Before I used LastPass, and for me, the form field detection was miles ahead. Not a tiny bit, but _a lot_ better. And the UI built on the ephemeral pop-up was a shitty idea that after years and years they haven't decided to ditch and do it the proper way on a new tab, like LastPass, uBlock Origin, o TreeStyleTabs do.
I use both. It’s far from “miles ahead”
I use BW for my personal use with my SO and 1P at work. I hit some errors in 1P that were crypting, stuff like "Failed to add this record" with no details, no help button, I had to fire up the chrome console for the extension to find out it was a 401 to our 1P portal. Very poor experience, probably related to our SSO setup but still.
Never had any weird issue like this with BW and I love the autofill shortcut and the absence of a popup when I access a password field like 1P.
So yea, YMMV as usual but definitely not miles ahead.
FYI, 1password has taken almost 1 billion dollars in vc investment. They have an obscene amount of pressure to grow.
Cloud password manager functionality can be accomplished in 6U of server space. Vault files are measured in kilobytes or megabytes, millions of customers could be handled by a single SSD RAID and a fast Xeon. Infrastructure and software to make it secure, reliable, and user friendly, add expense but not 9 digits of it.
Your app, the detection of forms (when total idiots try to prevent password managers being used), the security audits, active intrusion detection, etc... those are yet to be handled by an AI, so these cost a lot.
There are small issues with autocomplete on mobile here and there, which I have never seen a password manager do a perfect job at. Otherwise I have never had any issues with BW and the 2fa on the paid tier is great.
My home server costs me about 3 euro per month in electricity (and it is quite beefy for a home server) and it runs many services, not just Vaultwarden. Add homeassistant for smart home, nextcloud for document cloud, jellyfin for media, immich for photo backups, etc. Maintenance using docker and compose is also trivial task.
On top of that, it runs in a private network and has limited exposure to the outside world though VPN in case you need to access it away from home.
Yes, hosting a single service is more expensive, but hosting a bunch is much much cheaper.
Infrastructure costs are not just AWS / DataDog / OpenAI bills.
I could barely understand it myself let alone explain it to our lowest understanding employees.
1Password last I used it, asked for a master, and a secret extra password. I still cannot explain why.
Granted my setup was for corporate but I am pretty sure it’s the same for everyone.
My best guess is that they are trying to cover for weak masters in the way that LastPass was enforcing but failing to update their PBKDF2 interations.
Which IMO is stupid and a failure to enforce best practices at the user’s first input.
Nope. With that, you've quite literally convinced me to not just avoid it forever, but to also recommend others do the same.
VC investments means "they're gonna want money back at some point," and the service they provide is too important to have that hanging in the air, especially given how badly MANY other VC backed things have screwed things up.
You've effectively told me, there's a serious, if not likely, chance that they will at some point screw me and my passwords over if I don't pay them ransom (or engage in some other similarly drastic behavior that I haven't even considered yet)
Kill this garbage now.
Meanwhile everyone stopped wearing wristwatches except as a fashion statement. The original company would have survived this easily but the VCs wanted the next Apple or bust.
Exactly my experience. When 1Password announced the shift to a crummy Electron app, I evaluated all of the major password managers, plus some less major ones, such as Strongbox. Even with the UX degradation of 1PW 8, it's still clearly superior to the others, to the point it's really not a contest.
I stuck with V7 until just a few weeks ago, when other circumstances necessitated an "upgrade". I once again evaluated the others, including Bitwarden, to see if they were "good enough". Bitwarden's UX hasn't improved as far as I can tell; more importantly, it refused to import my secrets because I had a secure note that was too big for it. Not "refused to import that note"; refused to import anything—there's no skip option. I had to do a bunch of manual nonsense, which still left me in an incomplete state because I both need that note and want it in my vault (splitting it into multiple notes is an option but also an ugly kludge).
If I selfhost i want to not have to manage all my services with individual logins. Selfhosting with e.g. Authentik to provide SSO and identity management is really a perfect solution, but alas so many projects lock SSO away in their enterprise edition (good on psono to not make it ridiculously expensive like often is the case).
I share this frustration. Putting aside the ambitions of founders and initial investors in order to address your question about "everything"...
I think it comes down to tech being perennially talent constrained. It might not feel like that right now after a year or two of big layoffs, but every time that has happened, another long hiring boom has started within a couple of years.
If there were enough competent engineers (in this case, ones that aren't going to get the company in the news for things like cryptography mistakes or sloppy data handling), then that would change all of this. But there aren't, so these companies are left competing for the scarce talent.
You need a large pool of resources for that competition. VC money (eventually replaced by liquid stock grants) is often the easiest source of that. So, VCs can help a company keep and add talent, but in return they want hypergrowth.
But Google is so much more convenient.
I still wonder why there's no completely P2P password manager using SyncThing plus a layer of encryption. We have this near perfect tool for making multidevice apps but we don't use it for much!
https://www.passwordstore.org/
KeePassX works fairly well with syncthing as well, if I remember.
I've heard KeePassX can have sync conflicts if you edit on multiple devices with the wrong timing.
I think for a real conflict-free experience you'd need to put each password in its own file, or give each device a logfile to publish CRDT updates with cr-sqlite(Looking into adding that to a baserow style app).
I tried teaching my father to use Bitwarden for the sole reason that it seemed to be translated into my native tongue. In his use, Bitwarden turned out to be completely unreliable. As techies, we stop noticing the little glitches, the times when Bitwarden is unable to auto-complete, or to detect a login that needs to be saved. Or the times Bitwarden logs you out of the account, or fails to use your biometrics in the browser because the app is no longer running in the background. Or the management UX of the app that's terrible. For us, these are little annoyances, but for my father it was the difference between usable and unusable.
The individual plan is very cheap, but the family plan is costly. And you can self-host, sure, but it's expensive to self-host.
When talking of self-hosting, people actually mean the alternative built from scratch in Rust (vaultwarden). Well, that project was never audited to my knowledge. Open source or not, it may have security vulnerabilities that could be exploited remotely, and I don't understand how people can trust it.
Bitwarden also took VC investments. Which is fine, I guess they need to grow, but I'm longing for projects that are owned by sustainable businesses that don't need to grow. Why does everything need freaking VC investments? The problem being that startups that took such investments are not trustworthy to be around in another year from now, sorry. Although this is true of 1Password as well.