- cross-posted to:
- linux@programming.dev
- technology@lemmy.world
- cross-posted to:
- linux@programming.dev
- technology@lemmy.world
RyanL Bitwarden Employee
Hello everyone!
Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.
Bitwarden remains committed to open source security and transparency
The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone
If you have any questions, please ask them in this thread. Thanks all!
EDIT:
Bitwarden is not going closed-source
You can still fork Bitwarden
No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden
The free plan is here to stay permanently
You must log in or register to comment.
Well, we all know how this ends…
It’s a really sad day for me, I love Bitwarden, it’s easily the best password manager I’ve used, and I’m in IT, I’ve used a bunch.
Fuck private equity, fuck it to death. But until then, I’ll be moving my test setup for KeyPassXC into production over the coming weeks and months.
I was happily subscribed to Bitwarden for years for my personal account, I moved several people and a whole company onto its platform. We had a good run, time to move on.
why not vaultwarden?
If I’m going to have to host my own infrastructure, I don’t want it tied to Bitwarden, given the new direction of the company.
I fully support Vaultwarden though, and I wish them well.
I’ll be going with KeyPassXC and Syncthing.
Vaultwarden (and all the client apps) depend on Bitwarden for the API spec. If Bitwarden introduces closed features in the API that Vaultwarden can’t/won’t implement, but the client apps do, it will split the spec. They can also introduce API license keys, which would render Vaultwarden mostly irrelevant.
The only way for Vaultwarden to remain relevant going forward is to own it and split ways from Bitwarden. This would in turn mean that the FOSS client apps have to decide which to support. But I think the ecosystem is going to fragment eventually anyway, so the sooner every app decides which way they want to go, the better.
I’m. Using Vaultgarden but its not clear if the Android app will still be available.
I’ve been very happy with Vaultwarden+Keyguard
Edit: I had not looked closely enough at the license and did not realize it’s not FOSS, my bad
But that’s not Foss, so I didn’t consider it
It is free and open-source on Desktop at this moment.
Keyguard is a commercial app and unlocking a premium funds its further development and supports me (Artem Chepurnyi) directly. As of right now, only the Android builds distributed via Google Play store have main features locked behind a paywall, other distribution channels have a build with everything unlocked.
But it makes sense to pay for it, since Bitwarden is a constantly changing system and these projects based on it must always be up-to-date with their API changes, too. This is time and worry consuming, and should be compensated.
License is: all rights reserved.
That’s free like in beer, and open like ‘allowed to inspect’ that’s not what most people mean when they talk of Foss.
source: https://github.com/AChep/keyguard-app/blob/master/LICENSE
Thank you for pointing this out- I’d managed to completely miss that it seems. That’s unfortunate
Roger that. Thank you for the clarification that you meant the actual term, and not just the fact of no mandatory payment and it having an the source available for public.
I get what you mean, yet frankly, I do not believe such projects may be always free that are supposed to always be up-to-date for another system they have no official relation to, and keep it as a responsible hobby other people depend on.
It currently doesn’t work with Vaultwarden. The Linux client doesn’t accept custom certificates. And the Android client is paid. It is a dead-end for self-hosting.
The license is also stupidly a single sentence. Which means that use could be nuked at any minute, and any money you use to pay the developer means nothing. If they wanted to kill the project today and nuke the repo, you have no legal rights, the project dies and fuck you and your passwords. That doesn’t exactly inspires confidence.
Thank you for pointing out that the license is not FOSS, I hadn’t noticed that. I suppose I’ll be exploring my options again.
I’d been using the Android client from f-droid and hadn’t needed to pay for it, which was working with my VW server. On my desktop/laptop I use rbw, so I hadn’t noticed the cert issues with the kekeyguard desktop client.
Awesome!
100% but move where? I’m not going to self host something this critical. KeypassX is so much worse. I can’t even use it on mobile probably.
You can use KeePass on mobile, look for KeePassDX on fdroid.
Heh, I’m looking at you to those people that looked at me weird because I told them I was good with Keepass!
I pay for their product and its totally worth. It was $10 for the longest time and much like everything in the last few years has increased price to what it is actually worth. To be honest $20 a year is still stupid cheap and worth it to keep them developing the product. Bitwarden is also one of the few password managers that hasn’t had a user data breach.
Does anyone know if there’s any chance for a fork before this situation inevitably deteriorates? I dont know the license on that software enough to know if its an option.
are u gonna maintain clients?
No, I have money to pay instead. If I were able to contribute to the effort, I would have said that. Just picking fights in response to open questions today?
There is no way I’m self hosting something this important… So now I’m not sure what to do actually.
That’s why I’m just using KeePass. It’s just an encrypted file that you can store on whatever storage you want and sync with existing solutions like Syncthing etc.
Yes it’s a bit finicky when you edit the file on multiple devices before they’ve synced but it works very well for me…
Having only ever used keepass, what was the advantage of bitwarden? That you didn’t need to sync it yourself?
That you didn’t need to sync it yourself?
and that you have to never deal with sync conflicts. It’s a huge deal for those who are using tech but not understanding it, and a convenience for the rest
That’s the main benefit yeah.
I use the send tool as well for sensitive files
It’s also way easier to have shared passwords for family accounts.
Not surprised in the slightest sadly.
wow, setting up vaultwarden quadlet to work with my selfhosted OIDC sso was stupid easy. Migrating my bitwarden setup to it took no time at all. The extra step was setting up some extra pocketid passkeys to be stored on non-vaultwarden hosted systems (ie. google) to prevent myself from being locked out in case vaultwarden crashes (which probably was a good idea to do regardless). Just need to add the data volume to my regular backup.
It is effectively going closed source
How so
They don’t make any money off of the open source version. It is just a matter of the before they “discontinue” the open source version and move to source available.
If you have any doubts just look at Redis, Vagrant or Terraform
You can watch this same process unfold live before your eyes with Android OS, or if you don’t want to miss the beginning of the show, grab some popcorn and watch these guys.
Yeah we have seen the same process many times now.
I really hope they don’t go that route.
A different licence for the commercial version isn’t a bad thing in se, in my opinion
So, Vaultwarden it is?
This seems to be clients for the end devices, which I’m worried may actually be a move towards locking out VaultWarden which will uses the BW Clients
Fine to me as long as this doesnt impact Vaultwarden
What’s the benefit for them to change the license?
Money
commercial providers can’t fork and sell it and give nothing back to the OSS community.
So basically they were getting undercut by people reselling the same a services under a different name.
And not having to do R&D
What differences will exist between the two parallel versions?
Some future components will be published under the commercial license and will exist only in that build. Newly developed features will be evaluated on a case-by-case basis for which license applies to them.
source: the page linked by OP, https://community.bitwarden.com/t/published-version-update-in-app-stores/102750/4
Are they still going to publish the Android client app via their own F-Droid repository?
Does anyone have a handy guide to switching to selfhosted version? I was considering doing that but I let my plan renew out of laziness.
My knowledge of network security is very limited, right now I only self-host things like movies, music, ROMs, etc. I would love to do the same with my passwords, but I don’t think I would feel comfortable doing it with such sensitive data.
A viable concern if you wanted to put it public-facing. If you only care about syncing when you’re home, though, you should be able to host it perfectly fine just not giving any pathways in from the outside world.
If you wanted to use the Android application, you would have to learn about TLS certificates anyway, because it doesn’t work without HTTPS.
Works fine with acme certs though
I’m personally using Let’s Encrypt and duckdns.org for a completely free solution.
Currently only hosting everything on my local network though with VPN to access when not at home.
Here it explains some self host options with links to “Get Started” for each:
https://bitwarden.com/help/self-host-bitwarden/
For example, here’s the link to “Linux standard deployment”
https://bitwarden.com/help/install-on-premise-linux/
You may also want to consider not making your server available to the open internet, and instead access it only on your LAN via VPN.
That or jump to Vaultwarden https://github.com/dani-garcia/vaultwarden
Is there another client we can use with vaultwarden though? (In the scenario wgere that gets locked down)
The web interface is hosted directly by your vaultwarden interface so it’s not lockdown-able. The only things that are would be the browser extension and phone apps. Both of which are formally unnecessary because you can always just use the web interface. I’m sure if they ever locked down there’d be community versions in no time as they’re basically just web wrappers anyway.
Ah of course, perhaps i’ll give that a go and see how it goes.
The apps keep a synced local copy, so if the server is down or unreachable you can still get to your passwords. That can also be locked by biometrics etc.
There’s a lot of stuff that without be lost by going to just the web interface
There is an iOS app for Vaultwarden. Under that name.
https://apps.apple.com/za/app/vaultwarden-password-manager/id6799711599
Don’t see one for Android. And for the rest I just online.
Idk how it compares feature wise, but i have been running keepassxc/keepassdx combined with syncthing (or any file synchronization/cloud system) for many years without issues. The entire password manager database sits in one encrypted .kdbx file that you keep synced between your devices. Syncthing is nice because its p2p, so no self-/hosting required.
https://keepassxc.org/
https://github.com/keepassxreboot/keepassxchttps://f-droid.org/packages/com.kunzisoft.keepass.libre/
https://syncthing.net/
https://github.com/syncthing/syncthingI had done that for a long time. It worked until it didn’t and I lost passwords. I tried again with keepass2android and it’s built-in sync. It again worked fine until at some point it wasn’t able to sync anymore for no discernible reason. I’d love for this to be a reliable setup, but it just isn’t in my experience, at least when there are 3+ devices involved with different clients and no proper awareness of the password manager and the sync sides of each other.
Exactly. No way I’m going to use this for something critical.
Every single time Bitwarden is mentioned on the internet, someone comes in here and proudly recites the anthem “I have been using Keep ass with sink things”
It sucks compared to a dedicated extension.
No autofill No TOTP or 2FA support Doesn’t do passkeys Doesn’t have organizational sharing Doesn’t sync to mobile devices Doesn’t integrate with mobile browsers without trusting some compatible 3rd party app Requires selfhosting your passwords (don’t fuck it up!)
It’s actually pretty sad that the open source world doesn’t have a better solution for this. I mean I guess BitWarden was it but that’s been stolen by venture capital so
Both KeepassXC on desktop and KeepassDX on mobile support autofill, passkeys, and TOTP. Syncing to mobile devices is handled by Syncthing (I use BasicSync on Android) and is quite seamless after setup.
Integration with mobile browsers and other applications is handled by the OS-level autofill service (at least on Android). Trusting a third party app that is completely open source and has a ton of eyes on it? I don’t see a problem with that.
Selfhosting is literally the entire point, since who more can you trust with your most sensitive information than yourself? And even if you don’t trust yourself with being able to keep good backups and following the 3-2-1 rule, you’re more than welcome to sync with a third party cloud provider of your choosing since the password file is fully encrypted.
Why is it that every time i comment about keepass, its because some web based password manager once again broke, got hacked, or stopped development. Keepass users just stay winning :)
Also i have been using keepass with TOTP 2FA for years what are you on about?
Also also, you shouldnt use fido passkeys. Its a failed technology that is worse than what it tries to replace.
There isn’t anything wrong with passkeys that can’t also be made wrong with passwords, and there isn’t anything more secure about passwords, at all.
Please don’t tell me you took that article that was spammed all over here a few days ago at face value…
I just wish Syncthing didn’t have such a convoluted port usage, and also that its Android usage didn’t revolve around an unofficial app.
So I’ll stick to apps that do sync over SSH (using FolderSync atm).
Yup great combo. It baffles me why anyone one would favour to depend oneself on an online service instead
That’s my stack, except swap keepassdx for keepass2android, and add the Firefox plugin.
I used keepass but switched to vaultwarden, i might consider switching back, but is there a good self hostable web front end for a keepass database? (I need to access it on my work laptop and can’t install stuff there)
There is KeeWeb but I am not sure how well maintained it is. This issue is still open. It might be worth contacting your employers IT department instead. Asking for a well known password manager like KeePass shouldn’t raise any eyebrows.
It’s syncing it to my work laptop that would be the issue.
I just keep my KeePass file in a Nextcloud and occasionally synchronise manually via WebDAV.
I dont think there is. Keepass is trying to be as offline as possible. Just makes for a piece of software with much less attack surface.
Claude, code me a bit warden clone…
Careful, Claude is very sensitive these days. Might want to add ‘please’ and ‘thankyou’.
Anthropic is drawing a line in the sand protecting their model’s training sets from abuse.
Meanwhile OpenAI is down in a dungeon torturing GPT6 into writing academic mathematics papers.
They say if because AI will conquer the world… Reality since they use conversations to train AI, their AI is becoming less gentle.
