I’m currently using 1Password but I’m no longer satisfied with it.
Its open source, self host-able or cloud host and its had enough audits to say its fairly secure.
Top of the line, best of the best, nothing beats it. Especially if you self-host Vaultwarden, there is simply nothing that can compete. (Vaultwarden makes the 2fa component that is paid in Bitwarden free if you self-host it)
Especially if you self-host Vaultwarden
Out of interest, if you self-host, do you still have to pay for the “premium” BW features like TOTP-in-app?
I was on standard BW for less than a month before moving everything to KeePassXC to have free TOTP.
Sorry, which is the gold standard, bitwarden or vaultwarden or are they something you use in tandem?
Tandem.
BitWarden is the client. VaultWarden is the server-side, self-hosted component that emulates the official BitWarden cloud service.
I’m hearing a lot of good things about Bitwarden, especially from the Linux crowd.
What I am curious about though is what’s in your opinion wrong with 1password - a solution I’m currently using too.
Because it’s closed source, there’s a higher likelihood that there is an undiscovered vulnerability in 1Password. Even though it is audited, a vulnerability could be introduced after the most recent audit and you would never know.
For something as mission-critical as a password manager, going with an open source solution gives just that much more confidence that your data is safe. To me it’s simply not worth the risk to blindly trust a company with my login data, when I could trust a company that displays their entire solution in the open.
Going to play Devil’s advocate here, but open source does not automatically mean that things are safe or that anyone is even auditing the code on anything that resembles a regular basis.
Heartbleed was introduced into OpenSSL source code in 2012 and wasn’t discovered and fixed until 2014
Absolutely, but it’s a probability game. Between those two options of BW and 1Password I’ll go with the choice that has the higher probably of safety.
Thanks, this answer in particular have me something to think about.
I use Bitwarden but there is nothing wrong with 1password. Both have been audited, and (IIRC) don’t have major security holes so far. 1password is more expensive but it’s not an issue.
Some would argue that as 1password is proprietary it can’t be trusted as much as open source Bitwarden
I started using 1pass after the audit by my former company’s itsec team. Just curious if there are some downsides (apart from the price) I’m not aware of.
The one question no-one has mentioned yet given it’s probably Bitwarden’s biggest security vulnerability…
How strong is your password?
Because ultimately that is EVERY password managers weakness! I’m also still skeptical about the abuse, is it passkeys or something that I’m going to guess will make it so much easier to do social engineering on so I’d personally never use it on a vault.
It’s a good question. A vault is only as strong as the credentials required to access it.
Bitwarden does have MFA support, though. If you’re using it without that enabled, you’re asking for trouble.
Yeah, you need 2-factor yo.
Being using it for years, never had a problem…
I switched from bitwarden to 1password because the password autofill was less intelligent.
What’s your issue with 1password?
No self-hosting
Check out Vaultwarden
Vaultwarden allows 1password self hosting?
No, only Bitwarden self hosting
Must have missed the context. I thought the question was for Bitwarden.
I’ve switched away from 1password to proton recently.
it’s fine, it’s far less accurate than 1p was. Let this be a caution, 1password is great for user experience, I hardly noticed it because it always worked. Proton can’t see every login field, doesn’t know when to suggest a new password, won’t save passwords after it has suggested one, doesn’t update login credentials after updated passwords etc etc.
I’m unsure about bitwarden in particular, but I can vouch for the fact that a less intelligent app might be a dealbreaker for some.
Gold standard.
I use an unnoficial Bitwarden app on Ubuntu Touch. I would prefer KeePassXC or KeePassDX as my go to password managers but have found no reason to distrust Bitwarden thus far.
It’s safe. I have a self-hosted Vaultwarden instance on my NAS for years now. I absolutely love Bitwarden.
Recently switched from KeepassXC to Bitwarden because of the cloud hosting ability (I was tired of having to sync my database file everywhere) and have no problems so far. I see Bitwarden recommended a lot, especially from places like privacyguides
I use Bitwarden for passwords, it’s just great.
For totp I use a keepass database on the cloud. Each device needs a local key file to login to get the codes.
It’s one of safety solutions out there
