Concerned about BitWarden and password managers..

[Confused_nerd]

HI, I'm using linux mint 20.1, and wanted if using an external password manager like bitWarden is safe?
Like, I can just store all my passwords offline, but if I do use BitWarden(or any other password managing tool), will they not also have access to my data?
What tools do you guys use for storing passwords, and which method would be the absolute safest(offline storing and an offline backup, or online storing with offline backup etc.)?
Thanks.

 

[Rob]

I'm using bitwarden chrome extension on my laptop.. then the bitwarden app on my android phone. Currently using their hosted solution, but i'll eventually switch over to own-hosted version where I'd have it on a server at home.

 

[f33dm3bits]

BITWARDEN.....a serious alternative to LastPass

I have used LastPass since 2013. And I have paid, ....and paid. In more ways than one. via $, because I use it on more than one pc/mobile etc.....and also via frustration because when I do have a problem with it, the answers are sometimes like the answers you might get from a Linux forum which...

linux.org

LastPass

I don't know if this is relevant to any Linux users but - https://www.theregister.co.uk/2019/12/18/log_me_in_acquired I stopped using LastPass a long time ago in favor of KeePass. I had used KeePass off and on for several years on my Linux boxes and decided one day that I did NOT like the idea...

linux.org

 

[KGIII]

What tools do you guys use for storing passwords

I store some in my browser, some in plain text, but my most major tool is 'recover password'. I'll set unbelievably complex passwords and then just recover them when I want to use the site again.

It really depends on the site and how important it is to me - as well as how important my data is on their server.

 

[Condobloke]

I'm using bitwarden Firefox extension on my desktop, then the bitwarden app on my iPhone.

I think I would be safe in saying that BitWarden would be the most trusted password manager in use today.

I exhaustively went through every password I have (there are a lot !!) and used the Vault to access and open every password and the used the "check if password has been exposed" feature to check every single password.
I was more than surprised to learn that a significant number had been exposed.

So I then set about the laborious task of changing and updating every password I have.

I made sure that every password is a minimum of 16 characters long containing upper and lower case numerals and symbols etc etc

It is an easy task.......just boring. But once done, I am now secure as can be for the foreseeable future.

When I had finished, I used BitWarden to Save a .csv file and then saved that to a separate drive, and also printed it and I store that in a safe.

BitWarden WILL NOT have access to my data. If they did I would not use it.

Most important is your Master password. You MUST remember it. If you forget it you are in deep doo doo.

I use an event in my life which I will never forget. I then use the second letter from each word that describes that event, followed by a symbol (underscore, or hash....whatever you like) and then a number which is important to me but is not related to my own circumstances. The entire master password is 18 digits , letters etc etc long. .....and yet is easy to remember....for me.

I could gasbag on all day about it....but in the end, it is you who has to bite the bullet and install and set it up.

if you run into problems, just call out.

 

[Confused_nerd]

I'm using bitwarden Firefox extension on my desktop, then the bitwarden app on my iPhone.

I think I would be safe in saying that BitWarden would be the most trusted password manager in use today.

I exhaustively went through every password I have (there are a lot !!) and used the Vault to access and open every password and the used the "check if password has been exposed" feature to check every single password.
I was more than surprised to learn that a significant number had been exposed.

So I then set about the laborious task of changing and updating every password I have.

I made sure that every password is a minimum of 16 characters long containing upper and lower case numerals and symbols etc etc

It is an easy task.......just boring. But once done, I am now secure as can be for the foreseeable future.

When I had finished, I used BitWarden to Save a .csv file and then saved that to a separate drive, and also printed it and I store that in a safe.

BitWarden WILL NOT have access to my data. If they did I would not use it.

Most important is your Master password. You MUST remember it. If you forget it you are in deep doo doo.

I use an event in my life which I will never forget. I then use the second letter from each word that describes that event, followed by a symbol (underscore, or hash....whatever you like) and then a number which is important to me but is not related to my own circumstances. The entire master password is 18 digits , letters etc etc long. .....and yet is easy to remember....for me.

I could gasbag on all day about it....but in the end, it is you who has to bite the bullet and install and set it up.

if you run into problems, just call out.

Okay, I'll surely try using it.

 

[bytestream]

I prefer KeepassXC. It's offline and open source. I believe it is pretty safe and you can combine it with Veracrypt if you want to be like James Bond

 

[Condobloke]

How Safe Are Password Managers?

A password manager stores all your passwords and automatically fills them in your web browser and mobile apps. But is trusting an app with your passwords and storing them all in one place a smart idea?

www.howtogeek.com

 

[craigevil]

I use the Bitwarden extension in Vivaldi and Firefox.

 

[Condobloke]

I also use that same extension in Firefox ...also on an iPhone in either Firefox or Safari

 

[MatsuShimizu]

BW is safe.This video demonstrated how the password is encrypted before uploading to the BW server.

You might not know this, but you can login to BW app and browser extension offline. Login into the app once. Your credentials will be downloaded into your local PC. Then, disconnect. Enter your master password again and then you will be able to view your credentials offline.

It's been audited by the third party:

Compliance, Audits, and Certifications | Bitwarden Help Center

Review information about third-party security audits, our open source codebase, and our zero knowledge encryption model.

bitwarden.com

They also have bug bounty program at HackerOne:

Bitwarden - Vulnerability Disclosure Program | HackerOne

The Bitwarden Vulnerability Disclosure Program enlists the help of the hacker community at HackerOne to make Bitwarden more secure. HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited.

hackerone.com