In the latest episode of "they will always sell you out" - they sold you out! Who would've thought.

Hoping for a good alternative client to appear, the writing is on the wall. Vaultwarden can't exist without "leeching" off of Bitwarden.

top 99 comments

sorted by: hot top controversial new old
[–] 253 points 5 months ago (85 children)

Jesus, I'm tired of switching password managers.

  • source
  • hideshow 85 child comments
  • [–] 80 points 5 months ago (30 children)

    KeePassXC + KeePassDX is probably the best option, with the downside of no way to sync easily (syncthing is probably the best option there)

    I might switch back at some point, been getting frustrated with the bitwarden extension performance always being so poor.

  • source
  • parent
  • hideshow 30 child comments
  • [–] [S] 16 points 5 months ago (6 children)

    Merge conflicts are a concern for KeePass, especially for those that don’t want to resolve them. Sync is difficult. AFAIK this is a very common issue with Syncthing setups.

    Also, the portability from Bitwarden to KP leaves a bit to be desired, though that’s probably 90% on BW.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 8 points 5 months ago (2 children)

    I've been using KeePass with Syncthing for 5+ years now and I think I've only had a sync issue once in all this time.

    Granted I do make sure I only use the database on one device at a time (so not making edits on desktop and my phone at the same time) and I'm using XC and DX clients not the OG KeePass program.

    I'm curious what is causing sync issues to make it "common", I use my db every day.

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 3 points 5 months ago* (1 child)

    Yeah, it’s not an uncommon use case to accidentally or even intentionally edit the database on two online devices - I do it all the time when I want a new login to be used on my laptop right after I signed up for some new website on my PC, and the laptop just happens to have an “unpushed” change from last evening, or I edit the new login’s metadata, or whatever.

    With this, I’d have to keep a mental model of the versioning of each database and avoid even touching my phone like the plague if KeePass is open on my computer.

    It’s not that big of a deal, it’ll probably be a problem once every few months, but it’s annoying to keep track of and worth talking about.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 5 months ago

    Hmm, I'll have to play around with it a bit more then to see if I can trigger it.

    My only gripe is the browser autofill. Sometimes it triggers correctly and sometimes it doesn't. I've noticed if I let KeePass add in a new login itself after I've manually entered it then it's much more receptive to suggesting that login correctly going forward. So I'm tempted to create a brand new database and login everything manually so KeePass will create the database entries itself to fix my gripe.

  • source
  • parent
  • [–] 2 points 5 months ago

    Merge conflicts are a concern for KeePass

    It's really not that much of an issue. I sync my database between several devices, some of which are only used occasionally. Rarely do I ever have a merge conflict.

    If you're editing the database on multiple devices before they have a chance to sync with each other, maybe stop doing that. That's what causes merge issues.

  • source
  • parent
  • [–] 19 points 5 months ago (8 children)

    Sync however you want. Syncthing, Nextcloud, Dropbox, Gdrive etc.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 15 points 5 months ago (7 children)

    Syncthing is the way to leave Google Drive, etc.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 10 points 5 months ago (3 children)

    I use Nextcloud myself, but if people don't want to host a server or fuck with syncthing, they can sync it however they want as long as they use a strong enough master password/phrase (which they should be anyway.).

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 5 months ago (2 children)

    Oh, well, I'm talking about not having to password-lock and unlock your stuff constantly. For long-term storage, sure, that's fine; anything else would be way too tedious, though, no? I guess it depends on your use case and if you could locally automate the locking and unlocking or something.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 5 months ago (1 child)

    I'm not sure what you mean. On my computer, I have to unlock the database every so often (you can set how long) with my master password. On my phone I unlock it with my fingerprint. The method of syncing the database is irrelevant.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 5 months ago (2 children)

    Is there a proper syncthing android client now, after the official android client was discontinued?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 5 months ago

    Solid question; there are only third-party apps. A recent discussion in !syncthing@lemmy.ml led me to most recently adopt BasicSync, which is incredibly low-profile and is probably the closest thing we can get to it.

    However... if you want to get as pure as possible, you can apparently run Syncthing's Linux version directly in Termux on Android without the need for a dedicated Android app. There are also entire alternatives to Syncthing like syncspirit (which can also be run through Termux and which I'm considering trying as well).

  • source
  • parent
  • [–] 3 points 5 months ago (6 children)

    I use KeePass with KeeAnywhere. KeePass can natively sync over network share, FTP, or WebDav. With plugins, it can sync over SSH, FTPS, Amazon S3 compatible buckets (including open source compatible versions you host yourself), Azure, Box, Dropbox, Google Drive, OneDrive, and more.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 2 points 5 months ago (5 children)

    KeeAnywhere

    That's a neat one, although it doesn't look like KeePass supports passkeys yet, at least I don't see it in the feature list.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 5 months ago (4 children)

    Are you trying to use a passkey to unlock the database or for authenticating with other websites? KeePass can natively do TOTP. There's also plugins to do that. Including one that allows KeePass to be a native Windows 11 PassKey Provider.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 5 months ago (3 children)

    For other websites, if I search for 'passkey' on the KeePass website feature list nothing comes up. Plugins in a password manager sketch me out a bit tbh lol

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 5 months ago (2 children)

    See here: https://keepass.info/help/base/placeholders.html#otp Also worth pointing out that most plugins are open source. You can read the source and compile them yourself, if you'd like.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 5 months ago* (1 child)

    This is for OTP not Passkeys it seems?

    How do you go about loading plugins on the Android version for sync with your setup?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 5 months ago

    I don't usually use plugins on the Android version. I don't use the Android much, actually, just due to my use patterns. There's actually several different KeePass Android apps. KeePass is open source and the database format is documented. So anybody can make a program that uses the same database. The one I use is Keepass2Android, seems to be one of the popular ones. Looks like it also can natively generate TOTP. Apparently it has some sort of plugin system, but I've never needed to use it because it can pull my password database out of my Google Drive natively.

    You need to specify what kind of passkey to be more specific. There's several different algorithms. HOTP and TOTP are very widely used. It's what Google Authenticator and the like use. If you have something very proprietary, like the old RSA keys, that probably can't be emulated by any software. Or they could, but you can't get the secret to be able to do that.

  • source
  • parent
  • [–] 1 point 5 months ago (2 children)

    XC is really nice, but the devs are kinda dicks about not integrating some sort of syncing option, instead telling everyone who asks to "just point it to a local folder and use <insert sync tool of your choice> to keep that folder updated." Which isn't terrible advice, but some of us don't have that option on managed devices.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 5 months ago (1 child)

    I ended up using Keepass2Android and just pointing it at my webdav server, it seems to work pretty well!

    On desktop it's already taken care of since I put the DB in my folders that already sync via Syncthing.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 31 points 5 months ago (42 children)

    KeePass isn't going anywhere. They're also dragging their feet on passkey support, so you might go with KeepassXC.

  • source
  • parent
  • hideshow 42 child comments
  • [–] 10 points 5 months ago (19 children)

    They also don't effectively allow collaboration though, which is my cheif reason for using a cloud hosted password manager.

  • source
  • parent
  • hideshow 19 child comments
  • [–] 5 points 5 months ago (9 children)

    What is "collaboration" in this context?

  • source
  • parent
  • hideshow 9 child comments
  • [–] 6 points 5 months ago (6 children)

    Sharing passwords between groups of people so everyone always has the up to date version. Not breaking the world if two people try to modify the same entry as some file syncing solutions do.

  • source
  • parent
  • hideshow 6 child comments
  • [–] -1 points 5 months ago (5 children)

    Hmm, interesting, though isn't that a fault of the organization not having an account-linking system so that each person could have their own credentials but can still access the unified content? This workaround seems... flimsy, unless I'm not picturing a legit scenario in which no other method is as good, or something.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 3 points 5 months ago (2 children)

    It's the fault of my family organization or every company we use that my parent's bank, Google, phone, laptop, etc don't allow more than one set of credentials to access the same thing?
    It's not just that we need to be able to share credentials the once a blue moon I need to help them by logging into their account?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 5 months ago* (1 child)

    Wait, I don't understand. Why do you need to do so much account-sharing? I never had half of that... and if connecting is just once in a blue moon, then it shouldn't need something like group creds anyway, right?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 5 months ago

    I have credentials shared with my parents passwords managers (and others) so when they ask for help with a service I can do it remotely for the services they want help with, but not their whole password manager.

    I share company passwords in an organization so I can manage user accounts for things a user needs into but doesn't want to manage (I can change the Snowflake password but they can still login).

    I share common passwords with everyone in the house (gate codes, door codes, etc). Then when they need to change, no one is bothered or needs to take action. Also, then anyone can change it and everyone who should have the new one, does.

  • source
  • parent
  • [–] 0 points 5 months ago (4 children)

    Sure they do. Multiple people can have a file open at the same time. I use it for exactly this every day at work.

    With KeePassXC, that is. I don't know if other flavors have different support. I use XC primarily for the browser extension.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 5 months ago (3 children)

    And you can both modify the same things without causing horrible conflict issues? And you can share only parts of your vault with someone rather than having entirely different vaults you have to switch between? I'm assuming you mean putting the file somewhere like Google Drive, and you can access it offline even if you can't edit it offline? For feature parity with Bitwarden, obviously ideally one could edit any time and it would resolve problems when it came back online if there were any but Bitwarden doesn't allow this.

  • source
  • parent
  • hideshow 3 child comments
  • [–] -1 points 5 months ago (2 children)

    Yes, no conflicts. I don't know if you can only share part of vault; I just created a separate one for a separate team.

    I wouldn't put it in Google Drive or anything like that. The separate sync logic will definitely cause conflicts.

    I'm not worried about having access if I'm offline, because if I'm offline I'm not going to be able to log into anything anyway.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 5 months ago* (1 child)

    I guess a laptop, server, IoT device, or WiFi connection when your main device doesn't have internet is out of scope for you?
    Like fixing my laptop and not wanting to type the new password into my phone instead of copy/paste, sync when online?
    And how are you sharing a file, to multiple people anywhere in the world realtime ish, without a cloud service you or someone else hosts? Doesn't that necessitate some syncronization logic?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 5 months ago (3 children)

    KeePass isn't meant to be used that way. It's a personal password manager. Always has been.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 5 months ago (2 children)

    Valid. But it's also valid that it now doesn't work for me or anyone who also helps manage other people's lives or works on a team ¯_(ツ)_/¯

  • source
  • parent
  • hideshow 2 child comments
  • [–] 19 points 5 months ago (8 children)

    @slateWasn't there some commotion a few weeks about KeepassXC and vibe coding?@RonnyZittledong

  • source
  • parent
  • hideshow 8 child comments
  • [–] 33 points 5 months ago* (last edited 5 months ago) (6 children)

    Yeah, there was. It was forked because of that, actually: https://codeberg.org/ChiPass

  • source
  • parent
  • hideshow 6 child comments
  • [–] -3 points 5 months ago* (12 children)

    They’re also dragging their feet on passkey support

    As... they... should, forever.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 16 points 5 months ago (11 children)

    Two articles behind a paywall, one that won’t load, and another article that says the big problem with passkeys is…people are unfamiliar with them.

    If anyone tells you that Passkeys are bad, they’re a liar. Way more safe than passwords, full stop.

    Just don’t let Microsoft or Apple tie them to your device. You don’t have to do that.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 6 points 5 months ago (6 children)

    Are you calling me a liar? That's pretty weird; it's not like I'm telling you to stick to passwords while I move to passkeys. With that said, though, get Bypass Paywalls Clean (Mozilla-only, as far as I know) and you'll never see another paywall again. I forgot about having that.

    Just don’t let Microsoft or Apple tie them to your device. You don’t have to do that.

    The problem is that this is where it's eventually going to lead to.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 3 points 5 months ago (1 child)

    At the very least you're misguided or don't know what you're talking about. Passkeys are not vendor locked in and of themselves.

    You can make the same argument against password managers because most iPhone users that use them, use Apple's one.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 6 points 5 months ago* (last edited 5 months ago)

    They will almost certainly lead to vendor lock in. Why do you think they won't? Apple's password manager is definitely an example of vendor lock in. Many others have a simple to use export feature to CSV or something that others can understand

    Edit: it could be that you don't know what the WebAuthn/FIDO2 specification says or we understand it differently? Do you know how the attestation mechanism works? That ties the key to a device or software authenticator (the software authenticator is likely going to tie it to the device somehow, possibly even via a TEE).

  • source
  • parent
  • [–] 2 points 5 months ago (3 children)

    Not really, Vaultwarden/bitwa4den offer passkey support. When I log into a service a popup shows on my extension, I click it and I'm in. It's not gonna lead to device locking if you don't want to...

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 5 months ago (2 children)

    except when the wide populace starts accepting it being device locked, and your opinion does not matter anymore to those making the decisions

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 5 months ago* (1 child)

    No one of the people I know that use passkeys use it from the phone, either they use a password manager, they have passwords on a physical note, on an excel file in the desktop, a physical yubikey, or bitwarden like me. That's everyone I physically know including every family member, friends and work people.

    I know it's anecdotal, but you present your "wide populace" fact without giving sources too, and since I know no one that uses phone based passkeys, even if my experience is anecdotal, I say sus. Check your bias.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 5 months ago

    but you present your "wide populace" fact without giving sources too

    my statement is not that many people are using passkeys today. but that if there comes a time when many people will use passkeys, they will be as careless and convenient as they are with everything else today, accepting any restrictions, because "why would anyone not use Google Passkeys? It's the most convenient thing!".

    and not only that. I was talking about device locking but that's only part of the problem. isn't it that passkey receiving services can identify the client software, and decide they will only accept passkeys from x and y clients?

  • source
  • parent
  • [–] 3 points 5 months ago (3 children)

    There is no full stop there... A password that is sufficiently long will never be cracked no matter the hashing algorithm in use. Passwords are easily transferrable and can be communicated to a third party in the event of an emergency. They also provide tunable security, where you can trade off security for convenience if you want.

    Some (not all, I know) passkeys are tied to a device. Stolen device means stolen passkey, and it's potentially very difficult to recover from that. Passkeys are also locked to a certain standard, passwords have no such restrictions.

    Tbh I don't understand the move for passkeys replacing passwords. They should become the second factor when a user wants additional security. They're perfect for that niche.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 5 months ago

    Passkeys provide a secure way to authenticate while also being convenient. With the tradeoffs you mentioned.

    I don’t like the push for only allowing some vendors to issue keys and to not allowing exporting and backups. And password should still be an option.

  • source
  • parent
  • [–] 1 point 5 months ago (1 child)

    Password can also very easily be stolen during phishing, while passkeys are phishing resistant.

    And while a hardware passkeys can be stole and used, those who steal them will still need the pin to use them, and the two major hardware passkeys options now (Yubico and Token2) both have some pin brute force protection in their firmware to slow someone down long enough for an account to be secured another way.

    As for passkeys on phones, they require the pin or biometric used to unlock the phones to be used.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 5 months ago*

    "Difficult to recover from" was referencing setting all of your accounts back up. I should have also included "lost" and "broken" to make that more obvious. Many hardware (most? all?) passkeys do not allow for backup and restore.

    But I do see an issue with stolen hardware passkeys being used for access too if they're a primary factor. With the mitigations you mentioned hopefully holding up.

  • source
  • parent
  • [–] 6 points 5 months ago (6 children)

    I just got Bit warden this year! Gah. Where are we jumping?

  • source
  • parent
  • hideshow 6 child comments
  • [–] 5 points 5 months ago (3 children)
  • [–] 1 point 5 months ago (2 children)

    Vaultwarden relies on Bitwarden existing.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 5 months ago (2 children)

    Took me like 5 minutes to move back to KeepassXC.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 100 points 5 months ago

    That’s troubling, I don’t like what this portends.

    The new CEOs background especially suggests they’re spiffing up the company for a later sellout, why else would they pick a merger specialist for the role?

  • source
  • [–] 49 points 5 months ago* (last edited 5 months ago) (11 children)

    This is why corporate promises can never be trusted, because a new CEO can change those promises on a whim.

    It's part of why despite being interested in Beeper, I never signed up for it because I had questions about if those privacy promises they made would be kept if they sold to a bigger company... which they eventually did.

    On the plus side Bitwarden already made an official open source self-hosted version, which can be forked and/or return to the community developed Vaultwarden roots.

    Meanwhile KeepassXC keeps on chugging along.

  • source
  • hideshow 11 child comments
  • [–] 10 points 5 months ago (10 children)

    FYI beeper is really just matrix with bridges. Once I realized that I set up my own and now I have the same functionalities as beeper, self hosted, with a choice of clients.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 3 points 5 months ago

    With one difference. After merging with text.com they switched to a model with on-device bridges so that the decryption on their servers is no longer needed. Ofc it’s similar if the matrix instance and the bridges run on the own server.

  • source
  • parent
  • [–] 2 points 5 months ago (8 children)

    Oh I was well aware at the time, but I had a lot of friends who still struggled with trying to use Matrix/Element so at the time I was seeking a simpler solution for them.

  • source
  • parent
  • hideshow 8 child comments
  • [+] -10 points 5 months ago* (7 children)

    How fucking stupid do you need to be to struggle with element do they struggle to use cups are they trying to do weird advanced features on an architecture I've never heard of with a compiler built themselves wtf

  • source
  • parent
  • hideshow 7 child comments
  • [–] 2 points 5 months ago (1 child)

    element was very buggy a few years ago. the new clients are just now starting to get feature parity, and in my experience calls are still quite unstable, requiring your server to have some specific additional setup (which most public registration instances don't have), besides that not a lot of clients have implemented yet MatrixRTC calls. even the client list on matrix.org is only showing whether a client supports the former calling system.

    so for the layman it's definitely not production ready yet. and even for new tech literate users some of the things are still challenging to figure out.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 5 months ago (4 children)

    Wow, usually people lose their shit and complain that Element is too complex and that me and the devs are being assholes asking them to use it... You know kind of like all the people here on the Fediverse who think we need to make it bigger and bring in everyone from everywhere and that the devs and users who defend them are awful for not focusing on user interface first and making it less confusing to choose a server...

    Anyway, thanks for being on team reasonable, because I'm with you on this 100%, but I can't change how little people want to learn anything sadly so I make compromises with people who cant or wont learn how to do things. It sucks, people really don't seem to understand that security and convenience are a balance, and every time people argue for shit to be easier they're actually arguing for everything to be less secure. You sacrifice security for convenience, every time, and the opposite happens because you can sacrifice convenience for increased security measures. Security has to be complex by nature to be effective, and the core of Matrix is being a secure, encrypted protocol, which they have already actually put a ton of work into making easier for fucking normies. Yet, it's never enough for people. Always screams of "It's too complex! I hate thinking!"

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 5 months ago (3 children)

    The buttons are in a different place oh god so much blood yes I resized the window what's your point

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 5 months ago* (2 children)

    lmao God I can feel the frustration rising in me just thinking about it. I know these are digital rather than physical objects... but do these people fail to have object permanence?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 5 months ago*

    I feel like there's a very real rejection of consciousness and self reflection I feel that as a strange person who doesn't always accommodate defaults too its really depressing in a very real sense they're rejecting personhood based on protest and and silicon valley propaganda of normalcy and frictionlessness

  • source
  • parent
  • [–] 2 points 5 months ago* (last edited 5 months ago)

    Not everyone is a tech nerd some of us just want our stuff to work stop asking us to be nerds too this is why everyone hates you fix it fix it fix it

  • source
  • parent
  • load more comments
    view more: next ›
    281 comments in c/technology@lemmy.world view that post
    30 comments in c/privacy@programming.dev view that post
    21 comments in c/bitwarden@discuss.tchncs.de view that post
    4 comments in c/hackernews@lemmy.bestiver.se view that post