Hacker News Reader

Comment by kcmastrpc | Hacker News Reader

considering using and supporting the open source bitwarden project instead.

I've been interested in migrating to bitwarden for a while, but I've been hesitant because I don't know how much I can trust it. Mostly, I was looking for an independent security audit. I took another look today and found a GitHub issue on the subject [1] and they're working with researchers on HackerOne [2].

[1] https://github.com/bitwarden/core/issues/27

[2] https://hackerone.com/bitwarden

Running a bug bounty is not the same thing as getting an independent security audit.

That's quite the understatement.

Yes, but there's discussion in the issue that I linked to about raising funds for an independent audit.

Why does it need me to create an account? What's the technical reason? My ye olde 1Password (pre-cloud) doesn't need an account, and stores its database in iCloud or on Dropbox using the accounts I already have there.

It's a web service. You can host it yourself.

This seemed like a nice software to manage my passwords so I decided to give it a try and install it on my Synology NAS. However, two things put me off about it.

1) I wanted to install it via Docker App that comes pre-installed on my NAS so that I can use its GUI to make necessary hosting configurations. I searched for the keyword 'bitwarden' on DockerHub and found multiple images created by Bitwarden's company with different names such as "bitwarden/web, bitwarden/api, bitwarden/setup, bitwarden/server, bitwarden/admin" [1] and all have the same description which basically tells you to go to their website for more information about self-hosting it. And unfortunately they don't have any information regarding which one of those images is the one that needs to be installed for self-hosting. All it says on the documentation is how to install it via terminal and pulling the image from GitHub.

2) The other thing, which is more important than the first one, is having to give them an email address and get a unique installation id and key [2] for self-hosting it. I understand that they probably see it as an easy way for upgrading your license for premium features [3] if you choose to do so later on but it kind of kills the idea of self-hosting it on my own server and wanting to have nothing to do with the company other than using their open-source software for me. They may be right for saying 'It's really free, not a fake "free trial free"' on their website but what they're not directly telling you is that it actually is a freemium [4] software if wish to self-host it under these circumstances.

[1] https://hub.docker.com/r/bitwarden/ [2] https://bitwarden.com/host/ [3] https://help.bitwarden.com/article/licensing-on-premise/ [4] https://en.wikipedia.org/wiki/Freemium

There are 2 3rd party bitwarden servers:

https://github.com/jcs/bitwarden-ruby https://github.com/VictorNine/bitwarden-go

but to run the bitwarden-blessed one see: https://help.bitwarden.com/article/install-on-premise/

Their mobile app appears to only offer copy paste. It'd be nice if they had a custom keyboard or some cross app integration.

Under tools(the hammer & Wrench icon), select "Bitwarden App Extension", and it will show up in the share sheet for safari/etc. I assume similar happens on Android, but I dunno.

Are you on an iOS device or Android? If you are on an android device that is Oreo or higher, bitwarden uses the autofill framework:

https://blog.bitwarden.com/bitwarden-the-oreo-autofill-frame...

There is a CLI for bitwarden now (3rd-party, MIT licensed and not supported by the company at all): https://fossil.birl.ca/bitwarden-cli/doc/trunk/README.txt

Business plan's pricing is attractive to small businesses in Latin America. Thanks for sharing the link. I will implement it in my company.

Reply on news.ycombinator.com