RyanL Bitwarden Employee

Hello everyone!

Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.

Bitwarden remains committed to open source security and transparency
The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone

If you have any questions, please ask them in this thread. Thanks all!

EDIT:

Bitwarden is not going closed-source
You can still fork Bitwarden
No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden
The free plan is here to stay permanently

top 98 comments

sorted by: hot top controversial new old
[–] 143 points 1 month ago (20 children)

Well, we all know how this ends...

It's a really sad day for me, I love Bitwarden, it's easily the best password manager I've used, and I'm in IT, I've used a bunch.

Fuck private equity, fuck it to death. But until then, I'll be moving my test setup for KeyPassXC into production over the coming weeks and months.

I was happily subscribed to Bitwarden for years for my personal account, I moved several people and a whole company onto it's platform. We had a good run, time to move on.

  • source
  • hideshow 20 child comments
  • [–] 28 points 1 month ago (17 children)
  • [–] 39 points 1 month ago

    If I'm going to have to host my own infrastructure, I don't want it tied to Bitwarden, given the new direction of the company.

    I fully support Vaultwarden though, and I wish them well.

    I'll be going with KeyPassXC and Syncthing.

  • source
  • parent
  • [–] 9 points 1 month ago (6 children)

    I'm. Using Vaultgarden but its not clear if the Android app will still be available.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 12 points 1 month ago* (last edited 1 month ago) (4 children)

    I've been very happy with Vaultwarden+Keyguard

    https://keyguard.dev/

    Edit: I had not looked closely enough at the license and did not realize it's not FOSS, my bad

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 1 month ago* (1 child)

    It currently doesn't work with Vaultwarden. The Linux client doesn't accept custom certificates. And the Android client is paid. It is a dead-end for self-hosting.

    The license is also stupidly a single sentence. Which means that use could be nuked at any minute, and any money you use to pay the developer means nothing. If they wanted to kill the project today and nuke the repo, you have no legal rights, the project dies and fuck you and your passwords. That doesn't exactly inspires confidence.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 month ago*

    Thank you for pointing out that the license is not FOSS, I hadn't noticed that. I suppose I'll be exploring my options again.

    I'd been using the Android client from f-droid and hadn't needed to pay for it, which was working with my VW server. On my desktop/laptop I use rbw, so I hadn't noticed the cert issues with the kekeyguard desktop client.

  • source
  • parent
  • [–] 25 points 1 month ago (8 children)

    Vaultwarden (and all the client apps) depend on Bitwarden for the API spec. If Bitwarden introduces closed features in the API that Vaultwarden can't/won't implement, but the client apps do, it will split the spec. They can also introduce API license keys, which would render Vaultwarden mostly irrelevant.

    The only way for Vaultwarden to remain relevant going forward is to own it and split ways from Bitwarden. This would in turn mean that the FOSS client apps have to decide which to support. But I think the ecosystem is going to fragment eventually anyway, so the sooner every app decides which way they want to go, the better.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 4 points 1 month ago (7 children)

    Or you could just fork it when there's a problem

  • source
  • parent
  • hideshow 7 child comments
  • [–] 20 points 1 month ago (6 children)

    Sounds like you're volunteering to do that additional amount of work.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 7 points 1 month ago (4 children)

    History shows this will happen. Or do you have any counter example?

    Mariadb, libreoffice and most recently OpenCourant

  • source
  • parent
  • hideshow 4 child comments
  • [–] 5 points 1 month ago (3 children)

    Not arguing against it of course, just dislike when people make forking (and establishing a whole new standard) sound like not that big of a deal.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 1 month ago (2 children)

    well, the first step of forking is clicking a button or execting a "git clone" command. thats trivial. publishing to android is a bit of work, but very one-time.

    keeping up with development is a different story - but many foss projects thrive with support from whoever needs to have something fixed.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 1 month ago (1 child)

    You'll also have to convince other maintainers to adopt the new API in this case, otherwise it's pointless. Vaultwarden is only the server, you'd at least require one third-party client (e.g. Keyguard) to add and maintain the Vaultwarden API and probably also someone to fork the browser plugins. This whole issue is quite involved.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 month ago

    When presented a hypothetical between the commenter suggesting it be

    A) forked now

    And me suggesting

    B) forking when there is a problem

    You elect C) the commenter does the work?

    Brilliant contribution

  • source
  • parent
  • [–] 47 points 1 month ago*

    I guess we're gonna see more open-source apps soon, aimed at Vaultwarden first

  • source
  • Not surprised in the slightest sadly.

  • source
  • [–] 27 points 1 month ago

    Sure, it's no change for self hosters currently, but it's one more step in moving towards a more closed platform overall. I do hope more FOSS client apps end up getting made sometime soon. I've been using Keyguard on Android for some time, which means the recent several breaking changes in the Bitwarden apps to the Vaultwarden backend haven't hit me as hard, but I do still use the official apps for my laptop and desktop and Keyguard isnt fully FOSS, of course. I'd love to see some forks or brand new apps one of these days that are actually fully FOSS for both mobile and browsers. I've thought about doing some myself, but I have too many other projects and I also don't have a MAC or want to pay the fees to make an iPhone version. And I abandoned my Android Developer account when they started the identity nonsense, so none of my apps are on the official store anymore and Fdroid and similar may not be viable soon, so it would only really be for myself and a few others who use alternate Android OS's.

  • source
  • [+] 16 points 1 month ago* (1 child)
  • [–] 11 points 1 month ago (19 children)

    What's the benefit for them to change the license?

  • source
  • hideshow 19 child comments
  • [–] 39 points 1 month ago (16 children)

    commercial providers can’t fork and sell it and give nothing back to the OSS community.

  • source
  • parent
  • hideshow 16 child comments
  • [–] 11 points 1 month ago* (13 children)

    No, that would GPL. The benefit for them is that some features will be paid and won't be unlockable just by using Vaultwarden

  • source
  • parent
  • hideshow 13 child comments
  • [–] 1 point 1 month ago (12 children)

    it literally says in the post that the license change affects companies who are repackaging and reselling bitwarden, but ok.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 21 points 1 month ago (11 children)

    But this is the post by bitwarden, defending their decision. AKA marketing.

    Can you explain how bitwarden can be "repackaged and resold", that would be stopped by that change?

    Everybody can still fork/rename/publish the FOSS version which is continued to be available. Everybody can connect to vaultwarden....?

  • source
  • parent
  • hideshow 11 child comments
  • [–] 6 points 1 month ago (9 children)

    Everybody can still fork/rename/publish the FOSS version

    Yeah, but there's no guarantee the FOSS version will be the same as the closed one.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 1 point 1 month ago (8 children)

    There is certainty that the Foss version won't be worse than current bitwarden client. Then those will diverge. So?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 1 month ago (7 children)

    The current FOSS backend used to be the center of the ecosystem. Going forward that may change. If it stops being that center and it becomes merely a token offering so Bitwarden can claim "we're still doing FOSS" then it will become pointless.

    Simply forking the backend is meaningless without the work to also drag along the entire ecosystem, or establish a new one. Forking a project takes time, effort, vision, persistence, determination.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 1 point 1 month ago (6 children)

    The back end is already solved by vaultwarden, so I'm not sure what you mean

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 1 month ago* (5 children)

    Both backend and frontend revolve around the API, and Bitwarden owns that not Vaultwarden.

    If Bitwarden decides to modify the API so that only their closed-source backend has the full spec, and only gives that spec to their own apps, everything else (Vaultwarden and 3rd-party apps) will fall behind or become unusable.

    To counter that, Vaultwarden and the 3rd-party apps need to declare their own API and prepare to fly solo completely independently from Bitwarden.

    Such a move would force Bitwarden to show their true colors. If they really mean to stay true to the open version they will keep cooperating and keeping their API in sync with the Vaultwarden API.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 1 month ago (4 children)

    The api is implemented in Foss front&back end.... I don't know what you are talking about

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 month ago (3 children)

    If there are two version of Bitwarden backend (closed and FOSS), and the closed one changes its API, and the closed Bitwarden apps also switch to the closed API, then what value does the FOSS API have anymore?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 month ago (2 children)

    What is "the API"?

    The API is implemented by the bitwarden back end.

    The API is also implemented by the vaultwarden back end.

    The open source bitwarden client does talk the current version of this API. The open source client can be forked, so there is without much effort a version speaking this protocol in this version and is FOSS. Just the name will be different. I guess "vaultwarden client" would be fitting, but what ever.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 month ago (1 child)

    What is "the API"?

    Good question. When you have multiple implementations of an API, the API (the authoritative version) is what gives the reference spec that all other apps must follow.

    If the authoritative version will be fully implemented only by the closed backend and in the closed apps, it will cripple the FOSS backend and apps.

    This is a common tactic used by companies that want to sideline the FOSS options and slowly make them irrelevant.

    Yes, today all apps talk to both Bitwarden and Vaultwarden the same way. Be on the lookout in case that changes.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 month ago

    I'd totally see the risk if the clients were not available as open source. But they are. So I'm not.

    They might diverge, but vaultwarden users will just fork. Nobody who is using official clients with vaulwarden will be "oh dang, now I have to buy bitwarden, so long vaulwarden, was fun...."

  • source
  • parent
  • [–] 18 points 1 month ago (1 child)
  • [–] 7 points 1 month ago (36 children)

    Does anyone have a handy guide to switching to selfhosted version? I was considering doing that but I let my plan renew out of laziness.

  • source
  • hideshow 36 child comments
  • [–] 16 points 1 month ago* (15 children)

    Idk how it compares feature wise, but i have been running keepassxc/keepassdx combined with syncthing (or any file synchronization/cloud system) for many years without issues. The entire password manager database sits in one encrypted .kdbx file that you keep synced between your devices. Syncthing is nice because its p2p, so no self-/hosting required.

    https://keepassxc.org/
    https://github.com/keepassxreboot/keepassxc

    https://f-droid.org/packages/com.kunzisoft.keepass.libre/

    https://syncthing.net/
    https://github.com/syncthing/syncthing

  • source
  • parent
  • hideshow 15 child comments
  • [–] 5 points 1 month ago (1 child)

    I had done that for a long time. It worked until it didn't and I lost passwords. I tried again with keepass2android and it's built-in sync. It again worked fine until at some point it wasn't able to sync anymore for no discernible reason. I'd love for this to be a reliable setup, but it just isn't in my experience, at least when there are 3+ devices involved with different clients and no proper awareness of the password manager and the sync sides of each other.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 1 month ago

    I just wish Syncthing didn't have such a convoluted port usage, and also that its Android usage didn't revolve around an unofficial app.

    So I'll stick to apps that do sync over SSH (using FolderSync atm).

  • source
  • parent
  • [–] 3 points 1 month ago (4 children)

    I used keepass but switched to vaultwarden, i might consider switching back, but is there a good self hostable web front end for a keepass database? (I need to access it on my work laptop and can't install stuff there)

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 1 month ago (2 children)

    There is KeeWeb but I am not sure how well maintained it is. This issue is still open. It might be worth contacting your employers IT department instead. Asking for a well known password manager like KeePass shouldn't raise any eyebrows.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 1 month ago (3 children)

    Every single time Bitwarden is mentioned on the internet, someone comes in here and proudly recites the anthem “I have been using Keep ass with sink things”

    It sucks compared to a dedicated extension.

    No autofill No TOTP or 2FA support Doesn’t do passkeys Doesn’t have organizational sharing Doesn’t sync to mobile devices Doesn’t integrate with mobile browsers without trusting some compatible 3rd party app Requires selfhosting your passwords (don’t fuck it up!)

    It’s actually pretty sad that the open source world doesn’t have a better solution for this. I mean I guess BitWarden was it but that’s been stolen by venture capital so

  • source
  • parent
  • hideshow 3 child comments
  • [–] 14 points 1 month ago

    Both KeepassXC on desktop and KeepassDX on mobile support autofill, passkeys, and TOTP. Syncing to mobile devices is handled by Syncthing (I use BasicSync on Android) and is quite seamless after setup.

    Integration with mobile browsers and other applications is handled by the OS-level autofill service (at least on Android). Trusting a third party app that is completely open source and has a ton of eyes on it? I don't see a problem with that.

    Selfhosting is literally the entire point, since who more can you trust with your most sensitive information than yourself? And even if you don't trust yourself with being able to keep good backups and following the 3-2-1 rule, you're more than welcome to sync with a third party cloud provider of your choosing since the password file is fully encrypted.

  • source
  • parent
  • [–] 7 points 1 month ago* (last edited 1 month ago) (1 child)

    Why is it that every time i comment about keepass, its because some web based password manager once again broke, got hacked, or stopped development. Keepass users just stay winning :)

    Also i have been using keepass with TOTP 2FA for years what are you on about?

    Also also, you shouldnt use fido passkeys. Its a failed technology that is worse than what it tries to replace.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 4 weeks ago

    There isn’t anything wrong with passkeys that can’t also be made wrong with passwords, and there isn’t anything more secure about passwords, at all.

    Please don’t tell me you took that article that was spammed all over here a few days ago at face value…

  • source
  • parent
  • [–] 0 points 1 month ago

    I've been using that for a while. I like the control I have in that I understand where everything is stored and encrypted. I miss the way that Google password manager had the autofill for seemingly every page nailed though.

  • source
  • parent
  • [–] 5 points 1 month ago (15 children)

    Here it explains some self host options with links to “Get Started” for each:

    https://bitwarden.com/help/self-host-bitwarden/

    For example, here’s the link to “Linux standard deployment”

    https://bitwarden.com/help/install-on-premise-linux/

    You may also want to consider not making your server available to the open internet, and instead access it only on your LAN via VPN.

  • source
  • parent
  • hideshow 15 child comments
  • [–] 25 points 1 month ago (14 children)
  • [–] 4 points 1 month ago (5 children)

    Is there another client we can use with vaultwarden though? (In the scenario wgere that gets locked down)

  • source
  • parent
  • hideshow 5 child comments
  • [–] 4 points 1 month ago (3 children)

    The web interface is hosted directly by your vaultwarden interface so it’s not lockdown-able. The only things that are would be the browser extension and phone apps. Both of which are formally unnecessary because you can always just use the web interface. I’m sure if they ever locked down there’d be community versions in no time as they’re basically just web wrappers anyway.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 month ago (4 children)

    Vaultwarden still depends on upstream bitwarden

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 month ago (3 children)

    Only if you're using the Android app or the web browser plugin, the actual core system does not.

    They could lock Bitwarden out tomorrow and Valtwarden would still work fine.

    Then people would just have to write specific application and plugin if they wanted to continue to use it with no change.

    The web interface would be fine.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 1 month ago (2 children)

    The web interface is from bitwarden. Technically they could fork it but that would be much more work.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 month ago (3 children)

    My knowledge of network security is very limited, right now I only self-host things like movies, music, ROMs, etc. I would love to do the same with my passwords, but I don't think I would feel comfortable doing it with such sensitive data.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 1 month ago (2 children)

    A viable concern if you wanted to put it public-facing. If you only care about syncing when you're home, though, you should be able to host it perfectly fine just not giving any pathways in from the outside world.

    If you wanted to use the Android application, you would have to learn about TLS certificates anyway, because it doesn't work without HTTPS.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 18 points 1 month ago

    Heh, I'm looking at you to those people that looked at me weird because I told them I was good with Keepass!

  • source
  • [–] 5 points 1 month ago (1 child)

    Side note: I just tried switching to KeePassXC and it seems pretty fine, except for one caveat. If you installed your browser (probs FF or Librewolf) through flatpak or snap on Linux, the browser extension will not work.

    I had to change to the non-Flatpak ver of Librewolf on my Fedora PC, which sucked a little lol 😅

  • source
  • hideshow 1 child comment
  • [–] 5 points 1 month ago

    wow, setting up vaultwarden quadlet to work with my selfhosted OIDC sso was stupid easy. Migrating my bitwarden setup to it took no time at all. The extra step was setting up some extra pocketid passkeys to be stored on non-vaultwarden hosted systems (ie. google) to prevent myself from being locked out in case vaultwarden crashes (which probably was a good idea to do regardless). Just need to add the data volume to my regular backup.

  • source
  • [–] 8 points 1 month ago

    I pay for their product and its totally worth. It was $10 for the longest time and much like everything in the last few years has increased price to what it is actually worth. To be honest $20 a year is still stupid cheap and worth it to keep them developing the product. Bitwarden is also one of the few password managers that hasn't had a user data breach.

  • source
  • [–] 7 points 1 month ago (2 children)

    There is no way I'm self hosting something this important... So now I'm not sure what to do actually.

  • source
  • hideshow 2 child comments
  • [–] 10 points 1 month ago

    That's why I'm just using KeePass. It's just an encrypted file that you can store on whatever storage you want and sync with existing solutions like Syncthing etc.

    Yes it's a bit finicky when you edit the file on multiple devices before they've synced but it works very well for me..

  • source
  • parent
  • [–] 2 points 1 month ago*

    If self hosting is not an option. Ideas that come to mind:

    Evaluate what it is worth to you and maybe pay for it, if they offer enough worth to you and it is affordable.

    Then there are people who host it and provide it to others. Together with other apps, as a suite. Maybe that's an option. But I suppose, donating or paying is expected here, too.

    Or switch to another solution. Preferably one with an import feature.

  • source
  • parent
  • [–] 12 points 1 month ago* (4 children)

    It is effectively going closed source

  • source
  • hideshow 4 child comments
  • [–] -2 points 1 month ago (3 children)
  • [–] 16 points 1 month ago* (2 children)

    They don't make any money off of the open source version. It is just a matter of the before they "discontinue" the open source version and move to source available.

    If you have any doubts just look at Redis, Vagrant or Terraform

  • source
  • parent
  • hideshow 2 child comments
  • load more comments
    view more: next ›
    133 comments in c/technology@lemmy.world view that post
    24 comments in c/linux@programming.dev view that post
    9 comments in c/linux@lemmy.world view that post
    7 comments in c/news@lemmy.linuxuserspace.show view that post
    4 comments in c/bitwarden@discuss.tchncs.de view that post
    1 comment in c/LinuxNews@lemmy.world view that post