Tangential question: What password manager do you guys use?
I also found this suited my devices and usage, Linux, Android, Mac, Windows... happy across the board.
Also... employers tend not to use Bitwarden, they pick 1Password or LastPass, so it means I can have both work and personal on my BYODs.
But isn't this what the backup codes are for?
I use the notes for each entry in Bitwarden to indicate what kind of 2FA I have enabled and whether I have a backup code already stored in the other vault.
I'd definitely introduce and use Bitwarden for teams.
I also use it at my company, and personally with my wife. Also got my mum to use it!
At my company, we also use it for server secrets, using envwarden: a simple wrapper we created and open-sourced[0] for managing server secrets with Bitwarden.
I'd love to hear an official stance on it from Bitwarden to know their take and whether they're considering supporting this important use case in an official capacity (e.g., sponsoringor providing some kind of support for the project). Seems like it could be a big differentiator over other password managers.
I also convinced my employer company to use it.
The nice thing about Bitwarden_rs is that you get features which you would have to pay for with normal Bitwarden. For example 2FA with U2F. As a note Bitwarden_rs is written in Rust.
I found LastPass painful to use and sync between local vault and server side to be broken. No thought has been given to layout, commonly used options are buried and basic things like selecting the right credentials by subdomain do not work. Their recent UI refresh has simply made things slower rather like Google's admin UIs. They have rather annoyingly decided, against NCSC advice, that I need to see a reminder to pointlessly cycle my master password every time I log in.
The final straw was when they applied a large renewal charge without authorisation to a card they were not given permission to keep and then mishandled the resulting complaint in every way you could possibly imagine.
Bitwarden is cheaper and far more usable, I can't find any single thing that LastPass does better for twice the price.
I've considered using Pass or other open-source self-hosted/synced alternatives but I don't really want to fiddle with something like this quite yet because Bitwarden meets my needs perfectly.
One fantastic feature is that you can add the second factor 6 digit generator to a given password, just like an authentication app. When you log in by filling the username/password and hitting enter, your second factor is copied to the clipboard. That lets you just paste it in, which is very convenient for those annoying sites that make you log in with 2FA every 30 to 60 minutes.
Now I'm testing waters with bitwarden. I like the cross platform functionality so far and the self hosting option. I also like that I just need a master password and don't have to worry about keeping any extra keys safe. I'm not a security expert so I'm not sure whether encrypting before syncing with bitwarden servers is actually safe (this is what bitwarden does afaik). I'm yet to try out their cli option. I also wonder what would happen to my passwords if it shuts down abrubtly. Do I have a backup/copy of the passwords somewhere? This is something that concerns me, where I feel pass is superior. Maybe if there was an option for pass, to use passphrase for encryption rather than gpg, that'd be really cool (maybe not good security wise? I'm unsure on this aspect)
I also liked that when I add the URI of the website login, it gives the icon for it too. Bitwarden's user experience is top notch. I recommended my parents to try it out, except for a few basic questions they were up and running within a few minutes. That's something I really appreciate.
If anyone has self hosted bitwarden, how do you make sure that it is safe from attacks? I'm still exploring this option. Bitwarden uses azure and lets the MS team take care of managing the infra (I'm guessing this includes taking care of attacks).
After a few months, I watched back to LastPass. Bitwarden never quite worked right and as far as I know doesn't provide a way to review access history (I was hacked and wanted to see if other IP addresses accessed Bitwarden).
I'm considering switching to 1Password or Bitwarden. But I'm not sure about BitWarden using the same password both for encrypting the vault and accessing Bitwarden server. Chrome for example has an encryption password which is different from your usual Google Account password.
It all depends on the risk you’re trying to mitigate. A MITTM or a server attack won’t be able to gain access to your passwords, even if they intercept the data. A user with knowledge of your password or a key logged on your client could. However in either of those cases, you’re not protected all that much by having two passwords as opposed to one long one.
I intentionally use other things for my 2FA and TOTP so that my most important accounts are still not accessible even if you somehow get into my password manager. I use YubiKeys where I can, Google Authenticator when it has to be TOTP.
For more important things I use KeePass and keep it all offline.
I moved from 1Password to BitWarden... 2 years ago now? (2 years 2 months) Oh the experience was SO much nicer than 1Password. And the iOS app WORKED!
Work is switching to Bitwarden due to easier ability to integrate into our environment than 1Password.
For example, if you use a third-party KeePass app on your phone, besides having to figure out a secure way to sync it, you also now have to trust the developer of the phone app as well. Larger attack surface.