Because most people need a cloud solution for synchronization across devices. Unless you’re spinning up your own service like Nextcloud or similar for this, relying on a commercial cloud storage service for storing the file is just as dangerous (perhaps more so, as your attack surface is now across two third party services) as relying on someone like Bitwarden or Lastpass.
There’s a big difference. You trust entities like bitwarden/lastpass/etc to properly encrypt the data, protect your master key, and trust their entire architecture behind the scenes.
When you encrypt the keepass DB that’s all done by you locally with a open source client. No one knows your master key, and you get a simple encrypted file. You can hand that file to hackers if you want, will be useless without the key.
I put one of the copies of my keepass on onedrive, and syncs perfectly across all devices.
Lol, imagine ridiculing users for trusting an FOSS company to handle their password management, and then storing your encrypted password DB in Microsoft’s OneDrive 😆
This is where your lack of understanding of the open source thing is readily apparent to everyone arguing with you. If it was backdoored, many people would be calling that out. In fact, this was one of the exact reasons at the heart of the original concerns leading to this story.
The fact that the source is available means that we can see exactly how the data is encrypted, allowing assurances to be made independently.
If nothing else, I trust Bitwarden MORE because of that and I’m happy to pay them for their services since it helps find further development.
If it was backdoored, many people would be calling that out.
In theory. And not necessarily soon.
Don’t forget the context of this thread: we compare bitwarden with keepass, which does not offer to you your password base on their server side.
And you are aware that bitwarden knows nothing about the passwords inside the vault and the vault is encrypted in zero knowledge type of fashion? AND that Bitwarden does external audits? AND if you loose your master password you are out of luck as they can’t support you helping crack the decryption?
Except for the part that it’s not a question of trust (being open source), there’s no third-party architecture to trust (it can and should be self-hosted), the data on the server are also encrypted client-side before leaving your device, sure.
Oh, and you also get proper sync, no risk of desync if two devices gets a change while offline without having to go check your in-house sync solution, easy share between user (still with no trust needed in the server), all working perfectly with good user UI integration for almost every systems.
Yeah, I wonder why people bother using that, instead of deploying clunky, single-user solution.
Because most people need a cloud solution for synchronization across devices. Unless you’re spinning up your own service like Nextcloud or similar for this, relying on a commercial cloud storage service for storing the file is just as dangerous (perhaps more so, as your attack surface is now across two third party services) as relying on someone like Bitwarden or Lastpass.
There’s a big difference. You trust entities like bitwarden/lastpass/etc to properly encrypt the data, protect your master key, and trust their entire architecture behind the scenes.
When you encrypt the keepass DB that’s all done by you locally with a open source client. No one knows your master key, and you get a simple encrypted file. You can hand that file to hackers if you want, will be useless without the key.
I put one of the copies of my keepass on onedrive, and syncs perfectly across all devices.
Companies can enshiffity at a moments notice.
Lol, imagine ridiculing users for trusting an FOSS company to handle their password management, and then storing your encrypted password DB in Microsoft’s OneDrive 😆
encrypted is the key word
I knew a comment like this was coming, but unless you can show how microsoft can decrypt my kdbx I stand fully by my current setup.
I don’t think Microsoft can decrypt your DB file, neither do I think Bitwarden can. Encryption happens locally on their open source clients too.
But I’m not the one disparaging trusting an open source program to securely encrypt passwords, you are.
Could you please show how bitwarden can decrypt a vault that’s locally encrypted by a foss client?
“Imagine trusting any company with your passwords”
They created the client. In theory, they can have some backdoors. And since you store your files on their side, risk is greater, imo
This is where your lack of understanding of the open source thing is readily apparent to everyone arguing with you. If it was backdoored, many people would be calling that out. In fact, this was one of the exact reasons at the heart of the original concerns leading to this story.
The fact that the source is available means that we can see exactly how the data is encrypted, allowing assurances to be made independently.
If nothing else, I trust Bitwarden MORE because of that and I’m happy to pay them for their services since it helps find further development.
In theory. And not necessarily soon. Don’t forget the context of this thread: we compare bitwarden with keepass, which does not offer to you your password base on their server side.
I do not trust bitwarden to encrypt my data anymore than anyone trusts keypass to encrypt my data.
They’re both open source and they both do the encryption locally; you’re plainly mistaken.
And you are aware that bitwarden knows nothing about the passwords inside the vault and the vault is encrypted in zero knowledge type of fashion?
AND that Bitwarden does external audits?
AND if you loose your master password you are out of luck as they can’t support you helping crack the decryption?
Except for the part that it’s not a question of trust (being open source), there’s no third-party architecture to trust (it can and should be self-hosted), the data on the server are also encrypted client-side before leaving your device, sure.
Oh, and you also get proper sync, no risk of desync if two devices gets a change while offline without having to go check your in-house sync solution, easy share between user (still with no trust needed in the server), all working perfectly with good user UI integration for almost every systems.
Yeah, I wonder why people bother using that, instead of deploying clunky, single-user solution.