cross-posted from: https://thelemmy.club/post/57178743
RyanL Bitwarden Employee
Hello everyone!
Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.
Bitwarden remains committed to open source security and transparency The GPLv3 OSS licensed version continues to be updated and published on GitHub All current features are available in both versions License details are on GitHub Bitwarden remains committed to a robust, free forever plan for everyoneIf you have any questions, please ask them in this thread. Thanks all!
EDIT:
Bitwarden is not going closed-source You can still fork Bitwarden No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden The free plan is here to stay permanently
App store EULAs and GPLv3 frequently clash. This change only affects the app store binary releases.
So, 99% of users. Do you use an iOS phone or the browser extensions? You’re affected.
So, 99% of users.
How? It’s not like the source code if no longer under GPL, it’s just that this specific compiled binary is under a different license but it doesn’t change anything for anyone in real life.
How do you install the GPL version on iOS or chrome?
https://developer.chrome.com/docs/extensions/how-to/distribute/install-extensions
Literally the first hit.
Also, why would users of a proprietary platforms (because Chrome is the proprietary version of free Chromium) care? FOSS people use different platforms, such as Helium browser, LineageOS, etc.
You think 99% of users will do that every time there’s an update? That method doesn’t auto-update. And iOS?
And iOS?
I’m not ChatGPT. Search the web yourself. There are ways but unlike you I don’t use a proprietary mobile platform and cosplay as a FOSS advocate.
Lmao I don’t use iOS either. But 99% of users use either the browser extensions or iOS, meaning most users will be affected by this, despite your bootlicking.
Because i havent seen it on this thread theres also passbolt
i havent used it personaly (yet) because its offline mode is still in beta.
Does this mean I will, or won’t be able to install the FOSS version through GitHub? Trying to stop repackagers from selling your project is one thing, but killing the source available installs would be another.
It’s still open source
Has anyone tried AliasVault ? How’s your experience with it ?
Well, i was planning to move from my 1password to bitwarden. No need for that now.
“bitwarden apps will be the commercially licensed builds.” I don’t understand how this is going to change anything.
I self-host vaultwarden. I use the official Bitwarden app, it works swimmingly. Going the self-hosted route you get enterprise features (I don’t use em).
Doesn’t the licensing stuff connect with the backend not the app?
All current features are available in both versions
They will start making changes exclusively to the propriety app, and eventually the proprietary app will be completely incompatible with the FOSS app. They’re doing what Google did with AOSP.
The commercial licensing is on the clients. You must switch to the Github versions immediately or proprietary code will be installed.
So, will you still be able to use the builds with the free license? Does that mean that the App Store builds will be locked down?
Sigh… I hope this isn’t the first move of enshitifying bitwarden. I read the comments/replies and hope this is benign but I’m now nervous
I think it is the next move (not the first) in enshittifying bitwarden. I think the first move was the leadership change announced in May.
The first move was when they hired a CEO who comes from private equity. This is the second move.
I really don’t want to have to switch password managers again.
Keepass.
Don’t even know where i’d switch.
Proton -> I already use Proton suite and I like the seperation, the 2 password option doesn’t work for me either. I just need a seperate password.
Keepass -> I use quite a few devices and the sync just seems like a nightmare…
Any other options? For now i’ll stick as BW is still great but will start exploring others.
I’ve been using Dashlane for years and love it
I use UNIX pass utility, it’s very minimal and works for me
Keepass X Syncthing
syncthing runs on everything and is easy to configure.
This, or Vaultwarden, but a lot of people swear by Keepass.
Maybe it’s changed in the year since I tried but I absolutely could not get syncthings to work on android
I recall having issues and bouncing off of it on my first attempt, but I’ve been using it on GrapheneOS/Pixel 8 Pro without issue for at least 2 years now.
But thousands of people have it working just fine. Not calling you out but it does work very well. Did you follow a step by step guide? I know websearch makes it hard to learn new tech things these days.
Just keep in mind, set up a default folder and file (filename.kdbx) to share on one device, add Remote Device (QR code helps there), go to Sharing Tab and select Default Folder. If the Default Folder isn’t ticked on both devices in the Sharing Tab on each, nothing happens. When you work it out, that folder can be called anything and you can get advanced with how or when it shares or which direction the data goes (think photo backup from mobile to desktop).
New Android app to use is:
https://github.com/chenxiaolong/BasicSync
Use Obtainium- https://github.com/ImranR98/Obtainium - to install it and keep it updated. Obtainium can update itself the same way.
Convoluted, I know, but so is relying on a company to host for you in the cloud. They just hide all the complexity behind the interface. With Syncthing, once it’s set up between all your devices (and there is a way to quickly auto accept setup once further advanced/knowledgeable), it just chugs along in the background. Changes to keepass file appear almost instantly across each device once it’s opened.
I’m probably going to try it again in the near future and hopefully it’s better than it was. Saving your comment, thank you.
Oh, I hope not. It’s not really that clear. I’ve been on it for a long, long time so would have got through that stage you tested with no issues. Having Basicsync now is nice, it’s just the webui on your phone with some quality of life improvements like when it turns on etc. Very simple and familiar across multiple devices.
Try comparing what I said with the official guide from “Configuring” downwards. Hits more than what I tried to communicate and has screenshots if you get lost.
https://docs.syncthing.net/intro/getting-started.html
When I first started with it, I just set it up on my phone with the Default Folder (and file inside) at /sync and then walked around to the other devices, open up Show ID on the new one I’m at, add remote from my phone and QR scan the new device. You then get a notification to accept the device, then make sure Default Folder in Sharing is ticked for both. You can just find devices on the network too.
The more devices, the greater redundancy on the keepass file if you lose a device or it fails. Sometimes there are conflicts with files that haven’t been synced properly (none of my family’s iOS devices sync always on in the background and I don’t use iOS so it’s not my problem and hasn’t been troubleshot) but you can merge conflicts in Syncthing in Keepass by merging both files together. Set up Simple File Versioning and 5-10 copies when you are confident with it. If you have a device that’s always on like a server, it tends to be the arbiter of truth and catches sync issues. Android/Linux/Windows just work for me.
Good luck.
A little more than a year ago, Syncthing for Android had a lot of issues, there was a breaking change installed that required updates and the existing clients had issues, it has since been forked.
If you don’t need the granular security or family-friendliness it should provide.
Yes I want to say this was right before or during the chaos because I remember reading about the fork after I gave up lol
That’s not an option for iOS users.
You could use Synctrain or maybe Möbius Sync to SyncThing-sync a folder with your phone, then use Strongbox or KeePassium or any other KeePass-compatible app to work with the file?
If you have a Nextcloud server, you should try Passman.
Why would you need to switch? Are you repackaging Bitwarden?
Because the new CEO seems to really be wanting to find revenue and this step just reaffirms in my mind that he’s likely going to start reducing features for unpaid accounts.
Just rip the bandaid off.
And go to what? What works as well / seamlessly as Bitwarden?
That’s quite the disappointment. Probably need to prepare to switch away from bitwarden or at least research options for open source clients for my vaultwarden backend.
what is even out there? I pay for proton and bitwarden. but I just dont trust them
Before Bitwarden / Vaultwarden I went with Keepass (it was some fork don’t remember the exact name KeepassXC probably) synced via Nextcloud. It’s not as convenient as Bitwarden plus at least back then it didn’t support passkeys. So yeah, I don’t know what is actually out there. Honestly I don’t think it’s super urgent to start hunting for alternatives but probably we should have at least some ideas in case the Bitwarden team does some weird moves.
Someone can correct me, but this change seems to be targeting people who are repackaging bitwarden and selling it. It does feel like we are trending the wrong direction though.
If you read their announcement carefully you’ll find things like
All current features are available in both versionsWhich strongly implies that the different versions will start to diverge over time. Then at one point they will just be like maah it’s not worth putting more work into the open source thing, we’ll focus on building new cool features yada yada yada. And this is how all the open to partly open to closed source rug pulls worked in the last years.
(If you want to do this the worst way possible like MinIO you also squash / delete the Git history the moment you announce you’re only working on closed source)
Minio also deleted the repos altogether about two weeks ago.
Yeah well, didn’t know this. I’m still running some old minio instances on my home server. Need to check if the docker images are still around otherwise I urgently need a backup plan…
Fucking hell, why didn’t they at least leave the old code available 😭
I moved from minio to garage a few months ago, and it was surprisingly easy to do
I tried to stand up a notesnook insurance to test a couple days ago and it kept failing because minio doesn’t exist anymore.
They really fucked a lot of people.
What would be the reason for using this and not Keepass from the beginning?
Well, a big reason I ended up with bitwarden is being able to have a family group that I can help foster, encourage, force my family to use a password manager by having/showing them how these work , why they should use them and continually point them to the app to save and/or retrieve passwords.
The barrier to entry for non technical users is much lower. I don’t want to manage making sure everyone’s db is safe/synced etc… either
I don’t know, my wife (0 technical knowledge) works perfectly, with daughter and personal databases. Of course, it’s true that I set everything up myself and I make sure the database is on the family NAS. I’m not judging you or anything, but while it’s true that setting it up is a bit more difficult, using it, in my opinion, is not at all.
I do run a number of self hosted things, (nextcloud, immich, plex). I had my own pw manager, and had tried keepass myself and when it came time to push the family to using a pw manager I just opted for bitwarden here vs taking ownership of managing that too!
Hell, it’s still a literal fight/push to make them understand the importance of it <sigh>
For me it is totp, cloud capabilities and passkeys
I’m using Strongbox on macOS and iOS. Uses a KeePass2 database in the background, does TOTP (so does KeePassXC), syncs via iCloud (but also supports SFTP, WebDAV, OneDrive, Google Drive, and Dropbox) and also keeps my Passkeys. And it supports Apple’s AutoFill API, so it works in basically any input field across the systems and feels “native”. No browser extensions (at least for Safari) needed.
And if it goes rogue, I can switch to e.g. KeePassium or any other KeePass-compatible app.
I might be a bit paranoid (or an idiot) but I think having the password and the totp in the same database (and app) somewhat negates the point of two-factor authentication.
I see 2FA as mostly a mitigation for users reusing passwords between services, which users of password mangers usually don’t. Of course, the password manger itself can be a single point of failure.
It does negate the big issue of passwords leaking from the websites and that’s the most important part of even having totp.
Nobody is going to spend time to separate the 2 and maintain backups of two different things and all that extra effort when 90% of people don’t even use password managers.
Don’t let perfection be the enemy of improvement.
It does, but not every account is worth it
I have a proton membership anyways so proton pass seems good since they have SimpleLogin
I just cannot get on board with Proton Pass while I cant have a completely different set of credentials.
I keep my Proton passwords inside the password manager. Either I need to make my Proton password memorable and be my master password OR setup the 2 password mode where I need to remember and login 2 passwords.
They need some kind of privacy pass implementation to link your Proton pass to your Proton account while allowing completely separate credentials.
I keep the master password inside proton pass itself. I don’t want to be trusted with remembering anything. What if I lose my memory, ya know. They give a twelve word backup which you can use in case you get signed out of every device.
Same, probably going to switch to it eventually even though I don’t like having all my eggs in one basket. Proton provides me a good quality service, can’t lie.
I am self hosting Vault warden on freeshard.net and using the Firefox Plugin and Android App. How does that affect me?
Depends. It all stands on the shoulders of the client. My guess is Vaultwarden will fork and go with their own UI and plugin.
