this post was submitted on 14 Jul 2023
502 points (97.5% liked)
Asklemmy
43952 readers
674 users here now
A loosely moderated place to ask open-ended questions
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Bitwarden is one I use several times a day. They do have a support plan for like $10 a year that gives a couple extra features like TOTP support, but the base level is incredibly robust. It’s open source, too. I know a lot of folks also host their own servers with Vaultwarden, but that’s a little beyond my skill level.
I pay for it just because it's cheap and to support them
Same, the free tier is so good that I'm paying to make sure it stays free.
I did this too when it first came out, and then the product became robust enough that I recommended we implement it at work because secrets management was non-existent. We have a bunch of licenses on the Enterprise plan now and it just keeps getting better each update.
My only complaint is that migrating the data to a new server is a pain in the ass and never works correctly, even when following the migration instructions to the letter. Always have to open a ticket with them for that. Not enough of a pain to move to another product, though.
I also still pay for my personal plan. It really is a fantastic product.
Why not just let them host it?
Because we have some contracts that stipulate any data related to the project, including secrets/credentials, must remain on-site, and in some cases, on an air-gapped network. Doesn't make sense to spin up something else to manage those secrets when Bitwarden can do it all and satisfy the requirements of those contracts.
Ahh figured it'd be something like that.
Pretty uncommon to host company credentials via 3rd party as policy. It wouldn't even be legal under national law for my field of work for example.
Obviously situations are different but the majority of standard businesses will let bitwarden host. In fact, I'd put more trust in bitwarden than than most self hosting teams.
Great I do the same too!
It’s so cheap! The value for the price is astounding.
I use the business plan to seperate personal and business but the sharing features are also great.
Oh wow, is it really cheap?! Good much money can I invest right away?!? 11?!1111!
I just recently started using their totp function and I can't believe I didn't switch sooner. Just the fact alone that it automatically copies the code to your clipboard is such a Time saver not having to open up a separate app.
It's a wild time saver. I can’t believe other folks go to a whole separate app for their codes! Hitting Ctrl+L to autofill passwords and user names then Ctrl+V for TOTP feels like a hack when I watch other people struggle with their other solutions.
I use a separate app for my codes, if someone somehow gains access to my Bitwarden if they have TOTP as wellcthrn they have all my accounts. With my TOTP in another app they still can't access them.
What do you use?
Personally I like Microsoft Auth. It just works well for 365
Not OP but, consider using something like a YubiKey or similar hardware key for your second factor authentication.
They usually support multiple protocols so you only need to carry one around - and storing your second factor with your passwords is like putting all your eggs in one basket.
Print out recovery codes or get an ekstra hardware key for backup and you get great security for surprisingly little effort.
Right! I was using Authy so I didn't have to grab my phone every time, but even that was still having to open the Authy app and wait for it to load, copy+paste. But using the keyboard shortcuts for Bitwarden is just so fast. Like you said, feels like a hack. It even auto copies on Android and with the autofill, makes it so easy.
I use keepassxc which autofills. Then 2fsa has an addon that auto adds the code. I'm in in under 10 seconds. I dread the idea of keeping my passwords and TOTP in the same vault.
FYI, This product is 100% marketed on Lemmy for a profit. I've seen astroturfed threads multiple times now.
Free app marketed for profit... There might be something wrong with you
It kinda does feel like it’s being promoted here, which seems unnecessary for a free, open-source program hahaha
Might just be because people really like it and want to share.
I don’t doubt that! I’ve just seen it mentioned a LOT, much more than any other sites I’ve visited.
I’m not suspicious about it anymore, though—if it wasn’t a free open-source program, that would be a different story! Spotting obvious ads disguised as comments everywhere on Reddit was always fun.
Same, the last few posts about a password manager was heavily voted for bitwarden and keypass. It is suspicious, but at the same time Lemmy is primarily filled with techy programmers that are more in tune with tech than most people and lean toward open source and pirating.
I really don't think it is promotion via paid users. It was talked about on Reddit a lot because it's really good and the users like to promote it.
I kinda thought that too, but it’s free and open-source… so that would be weird.
Looking into password managers, though, it does really seem like the best choice. Lastpass had breach lately, KeePass requires self-hosting, and other offerings cost more (and aren’t open-source.)