Hacker News Reader

Comment by navidfarhadi | Hacker News Reader

If you are looking for an alternative I highly recommend Bitwarden (not affiliated with the company). I switched over from Lastpass around a year and a half ago and am very happy with the service. All of the clients and the server are 100% open source plus you can self host if you want to.

View on HN

Switched from LastPass to BitWarden over the weekend. I have 1,200+ passwords, and the transition was seamless. I even set up BitWarden on one of my web servers so that I can control my data -- even that took less than 30 minutes, thanks to BitWardenRS docker container.

The only thing I have yet to figure out for BitWarden is how to get a little icon to show up next to user/password fields in forms. I just have to right click and go to BitWarden (FireFox) to get there, which it just slightly more work. Still worth it.

Why would I pay $36/year (LastPass) for something that I can control for free?

With BitWaden FF, you can use Ctrl+Shift+L to auto fill your most recently used account for the current website.

Hope it helps.

If you have Bitwarden in Firefox's toolbar the icon will also display a number indicating the number of available credentials, and clicking the icon to open it and then clicking any of the entries autofills.

Is there an exporter available for BitWarden then? I'm guessing your 1,200 password had a seamless transition because of some tooling the project provides? Is that correct? Cheers.

Not the person you're asking but you can export your passwords to CSV from LastPass and BitWarden can import the CSV. The only issue is that the LastPass export can be a bit sketchy and have a few errors you need to manually fix.

I suppose seamless may have been an oversell. I consider it seamless because BitWarden provides the import functionality for a variety of competitors' exports (XMLs, CSVs, etc), so all I had to do was export my LastPass passwords to my desktop and then import it into BitWarden via the web interface. HTH

LastPass is $36/year now!? It used to be $12/year (prior to their acquisition by LogMeIn, which is when I bailed).

Given you use Firefox, have you considered using the built in Sync service and companion Lockwise mobile app:

https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

I seriously considered Bitwarden not so long ago when I was looking for a password manager, and then realized I also need to maintain bookmarks across platforms and devices. Sadly Bitwarden doesn't offer that as a feature.

I'm curious if there is a differentiating feature of Bitwarden over Sync

I'm not the parent comment, but I did consider Lockwise but the inability to store anything else than passwords is a dealbreaker. I have some software license keys and their receipts stored securely, as well as some network accounts that are not web-based.

BitWarden is one of the few things I pay for even though I don't have to simply because I really want it to keep existing.

Same. And at 10$/year, its not like its un-affordable. Its probably my 3-4th most used piece of software, after win10, firefox, and thunderbird.

I just wish I could donate. I don't need the premium features, and I don't need yet-another-subscription-plan to worry about.

I subscribe to Bitwarden but this is a real issue with a lot of things: subscription overload.

It is especially bad with newspapers where everyone seems to be optimizing only for subscribers, not for sale of individual news items or even single day access.

Consequently I don't buy (except one local and one national one.)

The Guardian seems to be the winner in my case. They accept donations and get $10 for each thing I read there it seems :-]

Yep, I saw this and immediately felt vindicated for the move to BitWarden.

My only fault with it is that it's missing the "icon" in the inputs to click-and-fill as LastPass has, but I believe that's on the BitWarden backlog.

Still, I'd take having to press Cmd+Shift+Y over not being able to see access keys or er... any of my passwords.

If you have a Raspberry Pi lying around, there's a docker image for the excellent bitwarden_rs server available that makes it a snap to get up and running: https://github.com/dani-garcia/bitwarden_rs/wiki/Which-conta...

Forgive my ignorance, and possibly laziness, but if the Pi SD card dies do your passwords go with it?

Yes but for something like this backups (NAS, google drive, even a usb) are a must

If you care about Pi reliability then don't have the root partition on an sd card.

The cost of electricity and my time is probably more than $10 a year.

I hear "the cost of electricity" thrown out a lot for self running a small service. A Pi uses ~2W. At $0.11/kWh, running that constantly is ~$1.93 a year. Of course electricity rates vary, but I usually find the cost of electricity to be overblown when it comes to compute. Power can be very cheap.

However, I imagine spending an hour of your time is more than that $10 budget.

Yes, my time is worth more than $10/hour.

Also, I've never run a Pi for more than a few years without the SD card failing. Even when logging to a ram disk, something seems to fail eventually, and it is sometimes not found until the unit is rebooted.

Have you looked into alternatives? I'm about to swap out a Pi 3 for something a bit faster and without an SD card, but I'm not sure what. I was thinking NUC but they probably aren't nearly as efficient. Efficiency at idle, more than compute efficiency, is really what I'm seeking.

Running a Pi with a SSD over USB seems to be the best option at the moment. There are other SBCs with m.2 storage options which look neat as well but are obviously not nearly as well supported as the Pi line.

You can make the Pi boot over USB, I do that with more important stuff with a SATA SSD attached over USB.

Of course, I have a backup of the important data as well.

> However, I imagine spending an hour of your time is more than that $10 budget.

I always find this a weird way to judge things. Are people actually spending the time they'd be earning money to set these kinds of things up?

Any time they spent is time they could have spent earning money instead. They may not have wanted to earn money with their free time, but did they want to set up a password manager with their free time either? It's not exactly a leisure activity for most users

Worse, it's my free time that I value far more than my work time.

Bitwarden is free anyways if you just need username and password stored

The argument for self-hosting Bitwarden is about privacy and security, not cost.

I'm 3 years into Bitwarden and have never looked back. I backed the kickstarter that failed some while back, but it seems he/they ended up managing without it. I should probably subscribe even if I don't need the extra features.

I second Bitwarden. I have >130 120-character auto generated passwords stored and can rotate / regenerate my passwords with little hassle. Also love having the self hosting option available.

The "Premium" service offers 2-step login (Yubikey) but is only one account. Is there a "Family Premium" ?

Both the teams and enterprise options also allow you to share any credentials within an organization/team, though the default for any new credential is no sharing. I assume that's exactly how the family plan works as well?

Yes. It's called "Premium Access Addon". They charge additional cost of $40 /year.

More info here - https://blog.bitwarden.com/premium-access-for-families-organ...

Thanks!

After reviewing what you actually get from a family plan, I'm not needing to be sharing enough credentials to make it worth the cost. I opted for a premium plan instead so that I can make use of yubikeys.

There is. If you plan on sharing some credentials with only one more person, you can make an "organization" for free and put some credentials in there. My Netflix account is in there for my wife, so if I decide to rotate the password she'll have access to it.

There's also some other stuff like our Wifi password, etc so that she doesn't have to write it down.

I switched from LastPass to Bitwarden after LastPass started trying very hard to use the same password for every website I tried to generate one for.

Bitwarden sync can sometimes be a little slow but on the whole I am very pleased with it and would highly recommend it.

I really like the idea of Bitwarden but haven't used it yet. I think it will probably eventually be my go-to recommendation in this space, having fought with some of the other non-foss offerings.

Doesn't it worry you that Bitwarden is essentially maintained by one person [0]?

What if that person gets run over tomorrow and nobody knows the password for the AWS account. Imagine how long it'll take for somebody get around the huge code base on their own.

[0] https://github.com/bitwarden/server/graphs/contributors

You could easily export your passwords if needed and leave bitwarden in that case.

Now I think there is a scenario where the maintainer gets bussed and bitwarden later goes down after some months resulting in lost passwords.

I keep an offline, encrypted backup of my Bitwarden data in a safe place. If something happens I can quickly spin up a bitwarden-rs instance, or go back to KeePass.

Also check out this Bitwarden-compatible server written in Rust[0]. I've been using it for 2 years now and had exactly 0 problems with it.

[0] https://github.com/dani-garcia/bitwarden_rs

It's also much cheaper than LastPass. I was going to convert over to BitWarden the last time I was up to renew LastPass but that means I also have to retrain my family on how to use it. I'm gunning for sometime in the next year though.

Reply on news.ycombinator.com