a password manager essentially is? permalink fedilink source parent hideshow 6 child comments replies: [–] wintermute@discuss.tchncs.de 31 points 2 years ago Keepass is exactly that. Basically all the client side parts, and the database is a single encrypted file that you can sync however you want. permalink fedilink source parent [–] xthexder@l.sw0.com 11 points 2 years ago I've done basically this in the past by encrypting a text file with GPG. But a real password manager will integrate with your browser and helps prevent getting phished by verifying the domain before entering a password. It also syncs across all my devices, which my GPG file only worked well on my desktop. permalink fedilink source parent [–] LedgeDrop@lemm.ee 9 points 2 years ago It's the "stringing it all together" that could be problematic. If you have multiple clients (desktop/cellphone) modifying the same entry (or even different entries in the same "database" ). You need something smart enough to gracefully handle this or atleast tell you about it. I did the whole "syncing" KeePass and it was functional, but it also meant I needed to handle conflicts - which was annoying. I switched and really appreciate the whole "it just works" with self-hosted bitwarden. permalink fedilink source parent [–] AsudoxDev@programming.dev [S] 6 points 2 years ago That is the bare minimum of a password manager like Bitwarden. permalink fedilink source parent [–] HereIAm@lemmy.world 6 points 2 years ago I see it as it's easy to self host. But I'm not skilled nor rich enough to guarantee the availability of it. I don't want to be stuck on a holiday without my passwords because my server back home died from black out or what have you. I pay for bitwarden and the proton mail package to keep the password management market a bit more competitive and it actually works out cheaper. It would be nice to have protons anonymous emails built in, but I can live with it. But I might have to reconsider if Bitwarden is going a different direction that what I'm paying for. permalink fedilink source parent [+] Boozilla@lemmy.world 3 points 2 years ago [deleted] permalink fedilink source parent [–] Snowpix@lemmy.ca 2 points 2 years ago (2 children) permalink fedilink source parent hideshow 2 child comments replies: [+] Boozilla@lemmy.world 2 points 2 years ago (1 child) [deleted] permalink fedilink source parent hideshow 1 child comment replies: [–] Snowpix@lemmy.ca 2 points 2 years ago Yeah, I was worried about it too. I've become pretty cynical when it comes to everything becoming enshittified, but I'm hoping they stick to their word. permalink fedilink source parent
[–] Humanius@lemmy.world 5 points 2 years ago* (last edited 2 years ago) (6 children) It shouldn't even be that complex... I might be mistaken, but ultimately a password manager is basically nothing more than a database of passwords in an encrypted zip file, right? That could entirely be self-hosted with off the shelf open source applications stringed together. All you'd need is a nice UI stringing it all together. Edit: I'm not sure why people are downvoting me. Is that not what a password manager essentially is? permalink fedilink source parent hideshow 6 child comments replies: [–] wintermute@discuss.tchncs.de 31 points 2 years ago Keepass is exactly that. Basically all the client side parts, and the database is a single encrypted file that you can sync however you want. permalink fedilink source parent [–] xthexder@l.sw0.com 11 points 2 years ago I've done basically this in the past by encrypting a text file with GPG. But a real password manager will integrate with your browser and helps prevent getting phished by verifying the domain before entering a password. It also syncs across all my devices, which my GPG file only worked well on my desktop. permalink fedilink source parent [–] LedgeDrop@lemm.ee 9 points 2 years ago It's the "stringing it all together" that could be problematic. If you have multiple clients (desktop/cellphone) modifying the same entry (or even different entries in the same "database" ). You need something smart enough to gracefully handle this or atleast tell you about it. I did the whole "syncing" KeePass and it was functional, but it also meant I needed to handle conflicts - which was annoying. I switched and really appreciate the whole "it just works" with self-hosted bitwarden. permalink fedilink source parent [–] AsudoxDev@programming.dev [S] 6 points 2 years ago That is the bare minimum of a password manager like Bitwarden. permalink fedilink source parent [–] HereIAm@lemmy.world 6 points 2 years ago I see it as it's easy to self host. But I'm not skilled nor rich enough to guarantee the availability of it. I don't want to be stuck on a holiday without my passwords because my server back home died from black out or what have you. I pay for bitwarden and the proton mail package to keep the password management market a bit more competitive and it actually works out cheaper. It would be nice to have protons anonymous emails built in, but I can live with it. But I might have to reconsider if Bitwarden is going a different direction that what I'm paying for. permalink fedilink source parent [+] Boozilla@lemmy.world 3 points 2 years ago [deleted] permalink fedilink source parent
[–] wintermute@discuss.tchncs.de 31 points 2 years ago Keepass is exactly that. Basically all the client side parts, and the database is a single encrypted file that you can sync however you want. permalink fedilink source parent
[–] xthexder@l.sw0.com 11 points 2 years ago I've done basically this in the past by encrypting a text file with GPG. But a real password manager will integrate with your browser and helps prevent getting phished by verifying the domain before entering a password. It also syncs across all my devices, which my GPG file only worked well on my desktop. permalink fedilink source parent
[–] LedgeDrop@lemm.ee 9 points 2 years ago It's the "stringing it all together" that could be problematic. If you have multiple clients (desktop/cellphone) modifying the same entry (or even different entries in the same "database" ). You need something smart enough to gracefully handle this or atleast tell you about it. I did the whole "syncing" KeePass and it was functional, but it also meant I needed to handle conflicts - which was annoying. I switched and really appreciate the whole "it just works" with self-hosted bitwarden. permalink fedilink source parent
[–] AsudoxDev@programming.dev [S] 6 points 2 years ago That is the bare minimum of a password manager like Bitwarden. permalink fedilink source parent
[–] HereIAm@lemmy.world 6 points 2 years ago I see it as it's easy to self host. But I'm not skilled nor rich enough to guarantee the availability of it. I don't want to be stuck on a holiday without my passwords because my server back home died from black out or what have you. I pay for bitwarden and the proton mail package to keep the password management market a bit more competitive and it actually works out cheaper. It would be nice to have protons anonymous emails built in, but I can live with it. But I might have to reconsider if Bitwarden is going a different direction that what I'm paying for. permalink fedilink source parent
[–] Snowpix@lemmy.ca 2 points 2 years ago (2 children) permalink fedilink source parent hideshow 2 child comments replies: [+] Boozilla@lemmy.world 2 points 2 years ago (1 child) [deleted] permalink fedilink source parent hideshow 1 child comment replies: [–] Snowpix@lemmy.ca 2 points 2 years ago Yeah, I was worried about it too. I've become pretty cynical when it comes to everything becoming enshittified, but I'm hoping they stick to their word. permalink fedilink source parent
[+] Boozilla@lemmy.world 2 points 2 years ago (1 child) [deleted] permalink fedilink source parent hideshow 1 child comment replies: [–] Snowpix@lemmy.ca 2 points 2 years ago Yeah, I was worried about it too. I've become pretty cynical when it comes to everything becoming enshittified, but I'm hoping they stick to their word. permalink fedilink source parent
[–] Snowpix@lemmy.ca 2 points 2 years ago Yeah, I was worried about it too. I've become pretty cynical when it comes to everything becoming enshittified, but I'm hoping they stick to their word. permalink fedilink source parent