I have been using Bitwarden for around 7~ years. Subscription for this long too, at 10USD p/year. I will be switching due to lack of transparency, and would love to hear others thoughts on this.
The linked article goes into further detail, but here is a small summary that very much concern me / are sus:
- that 10USD per year has gone up quietly . I just checked and I have no email telling me it’s increased. It renews in like 2 months, so this is good timing for me
- Originally Bitwarden had values as apart of the acronym “GRIT”. Gratitude, Responsibility, Inclusion, and Transparency. They have changed the last two words to “Innovation, Trust”
- There is now a new CEO, this was not announced and the only reason people outside of Bitwarden know is that someone saw this change on LinkedIn
- The free tier momentarily disappeared from their product page for about a month (april14-may14). People were likely still able to make free accounts during this period. Bitwarden says it was a marketing mistake
The price hike is one thing, but for me the acronym change is most concerning, which is why I will be looking at another password manger (probably keepassxc)
if you’re into self-hosting i’ve been using vaultwarden for a while now. it’s an open-source implementation of the Bitwarden server
hello, quit using centralized services
Yep seems to be the way 🙏
I ran away from Bitwarden a few weeks ago due to other controversies and started using GNOME Secrets and KeePassDX. I couldn’t be happier, it’s slightly less convenient but I’m glad I did that.
I’ve asked this before but does any of this enshittification affect vaultwarden?
Even if it doesn’t affect it directly Vaultwarden is strongly linked to Bitwarden, for example I think you’re using official clients on your devices, Vaultwarden is not self sustainable (for now)
None of the above effects vaultwarden (how could it?), but it does raise concerns about long term FLOSS-friendlyness. I got bit by the sudden price increase earlier this year and decided that is the 1 year warning to migrate to either self hosted vaultwarden or something else. I move slow, so need some time anyway.
Well since most if not all use the Bitwarden client they could lock that down. Which would suck.
The GPL3 clients? They can relicense and stop developing those, but we would still have them in their current state.
I think in the worst case they fork the client as well.
you should get a notice no later than 2 weeks before the actual renewal
Yea this is what has likely happened to me, just haven’t got the email about it. Then I was thinking: If I never heard any news about the price hike (which I didn’t) it would be good if I got an actual email from Bitwarden - perhaps when they decided the price would be higher, therefore I could actually choose to stay with them or have time to research other options
I have switched to aliasvault.net myself ; which works better anyways.
Sure, Go for it. I’ve been using KeePass for a long time now and I am very satisfied with it. Aside from the security and privacy (Which you know is BEST out there), It comes with many customizations too. I used to use BitWarden but now I use KeePass.
Can keepass store files?
Yes, you can add multiple files to an entry.
Great, then I will probably switch to that then.
Great to hear. One thing I liked about Bitwarden is that you change choose Aegon2id and its KDF iterations, etc. Is that standard? Can you do that in keepass?
The CEO apparently is a big private equity guy, and those bloodsucking ticks only know how to do one thing: Suck every last drop of money and goodwill from the company and its customers as quickly as possible.
Breaks my heart, I’ve been a massive Bitwarden advocate for years. Been happily paying for the individual paid plan. I’m now working on setting up KeyPassXC with syncthing.
Does KeyPassXC have passkey and TOTP support?
Both, yes
Yes. For passkey, you need to install the browser plugin and enable support in the preferences.
Do you know if I can get KeePass working on both PC and Android in sync with Syncthing?
I have been using it that way for years and it works well (for this scenario no problem). Only recently I switched from Syncthing to using mounted SMB share. I switched partly because of the Syncthing for Android maintainer switch (though I still think its safe) and because Syncthing sometimes didn’t sync on my Iodé custom rom and I got tired of having to open the app to sync.
I used to do that few years ago. It worked very well. Never had any issues. I’ve used KeePassDX on Android and KeePassXC on Linux.
This is the email I received at the begining of the year when there were multiple articles about the price increase.
I think it’s important to note that you may have missed or deleted the email, or it potentially could have gone to your junk folder, but they did send out emails letting people know.
I got the same email with 25% discount for this year. Can’t argue with lack of transparency on that and it’s a bit unreasonable to expect no price increases ever
Yeah. If you’re using the services that might required a paid subscription, it’s not out of the realm of possibilities for there to be a price increase eventually.
I’m not discounting that there’s the potential for a pivot to less transparency and auditability going forward, I just wanted to point out that this wasn’t done with no warning.
I don’t trust the company that bought them. Private equity is almost always a bad time for consumers/users.
Don’t be evil!!
If you or someone you trust happen to have a home server, just install Vaultwarden, which is the community fork of Bitwarden without any fees, shady stuff or reliance on Bitwarden infrastructure.
I know this options exists, but honestly I don’t think I have reliable enough infrastructure. It’s hardly ever offline, but my backup game is super weak, and I have had to rebuild from scratch once in the past three years.
What happens if I fuck up again and have to rebuild? Just feels like a massive potential failure point.
Bitwarden app is fully compatible with Vaultwarden and stores copies of all your passwords for offline access, so as long as you have access to the app somewhere, you’ll have them.
Also, Bitwarden can export your passwords as a file in several formats, readable by Bitwarden, KeePassXC etc. You can have that stored somewhere safe.
Your backup is all your clients. Every client has a blob. If you loose it export and then import. That is if everything else fails.
How do you use it on mobile? I didn’t find an app version
Use the Bitwarden app, it is compatible. Under the email field, choose a custom server and set it up there.
You use the normal Bitwarden app and point it to your server
If you look real close side by side there is a subtle difference…
Suuuper easy to stand up, took me about 20 minutes to get it up and running
Well, when u say supereasy to set up, i don’t know. The need for reverse proxy was driving me nuts. For someone that doesn’t expose anything to the outside world, the need for a reverse proxy is overkill in my opinion. But i did hive up fairly easily, so i’ll have another go in the future when i have time. For now my Syncthing + Keepass setup will have to do but i do find its not 100% robust. If i have keepass open on both mobile and laptop, i’m at risk of loosing changes. If the change is made on one device and i close after change, i won’t see the change until i close keepass on the other device. But by then syncthing thinks that the latter is the most recent change and marks the file of first device as conflict file. So the chsnge is not lost but its not in the most “recent” version of the database.
If you have several, it really is convenient to set up an internal reverse proxy for all your internal-only services. One place to set up let’s encrypt and set up subdomains or different paths for the different services. No need for URLs with different port numbers or IP addresses.
It got bought by a company owned by Vista Equity partners, a private equity firm.
The loss of values happened at Citrix when it was Vought by Vista. They installed Tom Krauseasthe CEO to gut it from the inside out.
Everybody should have an exit plan ready to be able to leave bitwarden
Bitwarden got bought by private equity?
https://techcrunch.com/2022/09/06/open-source-password-manager-bitwarden-raises-100m/
No, they took $100 million in VC. Never a good sign imho.
Lol… From Transparency to “Just Trust Me Bro”.
I know right. Even in an Enterprise environment why would trust be a better word to represent your values over transparency
I will conti UE to self-host Vaultwarden and use the BitWarden clients until I feel the clients are not trustworthy or they are forked.
Yeah, I switched to KeePass for the same reason. The only way I trust software is if they’ll show me the code, and the only reason to replace “transparency” with “trust” IMHO is because they want to go closed source. Innovation also tends to just mean 'we’re going to be charging you for features that used to be free ’
It much work to get all the names and passwords and stuff from BW moved over to keepass?
Not really, just had to install KeePass on my computer and export my bitwarden passwords BW makes that easy to do) and import them to KeePass. I haven’t set up the browser extension yet, as at a glance it says it doesn’t work with browsers installed with flatpak and that’s how I have LibreWolf installed. Setting up syncthing was also pretty straightforward.
Sweet. Thanks.
I never use browser extension for my pwm anyway. Just the pwm apk on my phone and thats about it. Seems less likely for any shenanigans to happen that way.
Whoa no flatpak support is a problem. Thanks for the heads up.
I tested this a few weeks ago, but one thing I struggled with was having custom fields imported. Don’t know if I somehow did something wrong, but while the export data had them as expected, KeePassXC just didn’t import it all? The standard Notes did get imported, but none of my custom fields.
