• MrFunkEdude@piefed.social
    link
    fedilink
    English
    arrow-up
    45
    ·
    9 days ago

    Cool.

    I just started using Bitwarden almost a year now. I don’t know how I lived without it before? It’s nice to know I wont have to switch to something else.

    • CriticalMiss@lemmy.world
      link
      fedilink
      English
      arrow-up
      78
      ·
      9 days ago

      Sure. The majority of the BitWarden client is licensed under the GPL, which categorizes it as “free software”. However, one of the dependencies titled “BitWarden-SDK” was licensed under a different proprietary license which didn’t allow re-distribution of the SDK. For the most part, this was never a problem as FOSS package maintainers didn’t include the dependency (as it was optional) and were able to compile the various clients and keep the freedoms granted by the GPL license. However, a recent change made BitWarden-SDK a required dependency, which violated freedom 0 (the freedom to distribute the code as you please). BitWarden CTO came out and said this was an error and fixed this, making BitWarden SDK an optional dependency once again which now makes BitWarden free software again. For the average joe, this wouldn’t have mattered as BitWarden SDK contains features that are usually favored by businesses and the average Joe can live without. So everything now returns back to normal, hopefully.

      • JustEnoughDucks@feddit.nl
        link
        fedilink
        English
        arrow-up
        11
        arrow-down
        3
        ·
        edit-2
        9 days ago

        This seems like classic corporate backtracking when their customers spot a terrible, deliberate decision.

        That being said, I am happy about it. I got my company to use it and finally got my girlfriend to use it and just recommended it to her brother. Would hate to have to try to find something else

        • douglasg14b@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          1
          ·
          8 days ago

          This seems like classic corporate backtracking when their customers spot a terrible, deliberate decision.

          I didn’t think that’s the case here

          However, would you rather that the feedback of users NOT change behavior? I’m not entirely sure what your end game is here, you WANT corporations to ignore and not take action on feedback?

          • Excrubulent@slrpnk.net
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            3
            ·
            edit-2
            8 days ago

            Why do they have to “WANT” that? Ignoring the fact that they literally said they were happy it was changed back, why does that matter to the criticism? If it’s true, it’s true, and the fact that corporations are the ones in a position to habitually make terrible decisions about FOSS is a big problem. It’s valid to point out that it would be good to find a better way.

            If anything it sounds like you “WANT” to ignore it.

        • CriticalMiss@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          8 days ago

          I don’t think so, to be honest. The bitwarden-sdk had been there for a VERY long time and you could always compile without it. Not being able to build a FOSS client wouldn’t hurt bitwarden’s bottom line too much. Most people use whatever is provided in the app stores (which is compiled with the source available sdk).

  • 486@lemmy.world
    link
    fedilink
    English
    arrow-up
    26
    ·
    9 days ago

    I was really sceptical of the CTOs first response, but this does actually seem to be genuinely good news.

  • patchwork@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    10
    arrow-down
    7
    ·
    edit-2
    9 days ago

    Initially Bitwarden was one of the most impressive FOSS password managers, but their increasing willingness to trade user privacy for services and promotion by our favorite surveillance capitalist’s is the real issue imho. Believing Privacy and Security are inextricably linked, I cannot recommend, nor use them at this time.

    A quick scan on Blacklight (TheMarkup’s Privacy Tool) is an eye opener.

    https://themarkup.org/blacklight?url=https%3A%2F%2Fbitwarden.com%2F&device=mobile&location=us-ca&force=false

    • Rockslide0482@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      3
      ·
      8 days ago

      This is an interesting tool that I’m going to back pocket, so thanks for that. That being said, any trackers and such on Bitwarden.com root page isn’t really indicative of the real product, though I’ll say it reflects poorly. That page basically is a sales pitch put together by probably a completely separate marketing team.

      • patchwork@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        1
        ·
        6 days ago

        Blacklight is basically a front-end for DuckDuckGo’s open source tracker radar tool. https://github.com/duckduckgo/tracker-radar

        In a world increasing dominated by surveillance capitalists and dystopian tech, conscientious consumerism is one of the most effective tools we still have to effect change. Google chooses to sell tech to a Far-Right government’s engaged in ethnic cleansing, Bitwarden chooses Google as a business partner for analytics, marketing, cloud services, etc… I choose to not use Bitwarden.

        Another resource to assist in choosing which services to use is the open project PrivacySpy. Bitwarden doesn’t score very well by their metrics either.

        https://privacyspy.org/product/bitwarden/

  • Jeena@piefed.jeena.net
    link
    fedilink
    English
    arrow-up
    18
    arrow-down
    76
    ·
    10 days ago

    If that wasn’t on purpose than that was a big fuckup. I was sometimes thinking about testing Bitwarden but with this volatile license situation I’m not interested anymore.

    • dustyData@lemmy.world
      link
      fedilink
      English
      arrow-up
      142
      arrow-down
      2
      ·
      edit-2
      10 days ago

      That’s a poor understanding of the situation. Nothing in the licensing changed. The SDK has always been the proprietary business to business secrets management product. The client integrates with and can use that SDK to provide the paid service to businesses. The client and the server side management of password has always been and still is FOSS.

      This was apparently an accidental change in the build code (not the client code, just the building scripts) that required the inclusion of the SDK to build the client when actually it has never and doesn’t really need any of that code. It prevented building the client without accepting the SDK license. Which it shouldn’t.

      This was fixed and some things will be put in place so it doesn’t happen again. Nothing in the licensing scheme changed, at all. This is not a catastrophic enshittification event. A Dev was just being lazy and forgot to check the dependencies on the build chain before their commit.

    • Telorand@reddthat.com
      link
      fedilink
      English
      arrow-up
      52
      arrow-down
      1
      ·
      10 days ago

      You can do what you like, but the change is sane, and they’ve now separated their Secrets Manager, which is their proprietary software for businesses, from their primary client, which is GPL.

      IMO, the internet is doing that thing again where they invent villains.

          • WhyJiffie@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            9 days ago

            tbh I don’t think any of the 2 sides here could know that their opinion is the truth. we can’t say that it’s intentional, but can’t either that it’s just a honest mistake, so far everyone saying that just sounds to apply wishful thinking. let’s see what happens in a few years, and then we may be able to judge future incidents better.

          • umami_wasabi@lemmy.ml
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            11
            ·
            edit-2
            10 days ago

            I wish it’s just pananoia though I think that statement only in the skeptical realm, and I wish nothing substantial changed. I’m hosting vaultwarden currently for my family. To them the app on their phone is paramount. However, it is proven some will go that route, like Android. After all, a for -profit company goal is to make money.

            There is a risk and a probability one need to evaluate. Nothing wrong to plan for an exit, but abandoning the software right now is simply overreaction.

            As long as I can use it with a self-hosted server with features they expect, I’m don’t think I will move away from it.

            • 4am@lemm.ee
              link
              fedilink
              English
              arrow-up
              4
              arrow-down
              1
              ·
              10 days ago

              This is a much more level take than your first comment.

              • umami_wasabi@lemmy.ml
                link
                fedilink
                English
                arrow-up
                2
                arrow-down
                7
                ·
                10 days ago

                It is not always I want to write this long to explain what in my thoughts. The conclusion remains the same as my first comment.

                I always maintain a healthy dose of skepticism on anything. Not that they would do it again and it is highly probable that’s only a mistake but no one can tell except Bitwarden themselves. However, all the outsiders like us can only take their statement at face value and some skepticism will keeps eyes sharp.

        • 4am@lemm.ee
          link
          fedilink
          English
          arrow-up
          24
          arrow-down
          2
          ·
          10 days ago

          They didn’t try anything. Stop inventing. Go read an actual article on the subject instead of feeding the scarebait frenzy.

        • dustyData@lemmy.world
          link
          fedilink
          English
          arrow-up
          7
          ·
          10 days ago

          If this were done by MS or Apple, who lack any shred of respect left, sure. If it were a material change on how the code works, certainly it would be most concerning. But what happened was blown entirely out of proportion for who Bitwarden has been and how they’ve acted in the past. They are still ethically very solid. And it was an immaterial change in the build tools, that could very well have been neglectful or accidental.

          • 4am@lemm.ee
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            4
            ·
            10 days ago

            You are correct, but the way people reacted is certainly conditioning from the rug-pulling enshittification going on daily in the tech world. (What are we all using instead of redis, again?)

    • 4am@lemm.ee
      link
      fedilink
      English
      arrow-up
      18
      ·
      10 days ago

      “I only read the headline and the comments from the threads a week ago, I am truly disappointed in Bitwarden’s stance against FOSS as I’ve misunderstood it.”

    • Lettuce eat lettuce@lemmy.ml
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      1
      ·
      edit-2
      9 days ago

      Something tells me you’re the kind of person who sees a car turn the same direction as you twice and starts freaking out that you’re being followed…

        • catloaf@lemm.ee
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          1
          ·
          9 days ago

          If you think the meaning is “funny joke, upvotes to the left”, no, it never meant that.

      • thann@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        36
        ·
        10 days ago

        If you thnk they accidentally made a proprietary module, I have a bridge to sell you

        • Telodzrum@lemmy.world
          link
          fedilink
          English
          arrow-up
          18
          ·
          10 days ago

          If you don’t understand how easily this happens, you don’t understand how licenses work or the interplay involved in licensing packages, frameworks, and miscellaneous dependencies.

          • thann@lemmy.dbzer0.com
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            4
            ·
            9 days ago

            I’ve been programming for 20 years and have never seen this happen without a project manager wanting it to happen, I have however seen people lie about unpopular changes and call them bugs a whole bunch

            • DrDystopia@lemy.lol
              link
              fedilink
              English
              arrow-up
              4
              ·
              9 days ago

              Corporate lies to hide unpopular changes is basically the soup of the day. Every day. For as long as I can remember. I’m an old elephant.

  • net00@lemm.ee
    link
    fedilink
    English
    arrow-up
    19
    arrow-down
    83
    ·
    10 days ago

    Why would anyone trust any company with their passwords??

    Just use keepass and not bother with BS

    • Telodzrum@lemmy.world
      link
      fedilink
      English
      arrow-up
      71
      arrow-down
      1
      ·
      10 days ago

      Because most people need a cloud solution for synchronization across devices. Unless you’re spinning up your own service like Nextcloud or similar for this, relying on a commercial cloud storage service for storing the file is just as dangerous (perhaps more so, as your attack surface is now across two third party services) as relying on someone like Bitwarden or Lastpass.

      • net00@lemm.ee
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        29
        ·
        9 days ago

        There’s a big difference. You trust entities like bitwarden/lastpass/etc to properly encrypt the data, protect your master key, and trust their entire architecture behind the scenes.

        When you encrypt the keepass DB that’s all done by you locally with a open source client. No one knows your master key, and you get a simple encrypted file. You can hand that file to hackers if you want, will be useless without the key.

        I put one of the copies of my keepass on onedrive, and syncs perfectly across all devices.

        Companies can enshiffity at a moments notice.

        • Lettuce eat lettuce@lemmy.ml
          link
          fedilink
          English
          arrow-up
          46
          arrow-down
          5
          ·
          9 days ago

          Lol, imagine ridiculing users for trusting an FOSS company to handle their password management, and then storing your encrypted password DB in Microsoft’s OneDrive 😆

          • net00@lemm.ee
            link
            fedilink
            English
            arrow-up
            6
            arrow-down
            27
            ·
            9 days ago

            I knew a comment like this was coming, but unless you can show how microsoft can decrypt my kdbx I stand fully by my current setup.

            • Lettuce eat lettuce@lemmy.ml
              link
              fedilink
              English
              arrow-up
              37
              ·
              9 days ago

              I don’t think Microsoft can decrypt your DB file, neither do I think Bitwarden can. Encryption happens locally on their open source clients too.

              But I’m not the one disparaging trusting an open source program to securely encrypt passwords, you are.

            • Bezier@suppo.fi
              link
              fedilink
              English
              arrow-up
              14
              arrow-down
              1
              ·
              9 days ago

              Could you please show how bitwarden can decrypt a vault that’s locally encrypted by a foss client?

              “Imagine trusting any company with your passwords”

              • Llewellyn@lemm.ee
                link
                fedilink
                English
                arrow-up
                1
                arrow-down
                9
                ·
                edit-2
                9 days ago

                They created the client. In theory, they can have some backdoors. And since you store your files on their side, risk is greater, imo

                • soul@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  5
                  arrow-down
                  1
                  ·
                  edit-2
                  9 days ago

                  This is where your lack of understanding of the open source thing is readily apparent to everyone arguing with you. If it was backdoored, many people would be calling that out. In fact, this was one of the exact reasons at the heart of the original concerns leading to this story.

                  The fact that the source is available means that we can see exactly how the data is encrypted, allowing assurances to be made independently.

                  If nothing else, I trust Bitwarden MORE because of that and I’m happy to pay them for their services since it helps find further development.

        • Dark Arc@social.packetloss.gg
          link
          fedilink
          English
          arrow-up
          29
          arrow-down
          1
          ·
          edit-2
          9 days ago

          I do not trust bitwarden to encrypt my data anymore than anyone trusts keypass to encrypt my data.

          They’re both open source and they both do the encryption locally; you’re plainly mistaken.

        • Appoxo@lemmy.dbzer0.com
          link
          fedilink
          English
          arrow-up
          7
          ·
          9 days ago

          And you are aware that bitwarden knows nothing about the passwords inside the vault and the vault is encrypted in zero knowledge type of fashion?
          AND that Bitwarden does external audits?
          AND if you loose your master password you are out of luck as they can’t support you helping crack the decryption?

        • cley_faye@lemmy.world
          link
          fedilink
          English
          arrow-up
          6
          ·
          9 days ago

          Except for the part that it’s not a question of trust (being open source), there’s no third-party architecture to trust (it can and should be self-hosted), the data on the server are also encrypted client-side before leaving your device, sure.

          Oh, and you also get proper sync, no risk of desync if two devices gets a change while offline without having to go check your in-house sync solution, easy share between user (still with no trust needed in the server), all working perfectly with good user UI integration for almost every systems.

          Yeah, I wonder why people bother using that, instead of deploying clunky, single-user solution.

    • CarbonatedPastaSauce@lemmy.world
      link
      fedilink
      English
      arrow-up
      46
      ·
      9 days ago

      Bitwarden can be fully self hosted, I’m doing it. My Bitwarden server doesn’t (and can’t) talk to them at all as it has no way to access the internet. They know nothing about my deployment except that I signed up for a free license key.

    • mac@lemm.ee
      link
      fedilink
      English
      arrow-up
      12
      ·
      10 days ago

      I used to use Keepass and sync thing and would consistently run into conflicts between my desktop and mobile entries. Maybe there’s a better way to do it that I’m missing, but that was very annoying

      • cley_faye@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        9 days ago

        I use this setup for my personal passwords, using nextcloud as the sync solution. A semi-fix for that was using Keepass2Android (on Android obviously). It integrates with nextcloud directly, keep a local DB of passwords, and would only load the remote one (and merge) on unlock and updates, not keeping it “constantly” sync on every remote change. It works well… most of the time… with only two devices that almost always have connection to the server… and for only one user.

        It’s overly clunky though. It’s the big advantage of “service based” password manager against “single file based” ones. They handle sync. We have plans to move to bitwarden at my workplace, and since the client supports multiple accounts on multiple servers, I’ll probably move to that for personal stuff too. The convenience is just there, without downside.