Ask HN: Alternatives to Bitwarden?

snapsnail · 2024-10-21T18:30:27 1729535427

Is this really that dire? Comment from the GitHub issue:

"Thanks for sharing your concerns here. We have been progressing use of our SDK in more use cases for our clients. However, our goal is to make sure that the SDK is used in a way that maintains GPL compatibility.

the SDK and the client are two separate programs

code for each program is in separate repositories

the fact that the two programs communicate using standard protocols does not mean they are one program for purposes of GPLv3

Being able to build the app as you are trying to do here is an issue we plan to resolve and is merely a bug."

JAM1971 · 2024-10-21T18:19:50 1729534790

Isn't VaultWarden what you want?

https://github.com/dani-garcia/vaultwarden

DrBenCarson · 2024-10-21T18:24:38 1729535078

Vaultwarden is an open source implementation of the BitWarden backend, I don’t think OP is trying to run his own server

herrherrmann · 2024-10-21T18:23:43 1729535023

VaultWarden is only the server so far. OP is probably looking for a more “complete” provider with clients for different platforms etc.

AntonyGarand · 2024-10-21T18:23:55 1729535035

Per their response to this issue, seems like this is a bug: While they do have some non-FOSS code in their `sdk` package, the client should still be buildable without the SDK:

> Hi @brjsp, > Thanks for sharing your concerns here. We have been progressing use of our SDK in more use cases for our clients. However, our goal is to make sure that the SDK is used in a way that maintains GPL compatibility. > > > the SDK and the client are two separate programs > code for each program is in separate repositories > the fact that the two programs communicate using standard protocols does not mean they are one program for purposes of GPLv3 > Being able to build the app as you are trying to do here is an issue we plan to resolve and is merely a bug.

powersnail · 2024-10-21T18:32:35 1729535555

The problem with that statement is what exactly does "in a way that maintains GPL compatibility" means, especially since they plan on moving more functionalities into the proprietary code, so the two "separate" components will be increasingly coupled together.

I'm not a lawyer, but I'm quite skeptical of the outcome. Is it really going to produce a valid GPLv3 licensed client? To me, it seems like the whole thing is just going to be a combined proprietary + GPLv3 license, which will contradict itself.

But again, I'm not a lawyer, so my understanding of this might be way off.

AntonyGarand · 2024-10-25T15:11:32 1729869092

Seems like they relicensed their whole SDK to GPL so that's a move in the right direction!

https://news.ycombinator.com/item?id=41940580

gigatexal · 2024-10-21T18:26:33 1729535193

I drink enough of the foss koolaid to earn my community card but I’m also a nearly 40-year old realist. I just put everything in 1Password and pay them and forget about it.

If they do something heinous I’ll move to something else but this is not something I want to mess with.

rossng · 2024-10-21T19:46:49 1729540009

That's a fair position - I'm also not insistent on using an open source product. I'd just prefer that the nature of the product isn't silently changed underneath me.

If it's proprietary, and that's clear from the start, I don't think that's necessarily a problem.

politelemon · 2024-10-21T19:08:58 1729537738

I would not recommend a password manager with a cloud component dependency, that is the means by which the proverbial rugs are pulled. It's important to be in control of the vault yourself. Any keepass variant should do such as keepass2 and keepassxc.

solardev · 2024-10-21T19:28:12 1729538892

Not FOSS at all, but I've used 1password for years and love it. It's one of the few pieces of software that just works across my devices (Mac/iPad/Android phone), cloud sync is awesome, and built-in support for cloud-synced 2FA and Passkeys means I never have to worry about replacing devices.

I pay for a family plan and share it with family members. It's really wonderful and something I never have to worry about.

It's not the kind of thing worth wasting time self-building and hosting, IMO, especially the cloud component. I don't want to keep up with all the latest exploits and zero-days; much rather have a commercial company taking care of it with a vested interest in keeping your data safe.

There are FOSS things like Keepass XC. But the overall experience just sucks compared to 1password.

ww520 · 2024-10-21T18:27:11 1729535231

Use KeePass and its variants, for storing the encrypted data in a local file. Use any of the file sync products to sync the file across devices, e.g. Dropbox, Syncthing, etc.

hurutparittya · 2024-10-21T21:52:11 1729547531

Not having a built-in syncing mechanism is the #1 reson I'm looking to move away from KeepassXC as soon as possible. Making users kludge together their own makeshift sync methods using file shares and dropbox is honestly comical when syncing is probably one of the main features people think of when talking about password managers.

ww520 · 2024-10-21T23:09:11 1729552151

You give up control of your important file to a 3rd party who controls the encryption and the storage.

hurutparittya · 2024-10-22T06:23:56 1729578236

I'd never use anything less than completely open source and self-hostable for this purpose! Which is why I'm having trouble with finding a viable alternative to KeepassXC. I intended to go with Bitwarden+Vaultwarden, but that sounds a lot less appealing now.

pixxel · 2024-10-22T06:46:30 1729579590

>comical

Comical is what Hacker News has become.

aborsy · 2024-10-21T20:13:22 1729541602

Syncthing Android app has been discontinued too this week.

jsvcycling · 2024-10-21T18:23:51 1729535031

I'll likely be migrating over to Proton Pass[1] since I already have a Proton Mail subscription anyway. Seems like it meets all your criteria depending on what you consider to be a reasonable cost for a subscription.

[1] https://proton.me/pass

AJMaxwell · 2024-10-21T18:30:43 1729535443

Made the switch from BitWarden to ProtonPass a few months ago. I'm very happy with the switch despite Proton Pass missing some android functionality BitWarden has.

gmuslera · 2024-10-22T00:36:23 1729557383

Don't look forward but look back. A secure open format with many possible open source frontends (like keepass/keepassx/keepassxc) and maybe cloud sync.

28304283409234 · 2024-10-21T19:46:58 1729540018

Not open source, but a non-profit foundation guarding it: https://proton.me/pass edit: Is open source actually: https://github.com/protonpass/

teejmya · 2024-10-21T18:20:05 1729534805

I have been self hosting https://github.com/dani-garcia/vaultwarden, it has been good to me.

rspoerri · 2024-10-21T20:06:16 1729541176

in response to the topic of bitwarden being vc funded i have started to migrate to keypassxc. It works pretty fine, also export / import worked good, some minor issues with to strict db-locking policy which i think i managed to fix in the settings. It's missing cloud sync, but i do my file sync over syncthing anyway. But i'm on osx and i havent tested on windows yet.

DrBenCarson · 2024-10-21T18:29:50 1729535390

Very few open source password managers that have cloud sync and modern clients on popular platforms (I honestly don’t know any that I can recommend)

The logic is making things open source can allow attackers to more easily identify vulnerabilities (flawed logic, but there’s some truth to it)

I would stick to BitWarden or consider 1Password if I were you

I did see https://passky.org/ sometime back, might work for you on Android

throwaway77385 · 2024-10-21T18:28:28 1729535308

Hmmm, I'll be monitoring how this develops. I'm quite committed to Bitwarden. Let's see where this goes.

egamirorrim · 2024-10-21T18:31:10 1729535470

Enpass is pretty good, store your vault in your own <cloud storage>

2024-10-21T18:28:23 1729535303

[dead]

gaws · 2024-10-22T21:42:46 1729633366

There's a catch in there somewhere.