334
Bitwarden Makes Change To Address Recent Open-Source Concerns (www.phoronix.com)
submitted 2 years ago by to c/technology@lemmy.world
76 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 42 points 2 years ago (13 children)

Lol, imagine ridiculing users for trusting an FOSS company to handle their password management, and then storing your encrypted password DB in Microsoft's OneDrive 😆

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 13 child comments
    •
  • [+] -21 points 2 years ago* (last edited 1 year ago) (11 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 37 points 2 years ago

    I don't think Microsoft can decrypt your DB file, neither do I think Bitwarden can. Encryption happens locally on their open source clients too.

    But I'm not the one disparaging trusting an open source program to securely encrypt passwords, you are.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 14 points 2 years ago (9 children)

    Could you please show how bitwarden can decrypt a vault that's locally encrypted by a foss client?

    "Imagine trusting any company with your passwords"

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [+] -8 points 2 years ago* (8 children)

    They created the client. In theory, they can have some backdoors. And since you store your files on their side, risk is greater, imo

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 4 points 2 years ago* (7 children)

    This is where your lack of understanding of the open source thing is readily apparent to everyone arguing with you. If it was backdoored, many people would be calling that out. In fact, this was one of the exact reasons at the heart of the original concerns leading to this story.

    The fact that the source is available means that we can see exactly how the data is encrypted, allowing assurances to be made independently.

    If nothing else, I trust Bitwarden MORE because of that and I'm happy to pay them for their services since it helps find further development.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] -4 points 2 years ago (6 children)

    If it was backdoored, many people would be calling that out.

    In theory. And not necessarily soon. Don't forget the context of this thread: we compare bitwarden with keepass, which does not offer to you your password base on their server side.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 2 years ago (5 children)

    Trusting one FOSS client good. Trusting different FOSS client bad. Logic where?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 0 points 2 years ago (4 children)

    That different FOSS client stores your data on their company's server. It's an important factor, IMO.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 0 points 2 years ago (3 children)

    Dude, how is bitwarden hosting your own, locally encrypted (in FOSS client) password database any different than using keypass and syncing it however you want?

    I don't even use Bitwarden myself, I'm using keepass too, but this attitude is ... weird?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 0 points 2 years ago* (2 children)

    I find risk slightly bigger when you encrypt your private data with the product of the company and store that encrypted data on servers of the same company.

    Why: because if they have some backdoor now or plans to introduce it in future, they have all the time in the world to apply that backdoor to your data. Without you knowing it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 2 years ago (1 child)

    Bitwarden client is FOSS same as Keepass, though. Why aren't you afraid of Keepass having backdoor by "insert whatever big corporation sponsoring FOSS" giving said companies free access to your passwords you happily store in their clouds?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •