I was really sceptical of the CTOs first response, but this does actually seem to be genuinely good news.
I’m nerdy enough to use bitwarden but not nerdy enough to truly understand this.
Can someone explain it like I’m 5?
Sure. The majority of the BitWarden client is licensed under the GPL, which categorizes it as “free software”. However, one of the dependencies titled “BitWarden-SDK” was licensed under a different proprietary license which didn’t allow re-distribution of the SDK. For the most part, this was never a problem as FOSS package maintainers didn’t include the dependency (as it was optional) and were able to compile the various clients and keep the freedoms granted by the GPL license. However, a recent change made BitWarden-SDK a required dependency, which violated freedom 0 (the freedom to distribute the code as you please). BitWarden CTO came out and said this was an error and fixed this, making BitWarden SDK an optional dependency once again which now makes BitWarden free software again. For the average joe, this wouldn’t have mattered as BitWarden SDK contains features that are usually favored by businesses and the average Joe can live without. So everything now returns back to normal, hopefully.
This seems like classic corporate backtracking when their customers spot a terrible, deliberate decision.
That being said, I am happy about it. I got my company to use it and finally got my girlfriend to use it and just recommended it to her brother. Would hate to have to try to find something else
This seems like classic corporate backtracking when their customers spot a terrible, deliberate decision.
I didn’t think that’s the case here
However, would you rather that the feedback of users NOT change behavior? I’m not entirely sure what your end game is here, you WANT corporations to ignore and not take action on feedback?
I don’t think so, to be honest. The bitwarden-sdk had been there for a VERY long time and you could always compile without it. Not being able to build a FOSS client wouldn’t hurt bitwarden’s bottom line too much. Most people use whatever is provided in the app stores (which is compiled with the source available sdk).
Free software had a non-free extra bit that it technically didn’t need. Accidentally got changed to need the non-free part in order to run which caused news stories. Now the change has been reverted so it’s free again.
Cool.
I just started using Bitwarden almost a year now. I don’t know how I lived without it before? It’s nice to know I wont have to switch to something else.
Initially Bitwarden was one of the most impressive FOSS password managers, but their increasing willingness to trade user privacy for services and promotion by our favorite surveillance capitalist’s is the real issue imho. Believing Privacy and Security are inextricably linked, I cannot recommend, nor use them at this time.
A quick scan on Blacklight (TheMarkup’s Privacy Tool) is an eye opener.
This is an interesting tool that I’m going to back pocket, so thanks for that. That being said, any trackers and such on Bitwarden.com root page isn’t really indicative of the real product, though I’ll say it reflects poorly. That page basically is a sales pitch put together by probably a completely separate marketing team.
Why would anyone trust any company with their passwords??
Just use keepass and not bother with BS
Because most people need a cloud solution for synchronization across devices. Unless you’re spinning up your own service like Nextcloud or similar for this, relying on a commercial cloud storage service for storing the file is just as dangerous (perhaps more so, as your attack surface is now across two third party services) as relying on someone like Bitwarden or Lastpass.
There’s a big difference. You trust entities like bitwarden/lastpass/etc to properly encrypt the data, protect your master key, and trust their entire architecture behind the scenes.
When you encrypt the keepass DB that’s all done by you locally with a open source client. No one knows your master key, and you get a simple encrypted file. You can hand that file to hackers if you want, will be useless without the key.
I put one of the copies of my keepass on onedrive, and syncs perfectly across all devices.
Companies can enshiffity at a moments notice.
Except for the part that it’s not a question of trust (being open source), there’s no third-party architecture to trust (it can and should be self-hosted), the data on the server are also encrypted client-side before leaving your device, sure.
Oh, and you also get proper sync, no risk of desync if two devices gets a change while offline without having to go check your in-house sync solution, easy share between user (still with no trust needed in the server), all working perfectly with good user UI integration for almost every systems.
Yeah, I wonder why people bother using that, instead of deploying clunky, single-user solution.
And you are aware that bitwarden knows nothing about the passwords inside the vault and the vault is encrypted in zero knowledge type of fashion?
AND that Bitwarden does external audits?
AND if you loose your master password you are out of luck as they can’t support you helping crack the decryption?
Lol, imagine ridiculing users for trusting an FOSS company to handle their password management, and then storing your encrypted password DB in Microsoft’s OneDrive 😆
Are you a software developer ? Because you are way out of touch with what users want.
I get why you’d suggest the previous commenter is out of touch with what users want, but what does that have to do with being a software engineer?
I used to use Keepass and sync thing and would consistently run into conflicts between my desktop and mobile entries. Maybe there’s a better way to do it that I’m missing, but that was very annoying
I use this setup for my personal passwords, using nextcloud as the sync solution. A semi-fix for that was using Keepass2Android (on Android obviously). It integrates with nextcloud directly, keep a local DB of passwords, and would only load the remote one (and merge) on unlock and updates, not keeping it “constantly” sync on every remote change. It works well… most of the time… with only two devices that almost always have connection to the server… and for only one user.
It’s overly clunky though. It’s the big advantage of “service based” password manager against “single file based” ones. They handle sync. We have plans to move to bitwarden at my workplace, and since the client supports multiple accounts on multiple servers, I’ll probably move to that for personal stuff too. The convenience is just there, without downside.
