Hacker News

The page addresses this:

> The “Always free” motto quietly reappeared on the site after its removal was uncovered and went viral on Fedi.

(And the linked article gives evidence: <https://blog.ppb1701.com/the-quiet-renovation-at-bitwarden#:...>.)

Well it did happen - and then unhappened when people noticed.

It is not an overreaction at all to them replacing the principled leader who promised things with the vulture leader whose job and job history is primarily to enshittify things and sell them off.

I'm not seeing "Always free" on that page browsing from mobile. Also, it breaks my back button. Yeah... I'm going to need to switch.

I hear you, but I feel like it's a better safe than sorry situation. Exporting your passwords takes two seconds. I think you can export to an encrypted file, but I just did a plain-text json file and gpg'd it. Can't hurt to play it safe.

Agreed. I will continue using it as it currently fulfills my needs. But I’m not going to shout it at everybody I catch not using a password manager anymore. I’m just not willing to take responsibility for the changes they may make in the near future.

As an aside, since it seems like they’re trying to make money: The aforementioned enthusiasm has gotten it adopted at a workplace of mine. The experience hasn’t been good, so no recommendation here either.

Their moat was being a trusted name in FOSS and it’s a bit sad to see them going in the direction of abandoning it.

But somebody else will probably step up and build on the ruins, like vaultwarden already has. That’s the beauty of choosing FOSS in the first place.

You should try hosting it yourself in docker. Absurdly easy to do if you get an llm to do it and it works very, very well.

Hope they don't alter self hosting it.

They promised an "always free" option. People committed to the service based on that.

Many companies offer a free tier and a paid tier and are willing to incur the cost of users who will never convert. If a company doesn't actually intend to keep it "always free" they shouldn't make the promise in the first place

It’s about the backpedaling. No one says it has to be free, they said that. They just have to keep their promise.

I’ve been a paying user for years, but the free tier change announcement is a sign of the enshittification to come.

It means the old guard is moving away and potentially starting initiatives not in the best interest of the user. In the worst case scenario they will sell my data or introduce stupid changes that risk security.

Passwords are critical, losing them because you forget to pay or run out of money would be a disaster. I suspect they would still provide access in read only mode to non-paying users so it wouldn’t be a disaster if they didn’t offer a free version but I think it’s pretty easy to see why someone thinks it should always have a free offering.

For me it's not that it has to be free, but that it can't be a subscription service or cloud-hosted-only. It's why I left 1Password. I don't like trusting my password management to the whims of mercurial business decisions. It's only a matter of time until private equity smells blood in the water with this product category and starts "extracting value" through acquisitions and arbitrary price increases.

Thanks for the pointer. I use a very similar system, but I hadn't thought to put the password directory into a git repo.

I tried using pass once. I like that it follows the Unix philosophy, and I want to like it, but the fact that all of your account names are visible in the clear is a deal breaker for me.

I'm interested in this, what do you use to host the git repo? Just a private repo on something like github or your own server? How do you backup your private key?

+1 for pass! I use this on my VPS to store secrets. I love that it syncs with GIT. Good stuff

I have used this for almost 10 years now. It's pretty barebones but it seems like the usable lifetime of commercial password managers is 4-5 years before they get enshittified, bought, discontinued, price-jacked, or otherwise made unsuitable for use. "pass" just keeps working.

It’s phones, mainly. People do also have multiple other devices, yes. For me another big pro is having a realtime offsite backup and being able to survive simultaneous loss of all my devices, which is plausible in correlated scenarios like a burglary, fire, mugging, car crash, etc, but I don’t know how much others think of that one.

The people I know who use KeePass live like they’re disabled. You ask them to sign up for something and they need to schedule a half hour for it two weeks out. Ask them to use a website and they need to wait until they’re home because their biweekly manual data transfer was put off because of whatever. And if they ever drop their phone, it’s this totally unforeseeable panic they’re still recovering from two months later. I’m far from convinced it must be like this, but I’m also far from convinced that most KeePass people—or people using any other strategy—have really thought this through.

Multiple devices and family sharing. My wife and I share several accounts, so it's really nice that we can move them between private and shared vaults on 1Password.

I swap between my phone and my computer. Sometimes I need to get an account password on a workstation, and I can just login online rather than typing several lengthy generated passwords.

Most of the workstations I use completely block USB storage devices (but not fido2 keys!)

What would be super nice is to have USB wedge that I can just send my passwords from my phone to any computer like this https://www.inputstick.com/ (Expensive, sold out and also doesn't ship to the USA)

My KeePassXC database auto-syncs to my Nextcloud instance. Nextcloud client on PCs, Keepass2Android on my phone, and it's the same end result as Bitwarden but without the shenanigans.

> I just have everything in KeepassXC

Me too, but I rarely add/edit anything in .kdbx file, it rarely changes. So I just keep a copy on my phone and use KeePassDroid to open it sometimes.

If you change/edit your passwords all the time, and you like autofill and I assume other features, networked solutions are much better.

Having a password manager synced to phone, desktop, laptop, browsers is handy. I used Keepass 10 years ago but I prefer integrated experiences now, particularly since I often pull them up on mobile.

Also consider teams or multiple teams across an org sharing secrets. Flat files are a tough sell, so these apps eliminate almost all the hassle. We pay for a lot of 1Password accounts, and I couldn’t imagine rolling our own solution.

USB stick in your pocket sounds nice but what happens when you drop your keys and it cracks or you get caught in a rain storm and it gets soaked?

Syncing is a huge part, UX is another. I was using KeePass on my desktop for several years before I met my wife, and having her use it was a complete failure. She did not like the workflow. Having to open another another tool, login, search for the correct site, and copy/paste the password was too much friction. And that was when things worked.

Syncing was an utter disaster. Inevitably something would cause syncs to be delayed, and then there would be a conflict and one of our changes would be silently lost. We were constantly going to lookup a password we entered, and finding it was not there anymore, at which point I would have to dig through sync conflict backup files and manually reenter the passwords that were lost, or go through the password reset flow for the sites. It was a giant mess, and that was just with two desktops and a laptop. I was using btsync at the time but all the issues I encountered apply to any file based synchronization, like syncthing, nextcloud or dropbox. Performing whole database file synchronization is simply not the right approach for password safe.

I eventually switched over to self-hosted BitWarden with the browser plugin and haven't had any problems since.

In my case it's exactly that. I have a Linux gaming workstation, a work-issued (and managed) MacOS laptop and a Google-branded (Pixel) Android phone.

Bitwarden just works in all those places and the tech was, by all accounts, rock solid. AND I can pay for it instead of trying to leech off some privacy-ambiguous free tier.

I used to use syncthing to solve that problem, until the developer dropped the distribution because of the Google's anti-social behavior.

But the interface of every software on a phone is so atrocious that I have never actually seen any benefit from having a password manager there that I could copy stuff from. So now I just don't have it, and haven't seen any loss yet.

That said, I store way more low-value passwords on the Firefox manager (that is synchronized) than high-value ones on the offline manager.

USB sticks are infamously unreliable, not a great backup plan

Is it because everybody else is swapping between several different computers, and you need the synchronization?

.. and phones, and tablets. Yes

I only use Apple devices myself normally, but if I'm stranded out in the middle of nowhere and have to borrow someone's Android phone or Windows box in order to connect to important stuff like my bank, I'd really rather not be out of luck. Same reason I don't self-host my vault.

Surely they have their reasons, but if they made Linux support work I suspect a lot of the dev community would jump. This household certainly would.

"If you only use Apple devices, it’s really solid."

It's not a good idea to become dependent on a single corporation's products.

Public management exists for natural monopolies where no market competition is feasible. The role of the public entities is to protect competition. In this case that would be mandating import/export interoperability.

My old company switched through 4 different managers in the span of 3 months. They switched to LastPass just before all the seemingly endless breaches started. I think they were willing to weather it at first but things just got worse and worse. I think they also ended up with Bitwarden

I've been using LastPass for years. I really like it. Why did you switch away?

Until Bitwarden screws up it's going to be difficult for any fork to get much attention. If they do, that will the moment to launch a fork.

It's Bitwarden's game to lose. Forking is easy enough that there's no great need to pre-emptively fork.

Vaultwarden is a very lean implementation of Bitwarden but if you want to look into an alternative to the Bitwarden ecosystem, I recommend - AliasVault https://github.com/aliasvault/aliasvault - check it out!

https://alternativeto.net/software/bitwarden--free-password-...

Honestly after years of resistance I've finally partially embraced Apple's solution and have to admit it works great. I love that Hide My Email is integrated into it so well too

Vaultwarden looks neat:

> Lightweight, self-hosted server written in Rust, fully compatible with Bitwarden clients, implements the Bitwarden server API, supports organizations, attachments, web interface, website icon API, YubiKey, Duo, and multiple two-factor authentication options.

KeePassXC has always been the one true path.

ProtonPass

vaultwarden (self hosted)

Nothing says Trust like quietly and retroactively editing old blog posts. We have always been at war with EastAsia.

A bad idea for you. My non-technical family members can barely use 1Password and it is the easiest of the lot. The idea you promote is just not realistic.

>You'll be able to jump ship any time you want.

Famous last words...

I don't know why this is framed as "jumping ship" ... of course you can stop using it any time (and use your periodic export to go elsewhere).

The real issue is potential data loss. Remember LastPass? Bought by someone and downhill it went, with multiple security incidents.

Never underestimate the lengths companies will go to, to enshittify their product to squeeze customers for money.