this post was submitted on 26 Oct 2024
334 points (97.2% liked)

Technology

60057 readers
4061 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] soul 4 points 1 month ago* (last edited 1 month ago) (1 children)

This is where your lack of understanding of the open source thing is readily apparent to everyone arguing with you. If it was backdoored, many people would be calling that out. In fact, this was one of the exact reasons at the heart of the original concerns leading to this story.

The fact that the source is available means that we can see exactly how the data is encrypted, allowing assurances to be made independently.

If nothing else, I trust Bitwarden MORE because of that and I'm happy to pay them for their services since it helps find further development.

[–] [email protected] -4 points 1 month ago (1 children)

If it was backdoored, many people would be calling that out.

In theory. And not necessarily soon. Don't forget the context of this thread: we compare bitwarden with keepass, which does not offer to you your password base on their server side.

[–] [email protected] 1 points 1 month ago (1 children)

Trusting one FOSS client good. Trusting different FOSS client bad. Logic where?

[–] [email protected] 0 points 1 month ago (1 children)

That different FOSS client stores your data on their company's server. It's an important factor, IMO.

[–] [email protected] 0 points 1 month ago (1 children)

Dude, how is bitwarden hosting your own, locally encrypted (in FOSS client) password database any different than using keypass and syncing it however you want?

I don't even use Bitwarden myself, I'm using keepass too, but this attitude is ... weird?

[–] [email protected] 0 points 1 month ago* (last edited 1 month ago) (1 children)

I find risk slightly bigger when you encrypt your private data with the product of the company and store that encrypted data on servers of the same company.

Why: because if they have some backdoor now or plans to introduce it in future, they have all the time in the world to apply that backdoor to your data. Without you knowing it.

[–] [email protected] 0 points 1 month ago (1 children)

Bitwarden client is FOSS same as Keepass, though. Why aren't you afraid of Keepass having backdoor by "insert whatever big corporation sponsoring FOSS" giving said companies free access to your passwords you happily store in their clouds?

[–] [email protected] 0 points 1 month ago

Keepass could have backdoors too. The difference is: authors of those backdoors are not from the same company, which I use as cloud storage.