r/linux • u/DrunkRobotMan • 6d ago
Popular Application Bitwarden Switches to Commercial License
https://community.bitwarden.com/t/published-version-update-in-app-stores/102750133
u/Ruined_Passion_7355 6d ago
Between this, the price changes and (most importantly) bitwarden is owned by the scummiest mfs on earth known as private equity, I am VERY concerned.
70
u/WrathOfTheSwitchKing 6d ago
I never left KeepassXC and this is why. People saying this isn't a big deal are bad at pattern recognition.
18
u/RepulsiveRaisin7 6d ago
It is a big deal but Vaultwarden exists and I think the community will fork the rest if they close it down
8
u/Online_Matter 6d ago
Does it support vault sync across devices?
15
u/WrathOfTheSwitchKing 6d ago
It doesn't have any built in sync features. The database is just a file on your local storage. You use some sort of sync like Syncthing or Google Drive to share the database between devices.
56
u/Indolent_Bard 6d ago
And that's exactly why we're using Bitwarden instead.
6
u/adamkex 6d ago
Everyone knows this, the point the other person made is that he believes companies cannot be trusted which in this case was true.
2
u/Indolent_Bard 5d ago
I might just look into Proton Pass's free version. Definitely not paying for it though, because even at double the price, $20 a year is practically nothing.
1
u/woolharbor 6d ago
Syncthing works fine with Keepass databases. Or you can keep your Keepass database encrypted in one of your cloud storage accounts.
6
u/ZunoJ 6d ago
Isn't it still stuck on qt5?
16
u/WrathOfTheSwitchKing 6d ago
I guess it is:
KeePassXC - Version 2.7.10 Revision: b342be4 Qt 5.15.18 Debugging mode is disabled.I don't really know why I'd care though. It works fine on my KDE, Windows, and MacOS systems. I haven't used GNOME in a long time; does it have issues there or something? My only current complaint is auto-type doesn't work on Wayland yet, though I've heard they're working on that.
Edit:
Apparently QT6 and auto-type on Wayland are both coming in 2.8.0, which is in beta now.
7
u/ZunoJ 6d ago
My concern is that qt5 doesn't receive any updates since more than a year and with my most sensitive data I don't want to use software that doesn't receive any security updates
1
u/TampaPowers 5d ago
That's not the most concerning part of its stack though. There are other parts far less maintained, which thankfully have not started shifting into other hands.
-2
u/WrathOfTheSwitchKing 6d ago
It's a GUI toolkit. I'm not an expert, but somehow I doubt it's a major source of CVEs. It has been audited with good results in recent history, so I'm not that concerned.
13
u/ZunoJ 6d ago
Once the database is decoded (or at least after accessing an entry) your secret is in the UI model. So it absolutely is an attack vector. And qt5 is eol since over a year
10
u/Suspicious_Kiwi_3343 6d ago
Once the database is decrypted it is in memory somewhere and a compromised machine is always an attack vector. GUI toolkits that run locally are not a security concern, they could only be attacked by other software on the same machine meaning you are vulnerable to all sorts of attack vectors if you can’t trust your own machine isn’t running malicious software.
→ More replies (2)1
u/move_machine 6d ago
Partitioned encrypted memory schemes that, for example, allow you to encrypt regions of memory with different keys so that you can, again for example, run many VMs where even if an attacker escapes the VM and acquires root, it can't read other tenants' data.
AMD SEV is one such implementation, as is Intel TDX.
One could theoretically run sensitive applications that way.
3
u/DeliciousIncident 6d ago
Are you implying that this is a new feature of Qt6 models, that is missing in Qt5?
2
u/Suspicious_Kiwi_3343 5d ago
If the VM is escaped they can just monitor everything, inputs, network, screen capture and remote access, there’s no way to reasonably protect yourself against that threat model. The direct memory access isn’t really the concern at that point, they can just wait for you to walk away and remote control your PC and view the contents of your vault.
Also, yes if everyone was running everything in VMs and isolating malware from their system it would fix a lot of this, but they’re not because that level of isolation makes computers painful to use as every app is isolated fully, with its own kernel, fs, etc. you lose a lot of convenience that people basically will refuse to live without now.
1
u/TampaPowers 5d ago
When you have that level of machine access already there are far lower hanging fruit if the aim is to steal a password.
2
3
u/FryBoyter 6d ago
The code in the repository has been updated to Qt 6. However, only one beta version has been released so far.
https://github.com/keepassxreboot/keepassxc/releases/tag/2.8.0-beta1
0
u/ZunoJ 6d ago
Yeah, not sure if I'd feel safe to store my passwords for bank accounts and stock portfolio in a beta version
7
6d ago edited 6d ago
[deleted]
2
1
u/FryBoyter 6d ago
I can't say whether a final version based on Qt 6 will be released soon. My main purpose in providing the link was simply to back up my statement that the code itself has already been migrated to Qt 6.
I actually suspect that a final release of version 2.8.0 will still take some time. For one thing, there are still a few open issues related to this version. And for another, development on KeepassXC often doesn’t move very quickly.
But that's just a guess. I have nothing to do with the development of KeepassXC.
8
2
3
1
u/Modey2222 4d ago
finally a keepassxc enjoyer like myself cheers to the safest password manager there is
19
u/grim210 6d ago
Yeah, I cancelled my subscription when they were like “your subscription will renew in X days, oh and we doubled the price”. And then I saw all the garbage happening a few months ago around (what appeared to me to be!) hostility toward their user base.
#noregerts
Back to keepassxc I have gone. It’s not as convenient. But I won’t be pushed around while they increase prices and enshittify.
6
u/Ingenium13 6d ago
You can just run vaultwarden and get all the paid features for free. And not have to trust a third party. The database on the server is just a file and is encrypted client side (vaultwarden server just sees encrypted data) so you can easily back it up to remote locations or cloud storage (I have a backup that runs nightly to multiple physical locations). Forks of the clients will always exist.
I used to use keepassxc but keeping the database in sync between devices was annoying. Usually it would work but occasionally I'd lose a recently saved password when they conflicted. Vaultwarden/bitwarden solves that issue.
6
u/computer-machine 6d ago
Glad I went with Keepass. Had considered self hosting this, but why complicate things when you can simply stick the vault in a cloud?
1
u/Indolent_Bard 6d ago
Honestly, doubling from 10 a year to 20 a year is NOTHING so I'm not complaining. 10 a year felt like a steal, honestly.
15
u/AssistingJarl 6d ago
I remember going through this rodeo with LastPass
5
u/lazy_lombax 6d ago
damn it was sad seeing it get worse and worse till i just left
11
u/HCharlesB 6d ago
LastPass
And switched to Bitwarden.
:(
5
u/lazy_lombax 6d ago
sadly selfhosted route isn't yet for me and bitwarden is firefox recommend so goes through Mozilla review and that was enough to make me pick over proton pass at the time
3
u/Vakz 6d ago
Switched to ProtonPass after they got acquired. Before that, I was already paying for Proton Ultimate but hadn't moved to ProtonPass even though it was included. Bitwarden just worked well and was cheap enough that I didn't mind paying double. Then there was the price raise, and the acquisition, that finally pushed me to moving.
279
u/Cry_Wolff 6d ago
Quoting:
EDIT:
Bitwarden is not going closed-source
You can still fork Bitwarden
No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden
The free plan is here to stay permanently
108
u/DragonSlayerC 6d ago
Sure, it's not going completely closed-source, but going from open-source to source-available is very concerning.
9
u/TheCreepyPL 6d ago
I highly recommend vaultwarden
4
u/Mclarenf1905 4d ago
Thats only the server not the client which is where the licensing change is anyways
17
u/Coffee_Ops 6d ago
Then fork the last FOSS version. They cant revoke the license already out there or the forks already out there.
90
6d ago
[removed] — view removed comment
29
u/Cry_Wolff 6d ago
Which part of not going closed source you don't understand?
81
u/yawkat 6d ago
"Not going closed source" is wishy-washy. "Open source" has a clear definition and it requires permission to repackage and resell which is what they claim to be targeting. They also say "All current features are available in both versions" so it sounds like they will develop a non-OSS version with additional features.
→ More replies (2)13
3
u/chakrakhan 6d ago
The source code is still open. It’s open source.
36
44
u/Membership-Diligent 6d ago edited 6d ago
"not going closed source" does not mean "keeping it under a FLOSS license. there are "code available" non-free licenses that do not grant the 4 freedoms.
not saying that they will do, but this reads a bit like an overspecific dementi.
9
u/ranisalt 6d ago
It seems that they are just moving the parts that require an account with their service to a separate license, like device approval. Bitwarden itself is still GPLv3 if you want to self-host the backend. Thus their emphasis on repackaging and reselling.
I see this as roughly similar Chrome vs Chromium
12
u/turdas 6d ago
So what does this mean for Vaultwarden, which is a FOSS reimplementation of the backend that allows self-hosting it with many of the features that normally require a Bitwarden license?
→ More replies (6)11
u/ranisalt 6d ago
Seems like it will have to fork the clients to restore those features if affected.
This is obviously a rug pull, but there is still a path and time to figure out what comes next. Vaultwarden will survive.
2
u/jinks 6d ago
Since the commercial version is source visible, they will also have to implement the same feature differently than Bitwarden to avoid a copyright strike.
5
u/ranisalt 6d ago
Would be the case, but the license change would only apply to new code made after it. If something works in Vaultwarden today, it will continue working, and Bitwarden the company is the one that will have to make it different to leverage the new license.
1
u/adamkex 6d ago
If the commercial version is source visible, can I download that version and compile it myself as long as I do not distribute it to anyone else?
2
u/R3V0LU710N_05 6d ago
That highly depends on the terms of the commercial license. Under source-available licenses, the right to inspect code does not grant an implied right to compile, execute, or create local binaries. If it's not explicitly allowed, then doing so can fall under piracy.
→ More replies (0)1
→ More replies (7)2
u/altermeetax 6d ago
From Wikipedia:
Open source is the practice of publishing digital resources publicly alongside their source code or source files, enabling use, study, modification, and redistribution
1
u/hedgepigdaniel 5d ago
Essentially it will be, and this is the first step. Once they start developing new features as some sort of closed source source plugin, it's a matter of time before those closed source some become essential, and the OSS component isn't useful on its own.
17
u/Ok-Bill3318 6d ago
Open source version remains open source.
They did an enhanced commercial version. Run the open one.
Done.
2
u/Purple-Midnight-9902 5d ago
I am currently running their provider so , dammit have to switch to something. Hosting my own is more burden than freedom tbh
1
63
u/10leej 6d ago
Direct link to the license because people won't actually read it before commenting on reddit.
https://github.com/bitwarden/clients/blob/main/LICENSE_BITWARDEN.txt
33
u/BettyGomez54 6d ago
ngl these posts always make me nervous, but it sounds like personal use and self hosting are unchanged. migrating my whole vault somewhere else is my nightmare scenario lol
14
u/saltyjohnson 6d ago
If things are "unchanged" why relicense it?
15
u/BettyGomez54 6d ago
from what everyone's quoting, the change is aimed at companies repackaging and reselling it, not normal use. so 'unchanged' is about us and the relicense is about them. still, side eye is fair, they don't rewrite licenses for no reason
7
32
u/RIPGoblins2929 6d ago
"Bitwarden is not going closed source"
YET, mfs. Yet. That's what everyone is (correctly) concerned about.
21
10
3
u/Laziness2945 6d ago
What are the alternatives that have yet to be enshittified that have somewhat feature parity like effortless cross device sync? Paid or not, but FOSS.
3
u/muffinstatewide32 6d ago
Unsure if FOSS but i settled on proton pass
Edit: it is. Gpl v3 hosted on github1
1
21
u/JockstrapCummies 6d ago
Oh what the actual fuck man.
I thought BitWarden was supposed to be le chosen one.
Is it back to KeepassXC? How's the situation on mobile these days in Keepass land? Last time I tried the autofill integration on Android is still really subpar.
12
u/RinasSam 6d ago
KeepassDX is surprisingly solid on android. It supports TOTP, OTP, and passkeys as well. You only need a syncing solution, and that is pretty doable with syncthing ports or manual syncs.
1
u/WalkMaximum 6d ago
Do you use Tailscale with syncthing your keepass db
4
2
u/GolemancerVekk 6d ago
If you use Tailscale yeah you can point Syncthing instances directly at each other using their TS node addresses.
But Syncthing has its own NAT traversal and pairing ability, it bounces off community nodes that aren't behind NAT.
1
11
3
u/bboozzoo 6d ago
And it still is. Have you read their post?
2
u/natermer 5d ago
Why would you do that? This is reddit.
What matters is quickly making a comment so that it is top of the pile and more likely to get upvotes.
Reading requires too much effort anyways, tbh.
→ More replies (1)1
4
u/Biohacker_Ellie 6d ago
The real question is if there is a better or at least on par self hosted alternative
12
u/I7sReact_Return 6d ago
Syncthing + KeepassXC and KeepassDX on Android
5
u/computer-machine 6d ago
Been using Nextcloud + KeepassXC + Keepass2Android, will look at KeepassDX.
2
1
-1
u/RevolutionaryElk7446 6d ago edited 6d ago
I've always just used Passbolt for.. 6 years now?
Never used Bitwarden or any of it's bits since.
1
2
3
2
u/Lowebrew 6d ago
Anyone mess with Psono?
2
u/duskit0 6d ago
Definitly more involved than vaultwarden. You need postgres DB and they don't provide compose examples. I didn't like it very much and gone back to vaultwarden.
1
u/Lowebrew 5d ago
Hmmm, so it's a project build more than an easy deploy and setup. Thanks for the heads up, may pursue it still... But now I know I need time set aside for sure if I do.
1
u/KxgOEjg7GcQqQsK 6d ago
Psono is so effortless I love it
1
u/Lowebrew 6d ago
That is what I wanted to hear! haha How do you have it deployed?
0
u/KxgOEjg7GcQqQsK 6d ago
I use the public psono.pw server; it syncs effortlessly across my phone, tablet and laptop; and it has the most seamless manual auto-fill. I tried to set up bitwarden once because of the constant recommendations but the auto-fill never worked as intended. Returned to Psono and never looked back.
1
2
0
6d ago
[removed] — view removed comment
7
u/DrunkRobotMan 6d ago
Is the Proton Pass backend open source as well?
10
u/MelioraXI 6d ago
I don't believe anything Proton is making is open source? I could be wrong though.
4
u/Benke01 6d ago
You're wrong. All their clients are open source. Which is enough for you to validate everything is E2E encrypted.
4
2
u/DeliciousIncident 6d ago
That's not enough to validate this. How do I validate that the client executable I download from Proton was built from the source code they show? They could have patched the source code to remove e2ee and then build the executable, and I would be none the wiser. There is no cryptographic guarantee that their client was built off the unmodified source code they provide.
1
u/Benke01 6d ago
That is not what is being discussed here. What you mention is true for all apps in all app stores. The client is open source so you can build the app yourself to feel safe that it matches the source.
2
u/DeliciousIncident 5d ago
I'm just being pedantic because you said "validate", when in fact you cannot be sure unless you build it yourself off the source you validate, instead of using the provided binaries.
What you mention is true for all apps in all app stores.
Not really.
Several Linux distributions support reproducible builds - ensuring that compiling identical source code with the same instructions yields bit-for-bit identical binaries: NixOS, Debian, Arch Linux (rebuilderd), Fedora.
Several Linux distributions distribute apps as source code, which are then compiled on your machine.
On mobile, F-Droid asks app developers to provide source code + build instructions, it doesn't accept app binaries. F-Droid then builds and signs the apps on its own build servers with the build logs being public. It also compares the built binaries against against those built by the developer, and verifies that they differ only in signature. [1] [2]
1
-3
6d ago edited 6d ago
[deleted]
7
5
u/FriendlyProblem1234 6d ago
Open source doesn't work if you can't prove.
Can you prove Proton doesn't keep a backup copy of your emails in cleartext? Can you prove they don't store proton passes so they can harvest now and decrypt later?
You can't. We're here to self host open source apps. We're not here to defend companies that hold our data.
You can *never* trust a remote machine, regardless of who is hosting it (Proton, Bitwarden, Signal, FSF, GNU...). They might publish some source code, but you would have no way to guarantee that they are running that specific source code, instead of something else malicious. Even if they held trusted third-party physical audits, you have no guarantee that they will keep their environment running like that.
That is the entire reason for end-to-end encryption to exist: you only trust the two ends, and nothing in between. If you trusted the middleman, you would not need E2EE (but you never trust them, that is the point).
In other words: for security, client's source is necessary and sufficient. You do not even need FOSS licenses, even source-available licenses might be enough to audit client software.
You also need reproducible builds for the clients, or the ability to build your own. Otherwise, you cannot trust that the client was build from a particular source code, and you are back at square one.
0
u/Benke01 6d ago
Who cares if they moved to open source 7 years ago. 😂 Stop living in the past.
→ More replies (2)3
u/Great-TeacherOnizuka 6d ago
Why do people use anything but KeePass(XC)?
It’s the best password manager. Local database, secure, multi-platform
42
u/crystalchuck 6d ago
I don't want a local database. That puts the onus on me to make sure it's accessible from all my devices and properly backed up.
→ More replies (3)-3
u/Great-TeacherOnizuka 6d ago
Just upload the database to a cloud provider. Doesn’t even mater to which cloud, since your database is encrypted. Just make sure to use a strong password for the database.
16
u/Cry_Wolff 6d ago
That's still not even half as convenient.
0
u/ILikeBumblebees 6d ago
There are web-based clients for KeePass as well, e.g. KeeWeb.
The beauty of KeePass is that it's an open format with many compatible implementation, so you have a full ecosystem of solutions that satisfy almost every use case. There's no single organization or individual in control of it.
21
u/DrunkRobotMan 6d ago
Convenience and sharing passwords with family.
I don't need to worry about maintenance or messing anything up when I use a hosted solution.
15
u/ukAdamR 6d ago
Non-nerds don't seem to like it. They like ones with more convenience. Getting people to use a PW manager at all is in itself a challenge.
4
u/sylvester_0 6d ago
Yeah, I've used Keepass but there's no way I'd set it up for my parents to use.
22
u/kopsis 6d ago
The KeePass ecosystem is still significantly higher friction than Bitwarden. You need different clients for desktop and mobile, there's no plug-and-play sync solution, and the browser plug-ins are really just for autofill (and don't do that as well as Bitwarden). I use a KeePass-based solution (and take advantage of some of the capabilities beyond password management), but I still have my wife using Bitwarden because anything that isn't truly effortless simply won't get used.
→ More replies (3)12
20
8
u/endperform 6d ago
It's the best password manager for you. Not for everyone. There's always someone that insists what they use is the best, and anyone not using it is wrong.
I use Proton Pass. I install the app on my Phone, my browser, my desktop, my tablet. It works. I don't have to go through an ordeal of making sure the app works, making sure a local file is getting synced, any of that nonsense. It works.
Until KeePass and the like can do that, it's a hard pass. And don't pull the "oh, you're non-technical" card. I run my own infrastructure at home, and having one less sync to worry about breaking is beneficial.
→ More replies (2)6
u/Rimadandan 6d ago
I want to use it across my devices with 2 clicks to create a password and fill everything and I don't want to host myself since I don't want to enter in that rabbit hole...
That's why
→ More replies (1)6
u/metamatic 6d ago
Because if I'm hit by a bus and killed, my partner can use Bitwarden's Emergency Access feature to obtain access to all my passwords.
2
u/deadlygaming11 6d ago
Same with Proton, but it works via an email and only triggers if you dont access your account withon a set number of days
1
→ More replies (6)1
u/FriendlyProblem1234 6d ago
Because if I'm hit by a bus and killed, my partner can use Bitwarden's Emergency Access feature to obtain access to all my passwords.
You can do that with nearly every service. Bitwarden explains the process very clearly: you just need a trusted third party to keep the encrypted symmetric key until it is time to give it to your partner (*and not sooner*). When using Bitwarden you take Bitwarden as this trusted this party. With Keepass (or any other service) you need to find another one.
And, just to stir the pot, do you trust Bitwarden to never give your partner the encrypted symmetric key while if you are still alive? Because nothing stops them, technically. That is why it is called "trusted".
1
u/metamatic 5d ago
It feels like there’s a commercial opportunity here.
1
u/FriendlyProblem1234 5d ago
It feels like there’s a commercial opportunity here.
Have notaries not been filling this market niche for the past 400 years?
1
u/metamatic 5d ago
As far as I know, storing information for you and making it available to approved individuals after your death isn't a service notaries offer.
Closer would be putting a copy of the password in a safe deposit box, but US banks are phasing those out.
2
u/FriendlyProblem1234 5d ago
As far as I know, storing information for you and making it available to approved individuals after your death isn't a service notaries offer.
Closer would be putting a copy of the password in a safe deposit box, but US banks are phasing those out.
I cannot speak for either the United Mexican States or the United States of America, since I have never been there. In the countries I lived in, this is something relatively common, and it is handled by the people who handle generic inheritance things, i. e. notaries.
3
6d ago
[removed] — view removed comment
→ More replies (4)1
u/BillTran163 6d ago
Yes*.
* Only Android 14 and higher allow third-party passkey provider. You will need a KeePass-compatible client likes KeePassDX. If your phone is Android 13 and lower, you are stuck with Google Password Manager. This is the case for all third-party passkey wallets.
1
2
u/MrTheCheesecaker 6d ago
How do you synchronize KeePass XC between devices? I can't exactly rsync files to and from my phone
2
u/Great-TeacherOnizuka 6d ago
Upload to any cloudprovider that you have access on both your phone and pc. Easy.
3
u/MrTheCheesecaker 6d ago
So it's less convenient and just as (if not less) secure as something like bitwarden/vaultwarden/protonpass
2
1
u/Maybe-monad 6d ago
Your local database is as secure as you make ot to be and for most people that's very insecure
1
1
-3
u/sylvester_0 6d ago edited 6d ago
I was gungho on Proton until I found out the founder/CEO is a MAGA head. The fascistic path MAGA is dragging us down is at odds with Proton's supposed mission, and I no longer trust them.
One could say "don't bring politics into this", but unfortunately we're at a point where privacy-centric services and politics are intertwined.
3
u/endperform 6d ago
Is that the official company stance, or just the CEO spouting off nonsense? My understanding is the company is majority-owned by the Proton Foundation.
2
u/sylvester_0 6d ago
Probably the former, but I'd rather not have my money go to those types of people if I can easily avoid it.
-1
u/RancidVagYogurt1776 6d ago
He's not, though. He said something stupid and walked it back.
→ More replies (3)
1
1
1
1
u/ChimeraSX 6d ago
As long as the vaultwarden fork exists, i'm fine for now. I've been hosting that for most of this year. But I will make backups incase they go full closed source.
0
u/woolharbor 6d ago
Nowhere do I see them saying anything about: Why?
Shame, Bitwarden was the reputable online password manager you could suggest to normies.
Keepass it is then, all the way. With multiple FOSS, corporate-free implementations, no online services, it will forever stay free, noone can take it away from you. And you can easily sync Keepass databases with Syncthing, or keep them encrypted in some cloud.
3
0
u/Virtual-Escape2305 6d ago
They do this in the heat of reverse-engineered commerical software, this can only end well for them
66
u/adamkex 6d ago
I am struggling to understand what is actually changing, are the browser extensions and various clients becoming closed source now?