My main concern is that the password is the only key that is needed to both log into the server and to decrypt the vault. There is no additional key that is completely offline, like 1password Secret Key (that is presumably stored in Keychain / Secure Enclave at rest). A password seems somewhat more easily stealable (with keyloggers or clipboard loggers etc).
I am not a security expert, but I know enough to be concerned :). I wish there was more discussion on the implications of this difference on security models.
2. Offline access.
Bitwarden does not like to work offline.
You can unlock and view the vault, but you cannot make any changes without active connection to the internet! And Bitwarden will show you a very generic error ("failed to fetch") if you try editing while offline, it won't give you any suggestion on what to do.
Moreover, apparently they will delete the local copy of the vault if internet connection is missing for 30 days: https://www.reddit.com/r/Bitwarden/comments/vtaqi0/comment/i.... That's just nuts if true. I should not rely on the Cloud to have access to the vault as stored locally as long as I have the password.
While there is a general fear about trusting The Cloud as the source of truth for accessing the passwords, this caused very tangible practical issues. I have actually run into needing Bitwarden while on the go. Also the CloudFlare IP that Bitwarden uses was somehow blocked by my provider for some time, and that broke Bitwarden completely (both the provider and Bitwarden neglected to do anything about the problem when contacted).
3. UX.
You get used to it, but it's simply not great.
Worst of all, the UI of the browser extension is prone to data loss. The Bitwarden popup resets the state every time it is unfocused. So imagine the scenario:
* I start creating a new entry and generate a password.
* I briefly dismiss the Bitwarden popup to paste the password into the website.
* I open Bitward popup again hoping to finish entering the data and save. But the entry is gone. I just need to hope that the generated password is still on the clipboard.
1password in contrast keeps full UI state and partially entered data even if the vault is locked in the interim.
The fact that you can't access your passwords when offline really blew my mind.
Also that one time when they randomly blocked my IP and wont do anything about it, wtf?! From then on I've started occasionally exporting the JSON file and keeping it somewhere safe, just in case. Like... I'm the person behind this account, I own the email.. I don't even ask you for a password or whatever! I'm asking you to unblock my IP. This shouldn't take more than 5 minutes!
I also want BitWarden to succeed, but does it want itself to succeed?
Yeah, the extension data loss issue is especially bad, I save often to avoid it (it's also a bit weird to create a profile for a new site instead of saving entered data)
1. Security.
Bitwarden's documentation on its security model is quite thin.
1password has a great write-up about how it works in detail: https://1passwordstatic.com/files/security/1password-white-p.... Corresponding doc for Bitwarden is much lighter on detail: https://bitwarden.com/help/bitwarden-security-white-paper/.
The security audits they list of https://bitwarden.com/help/is-bitwarden-audited/ are focused on the client software implementation bits, and make no judgement on the overall security model.
My main concern is that the password is the only key that is needed to both log into the server and to decrypt the vault. There is no additional key that is completely offline, like 1password Secret Key (that is presumably stored in Keychain / Secure Enclave at rest). A password seems somewhat more easily stealable (with keyloggers or clipboard loggers etc).
I am not a security expert, but I know enough to be concerned :). I wish there was more discussion on the implications of this difference on security models.
2. Offline access.
Bitwarden does not like to work offline.
You can unlock and view the vault, but you cannot make any changes without active connection to the internet! And Bitwarden will show you a very generic error ("failed to fetch") if you try editing while offline, it won't give you any suggestion on what to do.
Moreover, apparently they will delete the local copy of the vault if internet connection is missing for 30 days: https://www.reddit.com/r/Bitwarden/comments/vtaqi0/comment/i.... That's just nuts if true. I should not rely on the Cloud to have access to the vault as stored locally as long as I have the password.
While there is a general fear about trusting The Cloud as the source of truth for accessing the passwords, this caused very tangible practical issues. I have actually run into needing Bitwarden while on the go. Also the CloudFlare IP that Bitwarden uses was somehow blocked by my provider for some time, and that broke Bitwarden completely (both the provider and Bitwarden neglected to do anything about the problem when contacted).
3. UX.
You get used to it, but it's simply not great.
Worst of all, the UI of the browser extension is prone to data loss. The Bitwarden popup resets the state every time it is unfocused. So imagine the scenario:
* I start creating a new entry and generate a password. * I briefly dismiss the Bitwarden popup to paste the password into the website. * I open Bitward popup again hoping to finish entering the data and save. But the entry is gone. I just need to hope that the generated password is still on the clipboard.
1password in contrast keeps full UI state and partially entered data even if the vault is locked in the interim.