Bitwarden Switches to Commercial License
2 days ago by Mustachius_Grumpius to c/technology
cross-posted from: https://thelemmy.club/post/57178743
RyanL Bitwarden Employee
Hello everyone!
Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.
Bitwarden remains committed to open source security and transparency The GPLv3 OSS licensed version continues to be updated and published on GitHub All current features are available in both versions License details are on GitHub Bitwarden remains committed to a robust, free forever plan for everyoneIf you have any questions, please ask them in this thread. Thanks all!
EDIT:
Bitwarden is not going closed-source You can still fork Bitwarden No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden The free plan is here to stay permanently
Don't even know where i'd switch.
Proton -> I already use Proton suite and I like the seperation, the 2 password option doesn't work for me either. I just need a seperate password.
Keepass -> I use quite a few devices and the sync just seems like a nightmare...
Any other options? For now i'll stick as BW is still great but will start exploring others.
Keepass X Syncthing
syncthing runs on everything and is easy to configure.
Maybe it's changed in the year since I tried but I absolutely could not get syncthings to work on android
But thousands of people have it working just fine. Not calling you out but it does work very well. Did you follow a step by step guide? I know websearch makes it hard to learn new tech things these days.
Just keep in mind, set up a default folder and file (filename.kdbx) to share on one device, add Remote Device (QR code helps there), go to Sharing Tab and select Default Folder. If the Default Folder isn't ticked on both devices in the Sharing Tab on each, nothing happens. When you work it out, that folder can be called anything and you can get advanced with how or when it shares or which direction the data goes (think photo backup from mobile to desktop).
New Android app to use is:
https://github.com/chenxiaolong/BasicSync
Use Obtainium- https://github.com/ImranR98/Obtainium - to install it and keep it updated. Obtainium can update itself the same way.
Convoluted, I know, but so is relying on a company to host for you in the cloud. They just hide all the complexity behind the interface. With Syncthing, once it's set up between all your devices (and there is a way to quickly auto accept setup once further advanced/knowledgeable), it just chugs along in the background. Changes to keepass file appear almost instantly across each device once it's opened.
A little more than a year ago, Syncthing for Android had a lot of issues, there was a breaking change installed that required updates and the existing clients had issues, it has since been forked.
If you don't need the granular security or family-friendliness it should provide.
I recall having issues and bouncing off of it on my first attempt, but I've been using it on GrapheneOS/Pixel 8 Pro without issue for at least 2 years now.
You could use Synctrain or maybe Möbius Sync to SyncThing-sync a folder with your phone, then use Strongbox or KeePassium or any other KeePass-compatible app to work with the file?
Proton pass works just as well if not better for me. The autofill is much more reliable on Android than bitwarden was, although I did switch about a year ago.
Why would you need to switch? Are you repackaging Bitwarden?
Whether you believe it or not is another matter, but this very post still includes the words "transparency" and "always free".
Bitwarden remains committed to open source security and transparency
Bitwarden remains committed to a robust, free forever plan for everyone
and a bonus:
The free plan is here to stay permanently
You can already see them positioning themselves to start removing features with the phrase "free plan."
Nothing stopping them from limiting the number of passwords available in "the free plan" or something, pressuring users into "the pay plan."
But I'm pretty cynical.
Aslong as it stays source available at a bare minimum for the paid offering/options I think I can live with that.
Lastpass limited the number of device types, phone OR desktop
I'd find it more likely they remove passkeys and TOTP from the free plan.
My fam will not like moving password managers again, but it might be time.
Need PC, Mac, Linux, Android, IOS, Passkeys, TOTP, Granular Permissions, keepass ain't gonna cut it. Getting off my ass and making something isn't impossible, but i'm not looking forward to figuring out passkeys, copy, paste and accessiblilty on IOS.
Lastpass limited the number of device types, phone OR desktop
The thing that shit me about LastPass doing that is that they used to do that. And I actually paid for it back when they did. Then they made it free for several years. And then they brought back the restriction, only at like 5x the price.
And in the meantime, quality of life of the service remained flat. I regularly had to go into the LastPass app and manually copy/paste because the autofill functionality didn't work properly on Android. There was just no way it was a service of a quality that's worth paying for. Bitwarden's UX is incredible by comparison.
pass https://www.passwordstore.org/ keepass https://keepass.info/
Never made any sense to me why so many people ran away from these two open source options towards Bitwarden.
Bitwarden has much better enterprise options. KeePass is kind of dinky by comparison; even for a single user you immediately run into the problem "how do I sync my new password to my phone automatically?" Bitwarden was just an app that worked.
That being said ~ I see the writing on the wall, and will be going back to the dinky option. Again. This isn't the first time I've been burnt, but I never seem to learn. Self-hosting seems to be the only sustainable long-term option after all. Hopefully the migration isn't too painful.
I highly recommend anyone reading this get your export out while they still have a good export tool. First thing companies do in enshitification 101 is make it difficult to leave and trap you via inconvenience.
I never understood the 9000iq move to give all your credentials to someone else...
That's why I use "pass" as password-store.
If you read their announcement carefully you'll find things like
All current features are available in both versions
Which strongly implies that the different versions will start to diverge over time. Then at one point they will just be like maah it's not worth putting more work into the open source thing, we'll focus on building new cool features yada yada yada. And this is how all the open to partly open to closed source rug pulls worked in the last years.
(If you want to do this the worst way possible like MinIO you also squash / delete the Git history the moment you announce you're only working on closed source)
Minio also deleted the repos altogether about two weeks ago.
Yeah well, didn't know this. I'm still running some old minio instances on my home server. Need to check if the docker images are still around otherwise I urgently need a backup plan...
Fucking hell, why didn't they at least leave the old code available 😭
what is even out there? I pay for proton and bitwarden. but I just dont trust them
Before Bitwarden / Vaultwarden I went with Keepass (it was some fork don't remember the exact name KeepassXC probably) synced via Nextcloud. It's not as convenient as Bitwarden plus at least back then it didn't support passkeys. So yeah, I don't know what is actually out there. Honestly I don't think it's super urgent to start hunting for alternatives but probably we should have at least some ideas in case the Bitwarden team does some weird moves.
So you have basically a local copy on your phone, for example, that syncs when possible?
Yeah vaultwarden and photos are the 2 things i'm too nervous to selfhost. I do selfhost basically everything else but these 2 things are too important for me to mess up that I just don't...
I have Vaultwarden, it works with the web app and browser extensions. But is there a vaultwarden specific android app? I know technically I can use the Bitwarden app. But sometimes they update the Bitwarden app too fast for all the changes to translate into Vaultwarden and then im kinda forced to use the web app.
The web app is just a minor inconvenience to me so I continue to use it. Just wondering if there is an easier Vaultwarden specific solution for android.
Then we will shit ... the enshitification exodus goes on
I think it is the next move (not the first) in enshittifying bitwarden. I think the first move was the leadership change announced in May.
It just blows my mind how so many comments use the term 'purchase' as if this new enshitification step still allowed for the dictionary meaning of the word.
I used to suggest bitwarden to everyone, now it's basically 'start using KeePass, keep a copy of your db in a USB drive in your safe, have fun'.
The fact that bitwarden raised 100 millions from venture capitalists for "acceleration" and small changes towards a closed license for premium features is a steady step towards enshittification.
The writing is on the wall and every announcement like that is a step further into enshittification to provide value for shareholders at the expense of thrle consumer base.
I still haven't switched yet because life is going fast and I didn't come around to do my backup file server yet, but I would suggest anyone reading this to look for an alternative because it will get worst.
Yep, have been using KeyPass or KeyPassX for at least a decade now and just syncing across all machines (via syncthing). 100% reliable in my experience.
That was written in the sky...
Open-Source is literally used as marketing tool for the under dogs until they reach a critical mass of users.
People were fighting on social media, defending the product, suggesting it, "it's open source", people were doing the marketing for them.
No wonder why people feel like they got raped, after all the hard work they have done for them...
But at least they didn't contribute code, did you? Not me, because I am old enough to never use such products, it's a classic rug pull, bait and switch.
Open source doesn't mean it's good, it must be hold by a bunch of strangers in T-shirt, not in full suite...
Corpo in disguise...
When Bitwarden got a meh "refresh" of the user interface and started vibe coding stuff (I'm not some super hard-line anti-AI person, but dammit, you absolutely should not vibe code security-critical apps), I switched to KeePassX. It was like coming back home! I used to use KeePass and KeePass 2, switched to Bitwarden for a long while, and while it was neat, KeePassX is just neater. (Doesn't have cloud sync, but syncing the vault files with LocalSend is easy enough.)
I guess you mean KeepassXC, because the last release of KeepassX apparently was in 2016.
KeepassXC is also using AI, they even made a blog post about it a year ago.
Yep, ChiPass is a good replacement: https://codeberg.org/ChiPass/ChiPass
Honestly their description of use and why that use it is not concerning. I'm more concerned with their choice being copilot lol.
Yup, I was supposed to say KeepassXC. (...I mean I probably considered using KeepassX at some point, it's XC's predecessor after all. But as I recall Keepass 2 worked well enough on Mono, so I didn't need to switch.)
Also, whoopsies on XC's AI use. At least they don't seem to embrace it as much as Bitwarden, but still makes me go hmm.
I think all of us can just move to using Vaultwarden, it seems to fix problems even in the old free version of Bitwarden.
The issue is, the bitwarden app you still use is what is affected by this change.
So these changes affect the client app too? If that's the case can't the client app be replaced?
At that point the only thing that would remain is the protocol itself
Only if you are reselling bitwarden. The client apps are still free for personal use.
The protocol is the same, anyone can build an app.
Fantastic. I'm tired of having to change password managers. DashLane, Keepass, LastPass, etc., they all end up shooting their own foot somehow.
Does this mean I will, or won't be able to install the FOSS version through GitHub? Trying to stop repackagers from selling your project is one thing, but killing the source available installs would be another.
According to their forum it is to prevent repackers
No one's taking away my favourite bash script: https://www.passwordstore.org/
"bitwarden apps will be the commercially licensed builds." I don't understand how this is going to change anything.
I self-host vaultwarden. I use the official Bitwarden app, it works swimmingly. Going the self-hosted route you get enterprise features (I don't use em).
Doesn't the licensing stuff connect with the backend not the app?
All current features are available in both versions
They will start making changes exclusively to the propriety app, and eventually the proprietary app will be completely incompatible with the FOSS app. They're doing what Google did with AOSP.
Rest in Peace :(
So, 99% of users. Do you use an iOS phone or the browser extensions? You're affected.
iOS app store doesn't allow open source in the first place
So, 99% of users.
How? It's not like the source code if no longer under GPL, it's just that this specific compiled binary is under a different license but it doesn't change anything for anyone in real life.
How do you install the GPL version on iOS or chrome?
https://developer.chrome.com/...
Literally the first hit.
Also, why would users of a proprietary platforms (because Chrome is the proprietary version of free Chromium) care? FOSS people use different platforms, such as Helium browser, LineageOS, etc.
Interesting thread I stumbled upon from a few years ago where everyone is praising Bitwarden as essential. Times sure do change.
I just cannot get on board with Proton Pass while I cant have a completely different set of credentials.
I keep my Proton passwords inside the password manager. Either I need to make my Proton password memorable and be my master password OR setup the 2 password mode where I need to remember and login 2 passwords.
They need some kind of privacy pass implementation to link your Proton pass to your Proton account while allowing completely separate credentials.
I keep the master password inside proton pass itself. I don't want to be trusted with remembering anything. What if I lose my memory, ya know. They give a twelve word backup which you can use in case you get signed out of every device.
Same, probably going to switch to it eventually even though I don’t like having all my eggs in one basket. Proton provides me a good quality service, can’t lie.
Well, a big reason I ended up with bitwarden is being able to have a family group that I can help foster, encourage, force my family to use a password manager by having/showing them how these work , why they should use them and continually point them to the app to save and/or retrieve passwords.
The barrier to entry for non technical users is much lower. I don't want to manage making sure everyone's db is safe/synced etc... either
I don't know, my wife (0 technical knowledge) works perfectly, with daughter and personal databases. Of course, it's true that I set everything up myself and I make sure the database is on the family NAS. I'm not judging you or anything, but while it's true that setting it up is a bit more difficult, using it, in my opinion, is not at all.
I do run a number of self hosted things, (nextcloud, immich, plex). I had my own pw manager, and had tried keepass myself and when it came time to push the family to using a pw manager I just opted for bitwarden here vs taking ownership of managing that too!
Hell, it's still a literal fight/push to make them understand the importance of it
It does negate the big issue of passwords leaking from the websites and that's the most important part of even having totp.
Nobody is going to spend time to separate the 2 and maintain backups of two different things and all that extra effort when 90% of people don't even use password managers.
Don't let perfection be the enemy of improvement.
I see 2FA as mostly a mitigation for users reusing passwords between services, which users of password mangers usually don't. Of course, the password manger itself can be a single point of failure.
I'm using Strongbox on macOS and iOS. Uses a KeePass2 database in the background, does TOTP (so does KeePassXC), syncs via iCloud (but also supports SFTP, WebDAV, OneDrive, Google Drive, and Dropbox) and also keeps my Passkeys. And it supports Apple's AutoFill API, so it works in basically any input field across the systems and feels "native". No browser extensions (at least for Safari) needed.
And if it goes rogue, I can switch to e.g. KeePassium or any other KeePass-compatible app.
Because i havent seen it on this thread theres also passbolt
i havent used it personaly (yet) because its offline mode is still in beta.
Well, i was planning to move from my 1password to bitwarden. No need for that now.
left long ago unfortunately
Has anyone tried AliasVault ? How's your experience with it ?
@lemmy.world
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
go to feed...
@lemmy.world
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
go to feed...
I really don’t want to have to switch password managers again.
save