Bitwarden introduced a non-free dependency to their clients. The Bitwarden CTO tried to frame this as a bug but his explanation does not really make it any less concerning.

Perhaps it is time for alternative Bitwarden-compatible clients. An open source client that’s not based on Electron would be nice. Or move to something else entirely? Are there any other client-server open source password managers?

  • CommanderShepard@lemmy.worldEnglish
    9·
    3 hours ago

    Bitwarden is a very convenient password manager for an average computer user. It’s very straightforward and easy to use.

    I can see some bias here of the people who say “o, just use KeePass and sync the database over some cloud provider”. What of there conflicts? How do they deal with them? I can figure it our but most people I know, won’t.

    Even the password manager concept is a complicated concept to grasp for many people (that I know). And I can recommend them Bitwarden because it’s relatively easy, but KeePass with sync? Maybe, if I commit to actively help them with it.

    P.S. I’ve convinced several people to try out Linux, and they are willing to learn it, but even if they just need to use a browser, they struggle sometimes. I can’t imagine them syncing the KeePass database.

    • overload@sopuli.xyzEnglish
      1·
      33 minutes ago

      Have got two of my family members onto bitwarden and even that is a lot for the tech-illiterate. Couldn’t imagine Keepass+syncthing.

      Ultimately, bitwarden is better than using hunter12 for everything like how they were.

  • TrippyHippyDan@lemmy.worldEnglish
    12·
    4 hours ago

    This plus the syncthing announcement about the Android client ending support is a bad day indeed. I was just thinking about self hosting instead of KeePass + SyncThing now it’s back to the drawing board once it stops working 😵‍💫

    • ShortN0te@lemmy.mlEnglish
      1·
      41 seconds ago

      The syncthing fork on f-droid is still an option. An issue has been opened on the github repo. Lets see what will happen with the fork

    • ancoraunamoka@lemmy.dbzer0.comEnglish
      3·
      56 minutes ago

      Or don’t, because they are going to kill it eventually.

      There are less convenient possibilities, like pass and keepass, even a markdown file pgp encrypted and git. Yes, less convenient, but guaranteed to work in 5,10,20+ years

  • 4shtonButcher@discuss.tchncs.deEnglish
    872·
    14 hours ago

    Can’t we ever have software that just keeps working? Password managers are like the new RSS readers.

    1. search around for a good one
    2. find a nice one and start using it
    3. they add stuff you didn’t want and slowly make it worse
    4. they’re bought up/ abandoned/ otherwise become unviable

    Back to 1)

      • jasep@lemmy.worldEnglish
        55·
        13 hours ago

        The downside to Keepass is it is not self hosted, as in it’s designed to run locally per device. Yes, you can put the database file on a network and have multiple clients from different operating systems access the database, but you will end up with collisions and database issues. Ask me how I know.

        Running cross platform Keepass (and it’s various forks) is absolutely doable, but it is not as seemless as BitWarden. I’m running self hosted VaultWarden and I’m hoping to run it for a long time as it’s much easier than Keepass.

        • PureTryOut@lemmy.kde.socialEnglish
          13·
          12 hours ago

          Eh, I have used KeepassXC over multiple machines using NextCloud to sync it for years now and have never had any conflict.

          • somenonewho@feddit.orgEnglish
            4·
            10 hours ago

            This. I have been running it the same way for some time now. Even if you change something on one machine and something else on another nextcloud will just happily inform you of the conflict and then you can open both databases and cherry pick. Never had corruption issues.

        • thayerw@lemmy.caEnglish
          17·
          13 hours ago

          For what it’s worth, I only ever had sync issues when sharing a database between devices with transient connectivity. Once I added an always-on instance of Syncthing into the mix, collisions were a thing of the past.

          We’ve been using KeePass trouble-free for many years now, sharing a single database across more than 6 devices, with frequent use and modification.

    • catloaf@lemm.eeEnglish
      53·
      13 hours ago

      Sure, you’re welcome to keep using the version you like, or to write or maintain one on your own. Or pay someone for their labor to do it for you.

      But if you use something made out of someone’s good will, don’t rely on it for anything critical.

      • gdog05@lemmy.worldEnglish
        4·
        10 hours ago

        Money isn’t necessarily a factor. I’ve paid for many services that have made business or operating changes to the point of needing to separate and then there’s WinZip on the other side of things.

  • just_another_person@lemmy.worldEnglish
    2914·
    13 hours ago

    BitWarden already has lots of clients. There’s also VaultWarden for the server if you want.

    This is being blown a bit out of proportion though. All they are saying is the official SDK may have some non-free components going forward. So what? It’s a private company, they can do what they want. Or the community can just fork it and move forward with a free one if they want, but it’s just not going to be in the official BitWarden clients. Hardly news or a big deal.

    • thayerw@lemmy.caEnglish
      362·
      13 hours ago

      I can only speak for myself, but I would never trust opaque, proprietary software to manage my credentials, especially in a networked environment. For me, that’s a total showstopper.

      I’ve never had need to use Bitwarden or Vaultwarden as I’ve always been happy with KeePass, but this news would definitely have me choosing an alternative.

      • Lucy :3@feddit.orgEnglish
        517·
        10 hours ago

        I always found it weird for people to recommend BitWarden … it just FELT like a company that’ll go completely off track sooner or later. And it did. Oh wonder. KeePass ftw!

        • Darorad@lemmy.worldEnglish
          3·
          6 hours ago

          Eh, there’s a completely independent reimplementation of the server, so I’d be surprised if the same doesn’t happen for the apps if there’s a real issue that comes up

        • Lemmchen@feddit.orgEnglish
          6·
          8 hours ago

          completely off track

          Let’s see how things evolve before declaring things like that.

    • 486@lemmy.worldOPEnglish
      21·
      13 hours ago

      BitWarden already has lots of clients.

      Does it? I’d be very much interested to know. I’ve been looking for other clients before, because I didn’t like the sluggishness of the Electron client, but couldn’t find any usable clients at all. There are some projects on Github, none of which seemed to be in a usable state. Perhaps I have been missing something.

      This is being blown a bit out of proportion though. All they are saying is the official SDK may have some non-free components going forward. So what? It’s a private company, they can do what they want. Or the community can just fork it and move forward with a free one if they want, but it’s just not going to be in the official BitWarden clients. Hardly news or a big deal.

      Nobody said that they can’t do that (although people rightfully questioned that their changes are indeed comatible with the GPLv3). I very much disagree that this isn’t a big deal, though.