Actually, the part of the article that made me prick my ears up was this paragraph:
In February, longtime CEO Michael Crandell moved to an advisory role, according to LinkedIn, with no announcement from the company. His replacement, Michael Sullivan, former CEO of both Acquia and Insightsoftware, touts his experience with “all facets of mergers and acquisitions” on his own LinkedIn page, including experience working with leading private equity firms.
In combination with downplaying the free plan and removing any hint of now politically unfashionable DEI-like language, what this screams to me is: Bitwarden is being prepped for a sale.
This is what made me and others nervous when they announced a huge investment into the company a few years ago. It was already a good and self-sustaining product, and taking on that investment was just going to create an expectation of returns later down the line, something that was more likely to result in enshittification.
I stopped endorsing closed-source software to friends and family years ago, because you can't trust the companies behind them not to quietly change directions.
Years ago I used a free workout app that I really liked. After a few months of using it I recommended it to friends. I only much later found out that I was on a grandfathered version of the free plan without ads or restrictions. The company had made changes to the free plan since I joined, and all new accounts (like my friends) were subject to ads and restrictions.
It was embarrassing to have unknowingly recommending something like that.
Bitwarden is open-source though? This is about the hosted version of it, which has a free tier. But you can run the same software on your server at home if you want, for free.
(That said, I am also concerned about the direction Bitwarden is taking. I just think this shows that even OSS projects can have direction/rugpull issues.)
You're right, though the friends and family that I would feel the need to recommend a password manager to aren't the type that would self-host their own servers.
I've paid for and recommended Bitwarden. For years it's operated along a stable trajectory. I was confident in its security record. Vaultwarden is an escape hatch I'm in a position to set up for my family as a last resort. Almost any reputable password manager is more secure than reusing the same passwords or storing everything in a note file.
What I stopped doing so frequently could be described as "evangelizing" or "endorsing". I no longer actively tell people that I think they should use X, instead, if someone asks, I say "I use X, and it's worked for me so far".
- KeePass files synced between laptop and phone on OneDrive, DropBox, etc
- KeePassXC on Windows and Mac
- Keepass2Android mobile client
- Browser integration on mobile.
- On laptop, I prefer no browser integration; Copy username and password with Ctrl+B and Ctrl+C
The server is only recently free, if indeed it is at all. I don't remember when or if that changed, because for most of its life it was definitely not free (open source).
How long after a public sale will Bitwarden clients keep compatible with Vaultwarden? The new owners could put a check in all clients on the first day of ownership if they wanted, and Vaultwarden would immediately be obselete and useless.
I wonder if Bitwarden shit on everyone, how long it would take for Vaultwarden specific clients to appear. A browser extension would be pretty simple, app store apps are a bit more complicated because of the pay-to-play aspects.
The problem is once Vaultwarden clients appear, then Vaultwarden becomes its own complete system and is no longer able to rely on the good reputation of Bitwarden. Plus developing clients for multiple browsers and OSes is a lot more difficult than just keeping a back end up to date.
If they went this path I think I would jump ship to a paid service.
Vaultwarden relies on the goodwill of Bitwarden to allow it to use its clients for compatibility. I would wager a new owner looking for money would block that pretty soon after buying the company.
Again, for how long? The answers to all the questions seems to be the same. If Bitwarden was sold they could remove all of this free functionality and interoperability with 3rd party clients immediately.
Then you could say well Vaultwarden will work with these forked clients, but then you are placing your security into the hands of multiple different open source maintainers and vaultwarden then has nothing to do with Bitwarden and becomes some random back end + some random 3rds party clients.
Sure, but vaultwarden as a system would be entirely usable, I don't think a lot of it is really relying on the bitwarden compatibility for much more than a little convenience.
Useable yes, but trustable? Not without some serious backing and regular auditing from some public security experts.
IMO that fact that the existing Vaultwarden system relies on Bitwarden clients and therefore caries Bitwardens secure reputation is its main selling point. Take that away and Vaultwarden is nothing more than some random back end software that can not really be trusted.
> the existing Vaultwarden system relies on Bitwarden clients and therefore caries Bitwardens secure reputation is its main selling point.
I hope that this could be a starting point and not an end-point of Vaultwarden. It has gotten far on the shoulders of the Bitwarden giant. If it forked, would it have a large enough community to continue to carry that trust forward (including building new clients)? How much financial support would they need? Could they find a sponsor? It's a European project -- would the EU help fund it as a data sovereignty push?
Agreed, it would be great to have a fully open source solution, however I would be wary of it until it was audited and backed by secuirty professionals in the field.
Early adopters are exactly the people that like to test and recommend things to the majority. Without being aware of it, I was recommending a different product than the one I was using.
People stake their own personal reputations behind their recommendations. I don't think quietly changing the product without warning is doing right by their early adopters.
The price doesn't seem bad, though this case smells of some sort of greater internal shift that's, at least for me, indicative the Bitwarden is being turned into a profit-machine-at-any-cost rather than providing a good service for money.
This new CEO is a massive red flag. Literally nothing about anything relevant to the product or industry, though he's apparently good at private equity and selling orgs.
Probably worth jumping ship now before it mutates into another shitty corporate org, except this one is keeping your passwords.
I've paid for Bitwarden for years, but I can come to no other conclusion from all this (CEO all about private equity, severe price hike, scrubbing of core values, hiding the free tier) that it will be sold soon. Time to jump ship!
There are 2 versions out there, the one from Bitwarden itself, and an open-source rewrite called Vaultwarden.
But, the main developer of works at Bitwarden.
Thankfully you can easily export your passwords and move to another system (unlike say Authy where we had to inject Javascript to extract the TOTP seeds).
Thank you so much for posting this. I have been paying the annual 10$ (which went up by 2$ this year), but now it looks like I have to pay a whopping 30$ a year (a 3x increase, with no increase in features or value at all).
The cherry on the shit cake is that they did not give me any heads up at all. Quite sad. Bitwarden has been consistently one of the best pieces of softwares I have ever used. Simple, just does what it does and gets out of the way.
You don't need to be a system backup expert to take backups, and with that attitude you will never become a system backup novice either. There is no gaurentee paid services will keep your data available either. One company lost my data and I was very glad to have backups.
The writing on the wall seems to have been when they suddenly doubled the price of a yearly subscription without notifying anyone. That struck me as skeezy as **...looks like it may just be the beginning.
I hope people are actively mirroring their GH repos, because I expect at some point they might suddenly decide to change the license to Proprietary and move to scrub the repos from the web. At which point, the community will then fork the last-free version and start to maintain a fork.
Which I really don't want to see happen, because having to move all my shit for myself and my family again after the LastPass debacle is going to be an extraordinary headache.
I feel glad that I never went paid (though I do pay for software and services). Bitwarden always seemed laggy: both the development pace and the iOS app (though the latter improved a bit only in the last two years). The moment Bitwarden took VC funding ($100 million?), it was clear that it would “pivot” to enterprise, raise prices for consumers and do other things that describe enshittification. It’s probably in the same league as 1Password (another scummy company with similar practices and deteriorating applications).
On password managers, anyone using ProtonPass want to chime in on how it is? I’ve read online that Proton (as a company) has a tendency to start working on new things all the time and let the ones they created remain half baked and languishing (to some extent).
I’m not into KeePass and other local password managers since I need a shared solution for multiple people using the same vault.
what's a good open source and secure alternative? even if payed? I've been using bitwarden for years but this change plus their new CEO gives me pause.
Now I started to worry about their clients openness to work with valultwarden. They also said in the past they will not change the behavior to not accept third party servers. But who knows now.
As much as I hate the changes Bitwarden is making, I’m kinda with them on not adding official vaultwarden support. Having to support multiple backends (some of which you don’t control!) with your frontend makes everything massively more complicated.
Unfortunately that has no team features, and last time I checked they were quite pushy about not adding any - which is totally fair, they know what product they want to make and are sticking to it! But BitWarden has good team features.
Last time I looked into this, you really couldn't in a reasonably simple way. It was possible between two users, but more than two just caused issues with syncing.
Syncing between your own devices is still an easier problem to solve than syncing between different users. The database is just a file.
I use a self hosted Nextcloud, but you don't have to.
KeePassXC allows you to automate opening a database from the URL column. My family and I share a second database and open it from there, but it's super kludgy on any other device.
Oh yeah, I love having to manage sync conflicts in my password database because I was dumb enough to edit it on two separate computers that weren't both online at the same time.
Yeah, my main reason to stay away from Keepass, everything is in a single versioned binary file. I like 'passwordstore.org', where every secret is it's own gpg-encrypted textfile in a git repo. Every change is a commit, easy to see history, easy to revert or know which version is newest. And easy to selfhost, you just need a place to git push/pull from.
My first bitwarden invoice is dated november 2019. My concern here is 'squeeze' type activities that other companies with strong M&A leaderships have brought to their customers. For consumers, loyalty is exploited, not rewarded, and one must be vigilant for signals to jump ship.
I think the deal is pretty clear with stuff like this: Free accounts for individual users, earning money with businesses.
It's not like Bitwarden is giving away their product without getting anything in return: The free users (tech-savy early adopters) were the ones that pitched Bitwarden to their bosses when they were looking for a password solution for their company. It's really no different than Adobe or other companies giving away student licences. Companies are not stupid.
Would you really be okay with HN charging monthly to use the site? HN probably stores more data anyways, passwords are pretty small in comparison to comments, and I produce more of them aswell.
In February, longtime CEO Michael Crandell moved to an advisory role, according to LinkedIn, with no announcement from the company. His replacement, Michael Sullivan, former CEO of both Acquia and Insightsoftware, touts his experience with “all facets of mergers and acquisitions” on his own LinkedIn page, including experience working with leading private equity firms.
In combination with downplaying the free plan and removing any hint of now politically unfashionable DEI-like language, what this screams to me is: Bitwarden is being prepped for a sale.
LogMeIn buys Lastpass, multiple massive breaches occur[, people move to Bitwarden].
Years ago I used a free workout app that I really liked. After a few months of using it I recommended it to friends. I only much later found out that I was on a grandfathered version of the free plan without ads or restrictions. The company had made changes to the free plan since I joined, and all new accounts (like my friends) were subject to ads and restrictions.
It was embarrassing to have unknowingly recommending something like that.
(That said, I am also concerned about the direction Bitwarden is taking. I just think this shows that even OSS projects can have direction/rugpull issues.)
I pay for a service for my family because I need reliable and easy for my wife and daughter to use it.
What I stopped doing so frequently could be described as "evangelizing" or "endorsing". I no longer actively tell people that I think they should use X, instead, if someone asks, I say "I use X, and it's worked for me so far".
Whats to say this will still be true if the company gets sold?
If they went this path I think I would jump ship to a paid service.
Then you could say well Vaultwarden will work with these forked clients, but then you are placing your security into the hands of multiple different open source maintainers and vaultwarden then has nothing to do with Bitwarden and becomes some random back end + some random 3rds party clients.
IMO that fact that the existing Vaultwarden system relies on Bitwarden clients and therefore caries Bitwardens secure reputation is its main selling point. Take that away and Vaultwarden is nothing more than some random back end software that can not really be trusted.
I hope that this could be a starting point and not an end-point of Vaultwarden. It has gotten far on the shoulders of the Bitwarden giant. If it forked, would it have a large enough community to continue to carry that trust forward (including building new clients)? How much financial support would they need? Could they find a sponsor? It's a European project -- would the EU help fund it as a data sovereignty push?
People stake their own personal reputations behind their recommendations. I don't think quietly changing the product without warning is doing right by their early adopters.
This new CEO is a massive red flag. Literally nothing about anything relevant to the product or industry, though he's apparently good at private equity and selling orgs.
Probably worth jumping ship now before it mutates into another shitty corporate org, except this one is keeping your passwords.
All those people who paid half a mil on education must appear useful at the expense of us all!
But, the main developer of works at Bitwarden.
Thankfully you can easily export your passwords and move to another system (unlike say Authy where we had to inject Javascript to extract the TOTP seeds).
The cherry on the shit cake is that they did not give me any heads up at all. Quite sad. Bitwarden has been consistently one of the best pieces of softwares I have ever used. Simple, just does what it does and gets out of the way.
Sad really ...
I'm moderately decent at self hosting. I'm fairly confident in my backups and security.
But also, I am not a system backup nor security expert, and I don't want to become either.
The one last thing that I really want to leave to the experts is my secrets management.
My worry however is about the future - what if a core functionality goes behind a paywall.
The writing on the wall seems to have been when they suddenly doubled the price of a yearly subscription without notifying anyone. That struck me as skeezy as **...looks like it may just be the beginning.
I hope people are actively mirroring their GH repos, because I expect at some point they might suddenly decide to change the license to Proprietary and move to scrub the repos from the web. At which point, the community will then fork the last-free version and start to maintain a fork.
Which I really don't want to see happen, because having to move all my shit for myself and my family again after the LastPass debacle is going to be an extraordinary headache.
They also ruin software.
On password managers, anyone using ProtonPass want to chime in on how it is? I’ve read online that Proton (as a company) has a tendency to start working on new things all the time and let the ones they created remain half baked and languishing (to some extent).
I’m not into KeePass and other local password managers since I need a shared solution for multiple people using the same vault.
whenever i need any new feature, i just add it.
Just use KeePass.
I use a self hosted Nextcloud, but you don't have to.
KeePassXC allows you to automate opening a database from the URL column. My family and I share a second database and open it from there, but it's super kludgy on any other device.
Obviously predictable. Bitwarden is now in the extraction phase and it is now time to pay an expensive...
...$1.65 a month.
[0] https://news.ycombinator.com/item?id=34427981
It's not like Bitwarden is giving away their product without getting anything in return: The free users (tech-savy early adopters) were the ones that pitched Bitwarden to their bosses when they were looking for a password solution for their company. It's really no different than Adobe or other companies giving away student licences. Companies are not stupid.
if the company can't keep the promises, then maybe they shouldn't make them in the first place?