Hacker News Reader

Comment by bigiain | Hacker News Reader

I'm a paid licence holder for 1Password, but am uncomfortable with being more and more forcefully pushed into using their cloud-based subscription service (which while I use for work, I'd rather _not_ us personally).

What're people's experiences with alternatives to 1PW - ones that do device-device sync and work at least across iOS/macos and ideally integrate nicely with browsers and apps on both those platforms? Is BitWarden ready for prime time for something as critical as secure password storage yet? Does it's iOS app take advantage of the secure enclave features of iPhones?

View on HN

I've been using Bitwarden since just after it launched. I've yet to have any issue with it. The desktop, browser, and mobile clients are all seamless and... well, just work.

I was part of the LastPass exodus after their acquision and used 1Pass with Windows and (then) OSX. The lack of Linux client was a hassle, and eventually left me shopping around. I tried Keepassx and the others, but I ran into issues with sync (most likely my error.)

I saw Bitwarden mentioned here and gave it a swing. Importing everything only took a minute, and I haven't looked back. It works on all operating systems, has 2FA, etc etc. It's perfect for my needs.

At some point in the future I may go self-hosted.

yup. similar journey. I think LastPass is going out of business - we were enterprise subscribers last year and it was impossible to get in contact with support when our license expired. couldn't even get in contact with a sales person - they literally didn't want our money anymore. Switched to BitWarden and am so much happier with the interface and such better pricing than 1password, plus i feel have always been upfront with their product development while 1password has been, um, sorta shady, imho.

that's crazy about LastPass. It was a decent product for its time, but password managers evolved quite quickly over the past few years.

My beef with 1Pass is that they charged around $35 - $50 for their standalone product during the exodus, and about a year later moved to their subscription platform --- pretty much abandoning development for the standalone users. The OSX application was far less buggy than the Windows client. And when you needed to grab a new copy of the standalone client, it was buried on their site in a FAQ.

1Pass should have offered a few months for free to pull the standalone folks over to the new service, but instead they said 'we don't have any offers, but feel free to contact sales' -- which is a difficult sell when compared to the newly polished Bitwarden that works on all systems and browsers out of the box without any requirement for payment or a subscription.

All this said, we're technical people, so we're more aware of sketchy practices and are quick to jump to different products, and may not be their target -- especially with their previous lack of Linux support.

FWIW, at work the 1PW cloud/subscription thing is a _very_ good thing, and easily worth what we pay for it.

I just don't want to have my personal password db on other people's computers, and their ever more forceful pushing to get me off the standalone apps synced between my devices over wifi has _finally_ got me looking around for alternatives. I'm _totally_ happy to pay for an alternative - I _do_ value software (especially this type of software), and Id love to be sure whatever I use has a reasonable change of being around (and being successful) in the timeframe of at east 5-10 years.

Bit I totally get that AgileBits are heading in the direction where my work is their target customer, and I am not. That's fine. I'm pretty sure I'd be making exactly that same decision if I ran/advised AgileBits.

KeePassXC is FOSS, free of cloud nonsense, works fine on desktop, and has integrations for most browsers. I have no idea about the iOS situation, but on Android KeePass2Android provides global autofill and works with a ton of storage providers (everything from Dropbox to bring-your-own-SFTP).

On iOS, there’s KyPass. It plays nicely with the Linux and Mac versions of Keepass, syncs with Dropbox, supports Touch ID, etc. There was a reasonable one-time purchase price, I believe.

I switched to the Keepass world a while back when 1Password started to try to nudge me into paying a monthly fee for software that I already paid for on multiple platforms. The Keepass variants aren’t as slick but who cares.

I actually _do_ care enough about "slickness" to be prepared to pay for it. I want to be able to keep my encrypted password db off other people's computers though - using 1PW's cloud service requiring Dropbox for multi device sync is not what I'm after...

I paid about 50$ or so for it with no complaints. I’m not willing to pay that plus a subscription fee for what is, at the end of the day, a small encrypted database.

Big fan of KeePass. On Mac KeePassXC is great, on Windows KeePass, but on iOS I use Strongbox [1] which is excellent. Auto fill works well, it's open source [2] and actively developed, I really don't trust none open source password managers

[1] https://apps.apple.com/us/app/strongbox-password-safe/id8972...

[2] https://github.com/mmcguill/Strongbox/

I had my whole extended family on 1PW. We've all switched to Bitwarden (after a few transgressed to LastPass, but that's behind us now), and we're happy.

Having the developer respond quickly on email is delightful, it works great on Ubuntu, macOS, Windows, Chrome OS, Android, Firefox, and sharing credentials between accounts works seamlessly.

How's BitWarden at autofilling forms on webpages? Does it work in Chrome on Android (or other mobile browsers)? Can you authenticate with a fingerprint? Can you force a non-fingerprint method after device reboot or a certain period of time?

I might have a closer look at it myself.

> autofilling forms on webpages

It works fairly well. Some sites (banking, mostly) don't work, but the UI lets you easily copy the username or password so you can paste it where it should go.

> Does it work in Chrome on Android

Yes, and Firefox on Android.

> Can you authenticate with a fingerprint

That's how I have it set up.

> Can you force a non-fingerprint method after device reboot or a certain period of time?

Maybe? I haven't seen (nor looked for) that feature.

> How's BitWarden at autofilling forms on webpages?

I don't think I ever had any issues with it.

It looks like it might use some old code from 1Password:

https://github.com/bitwarden/browser/blob/280f6f495f9f8bdfe3...

This is one of the most interesting things I've seen in this thread. I would not have expected 1Password to make any part of their platform MIT licensed.

Autofill on desktop is pretty amazing, I never had problems. On Chrome Android it uses the autofill APIs and is quite good but not perfect.

You can authenticate with a fingerprints and afaik no, you can't force pin after a reboot/period of time.

I never had trouble with it regarding that part and still recommend it. It also accepts 2FA with an YubiKey.

I second Bitwarden. Possible to self-host, open source, and works everywhere I want to.

> Is BitWarden ready for prime time for something as critical as secure password storage yet?

It works pretty well, but the user experience eventually drove me back to 1Password:

https://news.ycombinator.com/item?id=19839087

#4 in particular.

Does it auto lock? That sounds annoying. Saving passwords not as big of a deal, but definitely for filling in passwords.

You can set timeout on auto lock or put it on different settings such as browser restart, OS restart, or never.

That’s horrible. How is that not considered a bug?

The developer says "Unfortunately the browser APIs don’t allow for this.":

https://community.bitwarden.com/t/autofill-shortcut-should-o...

Now I’m going to have to check see what 1 Password does in this situation.

I took one look at BitWarden and, as a security person, ran the other way when I saw the CLI expects you to enter your password on the command line in order to operate it. This password gets exposed in your shell history, to anyone who can view a process list, etc.

If a company writing a security product can be this incompetent about something so basic, I don’t have any interest in gambling that the rest of their product is any better.

You mean the cli doesn’t prompt you to type the pwd separate from the cli command itself, akin to how Postgres ‘psql -p’ works?

According to the docs, all of the relevant commands accept the password as an argument to the binary itself.

https://help.bitwarden.com/article/cli/

It does. In fact, when you --help in the cli tool the first example it suggests is to login with "bw login" command which is the default way.

Did you actually try using the CLI tool, or did you only read the documentation? The documentation isn't super clear, but in actual usage your password (nor your email) doesn't get entered into shell history or otherwise.

You can pass your email and password as arguments to the "bw login [email] [password]" command, which will put them into your history, but the default way of typing "bw login" will then prompt you for them both, masking your password just like any other CLI tool does.

If if you can do this, the fact that the documentation encourages you to do otherwise is extremely worrisome. Securely-written tools shouldn't even allow you to do this in the first place, much less promote it.

https://help.bitwarden.com/article/cli/

I don't think it's extremely worrisome. The arguments are in brackets a.k.a. they are optional. If a user doesn't know that they probably shouldn't be using the command line tool in the first place. Besides, if you run help on the cli tool the first example it suggests is "bw login" (without the arguments).

Regardless that this is one way to operate it (just like many CLI commands can also prompt for password) you're aware you can tell your shell to not save commands to its history?

Not sure how it would work with iOS, but keeweb (or keepass) .kdbx files sync really well via syncthing. Even to my mobile devices.

I don’t know about the secure enclave, but I can anecdotally say that I’ve been using Bitwarden seamlessly across iOS/Windows/Linux for a while now. It uses the convenient auto fill api thing on iOS and the extension is pretty good on desktop as well. (Although I haven’t worked with it on Mac)

Haven’t had any issues, I switched from LastPass and the only feature I miss for personal use is password sharing. I think it was in the free version of LastPass but not part of Bitwarden. I didn’t really use that feature much anyway though.

I use it daily on a Mac. Works great, just like it does on Windows/Linux/Android. Can't comment on iOS.

Reply on news.ycombinator.com