Edit: it actually disappeared for some time but they put it back on May 18
snapshot from May 15: https://web.archive.org/web/20260515190646/https://bitwarden...
snapshot from May 18: https://web.archive.org/web/20260518183728/https://bitwarden...
> The “Always free” motto quietly reappeared on the site after its removal was uncovered and went viral on Fedi.
(And the linked article gives evidence: <https://blog.ppb1701.com/the-quiet-renovation-at-bitwarden#:...>.)
As I understand it, so far the only actual change is an announced increase in prices. Obviously, from the consumer perspective, cheaper is better, but this is a product where I think that a subscription plan makes sense (and the free tier, for now, still exists), and so I'm not going to get mad about price changes. Competitors exist and one doesn't think the new price is worth it, then switch to one of them (using the very-much-still-available vault export).
I don't think the warning is crazy or anything, but in my personal opinion it's a little stronger/earlier than is warranted and the current appropriate response is careful watching.
But with all this stuff coming out, I'm holding off on recommending it anymore; at least until everything calms down and the new value proposition is fully laid out.
Like other folks have said, I don't think it's yet time to migrate. That being said, it doesn't hurt to do an encrypted export for backup purposes, start looking at alternatives, and reach out to people I know use Bitwarden to do the same.
Keeping an eye out on how this develops.
As an aside, since it seems like they’re trying to make money: The aforementioned enthusiasm has gotten it adopted at a workplace of mine. The experience hasn’t been good, so no recommendation here either.
Their moat was being a trusted name in FOSS and it’s a bit sad to see them going in the direction of abandoning it.
But somebody else will probably step up and build on the ruins, like vaultwarden already has. That’s the beauty of choosing FOSS in the first place.
Hope they don't alter self hosting it.
It's a shell script that stores passwords in a git repository, containing one file per entry. The files are encrypted using a GPG key. Because it's just a git repository, you can synchronise it between devices using whatever infrastructure you want. I use a FOSS client for it on iOS, and there was one for Android before I got an iPhone.
Pass has a pretty good ecosystem of plugins/other clients, as well. There are open source iOS/Android clients and browser extensions so once you’re setup the day-to-day experience is not far off from any of the popular hosted password managers.
My only real issue is the dependency on gpg, as it’s pretty long in the tooth and a hassle to operate. (If you are not comfortable using gpg, spend some time learning that before you go all-in on pass!) There’s a fork[1] which swaps gpg for age, but it hasn’t attracted enough attention to get a similar ecosystem of mobile clients/browser extensions, so it’s not a very practical choice IMHO.
Is it because everybody else is swapping between several different computers, and you need the synchronization?
I just have everything in KeepassXC, and the ciphertext is subject to the same kind of backup regime I use for other files, a copy kept on a USB stick in my pocket.
The people I know who use KeePass live like they’re disabled. You ask them to sign up for something and they need to schedule a half hour for it two weeks out. Ask them to use a website and they need to wait until they’re home because their biweekly manual data transfer was put off because of whatever. And if they ever drop their phone, it’s this totally unforeseeable panic they’re still recovering from two months later. I’m far from convinced it must be like this, but I’m also far from convinced that most KeePass people—or people using any other strategy—have really thought this through.
Me too, but I rarely add/edit anything in .kdbx file, it rarely changes. So I just keep a copy on my phone and use KeePassDroid to open it sometimes.
If you change/edit your passwords all the time, and you like autofill and I assume other features, networked solutions are much better.
Bitwarden just works in all those places and the tech was, by all accounts, rock solid. AND I can pay for it instead of trying to leech off some privacy-ambiguous free tier.
Also consider teams or multiple teams across an org sharing secrets. Flat files are a tough sell, so these apps eliminate almost all the hassle. We pay for a lot of 1Password accounts, and I couldn’t imagine rolling our own solution.
.. and phones, and tablets. Yes
And Vaultwarden is nice. I've used it at work, hosted it myself, and as a user of the password manager I can say it's basically indistinguishable. But I don't really pay Bitwarden for a password manager -- I pay them for a secure sync of a password manager I can share with family members who can't figure out a VPN.
It's not a good idea to become dependent on a single corporation's products.
Overly idealistic thinking, maybe... but still thinking.
It's Bitwarden's game to lose. Forking is easy enough that there's no great need to pre-emptively fork.
They were never yours, and zillions of people you don't know have access to them.
Bitwarden/Vaultwarden had a good run but if someone's going to self-host Vaultwarden, I would encourage people to look into AliasVault instead. It's a complete opensource ecosystem.
Or did he sign all of those rights away when he took the $100M "fuck you" VC funding in 2022.
The quiet renovation at Bitwarden
>But the explanatory paragraph at the bottom of the same post still says the old ones: Inclusion and Transparency. Crandell’s name is still on it. The post now contradicts itself, and nobody wrote a new one.
Looking at the post right now, they've corrected it to Innovation and Trust.
Waiting for people to get this.
I end up helping a lot of older people for a variety of reasons with tech - 60s to 90s, family, neighbors, coworkers.
They’re not invalids and have a right to participate in the digital world, even if security requirements have exploded.
Anchoring the trust in stuff like 1Password where we setup domains, their account info, their OTP codes means they get to go to their bookmarked site, FaceID to unlock the PW manager, get automatically logged in, and do what they need.
Being able to let them navigate this world without always having to hand over the paper secrets notebook to random helpers, or lose sheets of paper with passwords, or get caught up in tracking down an SMS code is better for them. Their password manager with the autofill helps somewhat deter phishing links since relying on autofill usually signals something is off, and they call someone they trust.
My point, I guess, was that convenience is basic access for some subset of vulnerable groups of people.
Famous last words...
The idea of BW doing a rug pull and suddenly removing the ability to export your vault I think would trigger a class-action lawsuit.
The real issue is potential data loss. Remember LastPass? Bought by someone and downhill it went, with multiple security incidents.
- Google Authenticator
https://github.com/BrenoFariasdaSilva/Authy-iOS-MiTM is going to be my project for the afternoon.
is a good alter. Works perfect for me.