Hacker News Reader

Comment by jakebasile | Hacker News Reader

The problem with iCloud keychain for me is that I don't only use Apple devices, otherwise it might do the trick (except for TOTP 2FA stuff).

I'm trying Bitwarden now and it seems to be ok. Maybe it's time for a change.

View on HN

As a user that made the switch to bitwarden the last time 1Password tried their shift to the membership-only options some 1-2 years ago, it is an excellent replacement. I do miss some better search / sorting functionality, but otherwise this works great with a local server that I maintain for keeping my Mac, Ubuntu, Windows and Android devices in sync.

Bitwarden costs only what is it 10 or 12 USD a year. LastPass costs 24 USD, and 1Password 36 USD. If you need 2FA. If you don't need 2FA then it doesn't cost as much, but I think you still have a device limit.

Bitwarden's clients are FOSS. There's a 3rd party FOSS server for it available written in Ruby. So you could even self-host.

[EDIT: there's one written in Rust as well! [1] [2]]

[1] https://github.com/jcs/rubywarden

[2] https://github.com/dani-garcia/bitwarden_rs

You can also self-host the original server, it's under AGPL[0]. I'm using this atm, and yes, I pay for the organization feature, though I could easily adjust the code to unlock it. It just doesn't feel right (same goes for the 3rd party FOSS server). But that's just me.

[0]: https://github.com/bitwarden/server

IIRC, LastPass increased to $36/yr which made me switch to Bitwarden. $10/yr with better functionality and UX

Does BitWarden support "family" use-cases, where you share passwords between multiple accounts?

Yes. Family plan is just $1/month for 5 users and self-hosting as an option.

The free tier supports 2 users sharing.

That would be a good option if they supported all of their clients equally, but the developer has pretty much said that he's not going to update the extension to support Safari 13. As a Safari user, it's not a good option.

> The problem with iCloud keychain for me is that I don't only use Apple devices

If I ever need to sign into something on a non-Apple OS, I look up the desired iCloud KeyChain-stored password on my iPhone, then manually retype it on the other device.

I feel that gives me extra security.

>...that gives me extra security

Actually, manually typing or pasting your password (assuming you aren’t using WebAuthN) opens you up to phishing attacks because you could be fooled by the URL, whereas password managers and hardware tokens will activate only for the associated domain.

I meant, I don't have to trust Windows or Android's security to not leak access into third-party password sharing apps, or the in-house security hygiene of those third-parties.

With Apple there's only one party involved.

Bitwarden will also stop working with Catalina / Safari 13 so that doesn't help this particular use case

Seems to work fine, I installed Bitwarden yesterday

https://github.com/bitwarden/browser/issues/664

Ah, it works on Catalina. I don't use Safari.

That is not entirely true. Update: https://git.io/fjXLJ

+1 for Bitwarden.

+1 for Bitwarden

Reply on news.ycombinator.com