I use an unnoficial Bitwarden app on Ubuntu Touch. I would prefer KeePassXC or KeePassDX as my go to password managers but have found no reason to distrust Bitwarden thus far.
Since bitwarden is a VC funded company, I’m wary of the enshittification that might take place in the future. Even though technically speaking, you can self-host the server via Vaultwarden, it is largely possible because the project has blessing of official devs. That can change dramatically in future.
For something as important as your passwords, trusting a for-profit company might not be the best idea.
Would love to know what the community thinks about this.
DISCLAIMER: I love Bitwarden and use it daily, both for personal use and at work.
The VC money has gone to good though, like audits and open source code. A lot of the money they get is from company deals with bitwarden buisness anyway. As long as that works out, I can’t see them screwing over anyone while they have a money stream. If they do screw up, exporting to KeyPassXC is super easy anyway.
One of the things I dislike about KeepassXC is that it exports to a unstructured CSV file, whereas Bitwarden exports to JSON. It’s a lot easier to use something like jq to parse a JSON structure, if you want to import it somewhere as opposed to dealing with CSV files.
I also found the importer for Keepass CSV in Bitwarden didn’t import my “notes” and I had to individually check that for each record.
The one question no-one has mentioned yet given it’s probably Bitwarden’s biggest security vulnerability…
How strong is your password?
Because ultimately that is EVERY password managers weakness! I’m also still skeptical about the abuse, is it passkeys or something that I’m going to guess will make it so much easier to do social engineering on so I’d personally never use it on a vault.
Recently switched from KeepassXC to Bitwarden because of the cloud hosting ability (I was tired of having to sync my database file everywhere) and have no problems so far. I see Bitwarden recommended a lot, especially from places like privacyguides
Since the question has already been answered I can only give my opinion. Honestly Its the only cloud based password manager I trust. I was a customer for a couple of years until I decided to try keepassxc but my opinion has not changed about bitwarden. Havent tried vaultwarden
I’ve switched away from 1password to proton recently.
it’s fine, it’s far less accurate than 1p was. Let this be a caution, 1password is great for user experience, I hardly noticed it because it always worked. Proton can’t see every login field, doesn’t know when to suggest a new password, won’t save passwords after it has suggested one, doesn’t update login credentials after updated passwords etc etc.
I’m unsure about bitwarden in particular, but I can vouch for the fact that a less intelligent app might be a dealbreaker for some.
Top of the line, best of the best, nothing beats it. Especially if you self-host Vaultwarden, there is simply nothing that can compete. (Vaultwarden makes the 2fa component that is paid in Bitwarden free if you self-host it)
Absolutely proprietary, which is why you’re hearing about bitwarden instead from the linux crowd.
It’s one of the first services I started to selfhost externally. I’ve not had a single problem with it, and it’s easily the best, most useful piece of software I host.
I’m not sure how 1password works with families, though I see it’s 5 dollars a month for 5 members. I can tell you that with bitwarden (and selfhosted vaultwarden) it’s super easy to manage passwords for your family through organizations. I have it set up so I have access to all my parents’ passwords, and I share access to relevant passwords with my partner, but I don’t have to clutter their password manager with hundreds of passwords for random crap they don’t need.
Because it’s closed source, there’s a higher likelihood that there is an undiscovered vulnerability in 1Password. Even though it is audited, a vulnerability could be introduced after the most recent audit and you would never know.
For something as mission-critical as a password manager, going with an open source solution gives just that much more confidence that your data is safe. To me it’s simply not worth the risk to blindly trust a company with my login data, when I could trust a company that displays their entire solution in the open.
Going to play Devil’s advocate here, but open source does not automatically mean that things are safe or that anyone is even auditing the code on anything that resembles a regular basis.
Heartbleed was introduced into OpenSSL source code in 2012 and wasn’t discovered and fixed until 2014
I use Bitwarden but there is nothing wrong with 1password. Both have been audited, and (IIRC) don’t have major security holes so far. 1password is more expensive but it’s not an issue.
I started using 1pass after the audit by my former company’s itsec team. Just curious if there are some downsides (apart from the price) I’m not aware of.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
I use an unnoficial Bitwarden app on Ubuntu Touch. I would prefer KeePassXC or KeePassDX as my go to password managers but have found no reason to distrust Bitwarden thus far.
I’ll play the devil’s advocate here.
Since bitwarden is a VC funded company, I’m wary of the enshittification that might take place in the future. Even though technically speaking, you can self-host the server via Vaultwarden, it is largely possible because the project has blessing of official devs. That can change dramatically in future.
For something as important as your passwords, trusting a for-profit company might not be the best idea.
Would love to know what the community thinks about this.
DISCLAIMER: I love Bitwarden and use it daily, both for personal use and at work.
The VC money has gone to good though, like audits and open source code. A lot of the money they get is from company deals with bitwarden buisness anyway. As long as that works out, I can’t see them screwing over anyone while they have a money stream. If they do screw up, exporting to KeyPassXC is super easy anyway.
One of the things I dislike about KeepassXC is that it exports to a unstructured CSV file, whereas Bitwarden exports to JSON. It’s a lot easier to use something like
jqto parse a JSON structure, if you want to import it somewhere as opposed to dealing with CSV files.I also found the importer for Keepass CSV in Bitwarden didn’t import my “notes” and I had to individually check that for each record.
While true, you can easily migrate your data elsewhere in such a scenario.
If that changes they’re dead to me.
As safe as it can be. No more, no less. One of the best out there.
The one question no-one has mentioned yet given it’s probably Bitwarden’s biggest security vulnerability…
How strong is your password?
Because ultimately that is EVERY password managers weakness! I’m also still skeptical about the abuse, is it passkeys or something that I’m going to guess will make it so much easier to do social engineering on so I’d personally never use it on a vault.
Yeah, you need 2-factor yo.
It’s a good question. A vault is only as strong as the credentials required to access it.
Bitwarden does have MFA support, though. If you’re using it without that enabled, you’re asking for trouble.
It’s safe. I have a self-hosted Vaultwarden instance on my NAS for years now. I absolutely love Bitwarden.
Recently switched from KeepassXC to Bitwarden because of the cloud hosting ability (I was tired of having to sync my database file everywhere) and have no problems so far. I see Bitwarden recommended a lot, especially from places like privacyguides
I use Bitwarden for passwords, it’s just great.
For totp I use a keepass database on the cloud. Each device needs a local key file to login to get the codes.
Since the question has already been answered I can only give my opinion. Honestly Its the only cloud based password manager I trust. I was a customer for a couple of years until I decided to try keepassxc but my opinion has not changed about bitwarden. Havent tried vaultwarden
Same. I do use keepassxc (with KeePassium on iOS) for totp codes though just in case Bitwarden ever had an issue.
Separate systems > combined
Seconding this. I won’t use any cloud-based password manager but Bitwarden rn.
I’ve switched away from 1password to proton recently.
it’s fine, it’s far less accurate than 1p was. Let this be a caution, 1password is great for user experience, I hardly noticed it because it always worked. Proton can’t see every login field, doesn’t know when to suggest a new password, won’t save passwords after it has suggested one, doesn’t update login credentials after updated passwords etc etc.
I’m unsure about bitwarden in particular, but I can vouch for the fact that a less intelligent app might be a dealbreaker for some.
Its open source, self host-able or cloud host and its had enough audits to say its fairly secure.
Being using it for years, never had a problem…
Gold standard.
I switched from bitwarden to 1password because the password autofill was less intelligent.
What’s your issue with 1password?
No self-hosting
Check out Vaultwarden
Vaultwarden allows 1password self hosting?
Must have missed the context. I thought the question was for Bitwarden.
No, only Bitwarden self hosting
Top of the line, best of the best, nothing beats it. Especially if you self-host Vaultwarden, there is simply nothing that can compete. (Vaultwarden makes the 2fa component that is paid in Bitwarden free if you self-host it)
Out of interest, if you self-host, do you still have to pay for the “premium” BW features like TOTP-in-app?
I was on standard BW for less than a month before moving everything to KeePassXC to have free TOTP.
Vaultwarden allows all Premium features at no additional cost.
Ferb, I know what we’re gonna do today.
Same!
Sorry, which is the gold standard, bitwarden or vaultwarden or are they something you use in tandem?
Tandem.
BitWarden is the client. VaultWarden is the server-side, self-hosted component that emulates the official BitWarden cloud service.
I’m hearing a lot of good things about Bitwarden, especially from the Linux crowd.
What I am curious about though is what’s in your opinion wrong with 1password - a solution I’m currently using too.
Absolutely proprietary, which is why you’re hearing about bitwarden instead from the linux crowd.
It’s one of the first services I started to selfhost externally. I’ve not had a single problem with it, and it’s easily the best, most useful piece of software I host.
I’m not sure how 1password works with families, though I see it’s 5 dollars a month for 5 members. I can tell you that with bitwarden (and selfhosted vaultwarden) it’s super easy to manage passwords for your family through organizations. I have it set up so I have access to all my parents’ passwords, and I share access to relevant passwords with my partner, but I don’t have to clutter their password manager with hundreds of passwords for random crap they don’t need.
Because it’s closed source, there’s a higher likelihood that there is an undiscovered vulnerability in 1Password. Even though it is audited, a vulnerability could be introduced after the most recent audit and you would never know.
For something as mission-critical as a password manager, going with an open source solution gives just that much more confidence that your data is safe. To me it’s simply not worth the risk to blindly trust a company with my login data, when I could trust a company that displays their entire solution in the open.
Thanks, this answer in particular have me something to think about.
Going to play Devil’s advocate here, but open source does not automatically mean that things are safe or that anyone is even auditing the code on anything that resembles a regular basis.
Heartbleed was introduced into OpenSSL source code in 2012 and wasn’t discovered and fixed until 2014
Absolutely, but it’s a probability game. Between those two options of BW and 1Password I’ll go with the choice that has the higher probably of safety.
I use Bitwarden but there is nothing wrong with 1password. Both have been audited, and (IIRC) don’t have major security holes so far. 1password is more expensive but it’s not an issue.
I started using 1pass after the audit by my former company’s itsec team. Just curious if there are some downsides (apart from the price) I’m not aware of.
Some would argue that as 1password is proprietary it can’t be trusted as much as open source Bitwarden
It’s one of safety solutions out there