News for hackers. Stuff that matters.
Re:Firefox 56: Last Stop Before Quantum by smnrchrds on Friday October 06, 2017 @01:28PM (#15418544)
I would like to switch to Bitwarden, but I don't know how I can assure I can trust them with all my passwords. Are any of the founders well-known security experts? Has the service been recommended by respected security researchers?

I am not a security expert, so I cannot assert their trustworthiness myself. I know that you can run your own server. But even then, without auditing the code, configuring a firewall, and checking network logs, I cannot assure the server and the clients do not call home. And all of those solutions are both prohibitively time-consuming and way out of my area of expertise.

How did you decide Bitwarden was trustworthy? How can I stop worrying and give them my passwords already?

Re:Firefox 56: Last Stop Before Quantum by satysin on Friday October 06, 2017 @05:07PM (#15420497)
I didn't pick Bitwarden right away. The comment that mentioned it prompted me to research password managers in general. I looked at primarily online (1Password, LastPass, Bitwarden, etc) and offline desktop client ones (Keepass).

I do prefer the idea of using something like Keepass and not relying on a service but I found it rather frustrating to manage between my multiple devices. I knew if I were to actually make use of a password manager it needed to be a smooth experience because otherwise I would just return to using Chrome's built in one out of laziness.

After researching the main online managers I decided to go with Bitwarden. It is open source so if it does do something dodgy I would hope it is found and reported. I do not have the time nor expertise to audit all of the code myself so I have to put some trust in others.

Plus while it would be a real pain in the ass if accounts were compromised due to the developer being an asshole/idiot it wouldn't destroy my life. I have a strong password on my primary email account (not stored in Bitwarden) along with 2FA. Most of the logins stored in Bitwarden are for things like Hacker News, Reddit, Slack (personal not work), etc. Randomly generated 18+ character strings that are a pain to enter manually, especially on a phone.

Re:Firefox 56: Last Stop Before Quantum by zzalpha on Friday October 06, 2017 @07:15PM (#15421145)
FYI: KeePass plus Syncthing works great for me for cross-device password databases.
Re:Firefox 56: Last Stop Before Quantum by satysin on Friday October 06, 2017 @07:32PM (#15421238)
Will have to check this out. Not used Syncthing before. Thanks!
Re:Firefox 56: Last Stop Before Quantum by zzalpha on Friday October 06, 2017 @08:39PM (#15421554)
No problem!

As I mentioned in my other comment, the only gotcha is to make sure you set up your syncthing ignore file to ignore the KeePass database lockfile.

Re:Firefox 56: Last Stop Before Quantum by terminalcommand on Friday October 06, 2017 @01:52PM (#15418784)
I use KeePass as my password manager, it doesn't sync automatically across all my devices, I occasionaly transfer my keys database to my phone.

You could always upload your encrypted key database to dropbox, and keep your private key on your phone, on your computer, or on a USB stick, if you want automatic sync.

Re:Firefox 56: Last Stop Before Quantum by zzalpha on Friday October 06, 2017 @07:15PM (#15421146)
Syncthing + KeePass works very well for cross device peer-to-peer syncing.

Just make sure to configure Syncthing to ignore KeePass lockfiles.

Re:Firefox 56: Last Stop Before Quantum by lern_too_spel on Friday October 06, 2017 @02:36PM (#15419210)
It has no unit tests.