Hacker News Reader

Comment by xxkylexx | Hacker News Reader

If you're interested in an open source option that compares quite well to the LastPass feature-set, check out bitwarden: https://bitwarden.com/ (note: I am the lead developer).

View on HN

Hi, I'm considering giving bitwarden a try. I'm curious, though - are there any 3rd party security scans for the product? And (only half-joking) can we get Tavis to review it?

There have not been any formal third-party audits done that we can document yet, however, the product is entirely open source (from the database, backend apis, to all client-side applications). https://github.com/bitwarden . Anyone is free to audit (and contribute) as much as they'd like. If you can get Travis (or any security researcher) interested in reviewing our products we would love to work with him.

Thanks. Are there any plans to have routine security audits done?

As we bring some of our revenue generating features online we hope to have the cash flow to fund regular third-party audits.

I'm not the lead developer (or involved with the project at all) and I also recommend it.

Only issues I have right now are:

- No app-fill on Android.

- No auto-fill (have to manually click the icon and select an account).

- When using Firefox the extension periodically logs out for no apparent reason.

- There's no address/wallet stuff so I actually have to pull out my credit cards.

Other than that it works pretty well.

- We released app-fill (autofill) on android last month. Make sure you are using version 1.3.0 or greater. Read more here: https://blog.bitwarden.com/android-v1-3-0-now-with-auto-fill...

- We also fixed the issue you are referring to on Firefox last week. Make sure you are using 1.10.1

- There are plans for additional "wallet" features in the future.

Woo! I just got app-fill working.

To be clear though, app-fill and auto-fill were referring to different things. What I meant by lack of "auto-fill" was that when I visit a website on desktop, my details aren't instantly filled when the page loads. I have to manually click the extension icon in my browser and select the account I want.

This is not always a bad thing. Sometimes you don't want software to automatically plunk your login credentials into appropriately named fields on a JavaScript driven web page

This is why we don't offer this feature. This feature is one of the major offenders for lastpass in the past. It's very easy to get wrong and expose vulnerabilities.

It _is_ a vulnerability!

How are you making money off of this?

bitwarden is currently sponsored by the Microsoft BizSpark program which covers many of our operation costs and allows us to offer services for free to our users. We are working to introduce enterprise features for businesses in the future (scheduled for release next month) which will allow us to monetize. In the meantime, everything is free for users.

Which of the current free-for-everyone features, if any, are you considering making available to paid accounts only? (i.e., what will your current free users lose unless they move to a paid account once you monetize?)

Everything you see today will remain free for personal users.

Perhaps you missed it at the time but I'm wondering if you can answer this https://news.ycombinator.com/item?id=13438225

Looks cool. My personal "I can't use it because it lacks X" list:

- Firefox extension

- Password generator

But I'll keep an eye on it. LastPass is far from perfect.

We have both of these things:

- Firefox: https://addons.mozilla.org/en-US/firefox/addon/bitwarden-pas...

- Generator: http://imgur.com/3q4w9Mn.png

You need to update your user home screen then, both features have empty links saying "coming soon".

bitwarden has a Firefox extension [1], and it has a password generator.

[1] https://addons.mozilla.org/firefox/addon/bitwarden-password-...

Thanks for this comment. I switched to bitwarden from LastPass last night.

cool, thanks - I'll have a look!

Reply on news.ycombinator.com