Comment by satysin | Hacker News Reader

Comment by satysin | Hacker News Reader

Parent Full thread

> I'm ashamed to admit that one thing that might keep me on Chrome is the trove of passwords in my sync'd up account.

I was the same until a few days ago when I finally took the time to switch to a real password manager. A HN'er recommended Bitwarden[0] and I have to say it was pretty painless and I am much happier knowing my passwords are with a third party (not that I have any real issue with Google but I did worry about having all my eggs in one basket as such).

I haven't paid for Bitwarden yet but I plan to providing it doesn't have a massive failure in the next couple of weeks. Looks like it will easily be worth the $10/year though.

Another added bonus is that their Android app is very decent as well and so far has worked with all my apps as well which is handy and not something I had thought much about in the past. Makes life that little bit easier although I don't have to enter app passwords much in Android it is nice to have the option now.

But back to Firefox - I checked out Nightly when it hit 57 a while back and was extremely impressed. It felt like a whole new browser. Not sure if I will switch from Chrome just yet but I am excited for the future of Firefox again.

[0]https://bitwarden.com

I would like to switch to Bitwarden, but I don't know how I can assure I can trust them with all my passwords. Are any of the founders well-known security experts? Has the service been recommended by respected security researchers?

I am not a security expert, so I cannot assert their trustworthiness myself. I know that you can run your own server. But even then, without auditing the code, configuring a firewall, and checking network logs, I cannot assure the server and the clients do not call home. And all of those solutions are both prohibitively time-consuming and way out of my area of expertise.

How did you decide Bitwarden was trustworthy? How can I stop worrying and give them my passwords already?

I use KeePass as my password manager, it doesn't sync automatically across all my devices, I occasionaly transfer my keys database to my phone.

You could always upload your encrypted key database to dropbox, and keep your private key on your phone, on your computer, or on a USB stick, if you want automatic sync.

Syncthing + KeePass works very well for cross device peer-to-peer syncing.

Just make sure to configure Syncthing to ignore KeePass lockfiles.

It has no unit tests.

I didn't pick Bitwarden right away. The comment that mentioned it prompted me to research password managers in general. I looked at primarily online (1Password, LastPass, Bitwarden, etc) and offline desktop client ones (Keepass).

I do prefer the idea of using something like Keepass and not relying on a service but I found it rather frustrating to manage between my multiple devices. I knew if I were to actually make use of a password manager it needed to be a smooth experience because otherwise I would just return to using Chrome's built in one out of laziness.

After researching the main online managers I decided to go with Bitwarden. It is open source so if it does do something dodgy I would hope it is found and reported. I do not have the time nor expertise to audit all of the code myself so I have to put some trust in others.

Plus while it would be a real pain in the ass if accounts were compromised due to the developer being an asshole/idiot it wouldn't destroy my life. I have a strong password on my primary email account (not stored in Bitwarden) along with 2FA. Most of the logins stored in Bitwarden are for things like Hacker News, Reddit, Slack (personal not work), etc. Randomly generated 18+ character strings that are a pain to enter manually, especially on a phone.

FYI: KeePass plus Syncthing works great for me for cross-device password databases.

Will have to check this out. Not used Syncthing before. Thanks!

No problem!

As I mentioned in my other comment, the only gotcha is to make sure you set up your syncthing ignore file to ignore the KeePass database lockfile.

I like bitwarden at a high level, but there are tons of things that feel extremely janky with it.

Also for some reason, Firefox keeps complaining that bitwarden is freezing its UI thread.

I'm not in love with LastPass so am curious as to what you don't like about Bitwarden?

It seems to lag on Firefox. Multiple times I've gotten notifications from Firefox Dev that Bitwarden is causing my page to not render (which was true).

Can't change hotkey for auto-fill login form in Firefox.

No Support for standard notes (yet I guess).

UI renders very slowly on FF and has tons of strange inconsistencies.

It definitely has the FEEL of a somewhat younger open source project while LastPass was much more refined.

I'm debating if I should bother learning C# for the sole purpose of trying to fix some of these issues, because it is maddening enough where I actually use Chrome when i do things that require logins.

Thanks. Will probably wait for LastPass to release the firefox plugin for 57 then. Will check Bitwarden again in a few months.

Just to give a second opinion, I have not had any of the issues NikolaeVarius mentioned.

Well that is not quite true actually. In Firefox you can't change the hotkeys but that is more of a Firefox issue as you can't change the hotkeys for any extension. You can in Chrome though.

BitWarden is new to me, thanks for recommending it! Always good to see new open-source password managers. There are already enough proprietary ones.

Reply on news.ycombinator.com