▲ 610 points
back
263 comments
Two feedback points:
* Password field for creating new sends should be named differently, as by default Firefox autocompletion puts there my account's password there. Potentially should be exposed from OPTIONS panel. Alternatively it can be generated by default, and then once the message is created, will be shared to the creator - or stored in options menu of my sends
* Missing an option to expire message after first opening. It's like a self destroyable notification that can be read only once. Why? For the instance if I share some confident information with someone that I know is going to open very soon, then once he/she opens the message it will be destroyed, so that if somebody accesses either my or my friend's machine, it will be impossible to read the secret message. Another aspect is that if my friend will try open the secret message, and it will show that message doesn't exist / was destoryed - then we know that message was compromised.
Re point #2 - You can set a max access count to 1.
I feel like you shouldn't store your master password in another password manager...
Perfect timing. Just used this to send personal information across email. I still included the password in the email, but the expiry date means my personal data won't be collected through passive email logging. Also added max 2 read attempts: one for me test it, and another for the accountant.
And of course, the accountant at my company still insists on passing personal information through email. Another example, Monese bank asking me to submit all sorts of pdf scans of personal documents to close an account with them.
It's such a battle. When my wife and I were buying our home, we needed to send our entire lives in paperwork form to the solicitors.
I asked if they have a secure mechanism for file uploads and they responded "email is fine". No, email is not fine.
They _really_ struggled to understand why I wouldn't just email them every document they asked for (from birth certificates, marriage certificates, 6 months of financial data, 12 months of pay slips, and a host of other things).
In the end I hosted them myself and phoned them with a password, then deleted them once I'd seen they'd been accessed.
Unfortunately, I have no confidence that they have, did nor will handle all of that information appropriately once they receive it.
How is it not complete insanity to require _that much_ information on someone and _not_ have strict training and liability for managing it?
Between then and now, Firefox Send has come and gone, but fortunately it's open source, so I'll host that if I find myself in a similar situation in the future.
In the past the risk with email was mostly network sniffing during the transfer, which is somewhat low risk given who has access to backbone networks, and many systems have opportunistic TLS enabled, which is at least better than nothing.
However, after the Exchange hack, now we suddenly have to worry about all the stuff that’s stored in people’s mailboxes after delivery, which is likely a huge amount of data. I expect we’re going to see a huge wave of identity theft stemming from this.
Interesting, it seems to work very similarly to Firefox Send.
For communications in the other direction, such as when you want to make sure the other person sends you the content securely, there is https://github.com/whitesmith/hawkpost (disclaimer, this was an hackathon project I participated some years ago). Hawkpost doesn't even store the encrypted content.
I wonder if there is a solution that would correctly deal with both situations (never requiring the other end to sign up or know anything about encryption).
By the way, Mozilla's Send is down, but I'm maintaining a fork with a public instance. :)
This is really clever. And looks like it's easy to self-host via Docker.
> I wonder if there is a solution that would correctly deal with both situations (never requiring the other end to sign up or know anything about encryption).
I'm actually in the midst of building out a tool for that exact scenario[0]. You can send it to anyone so long as you know the email or username they use for a service that implements OAuth. If they successfully authenticate and the server sees their username / email match up, it sends back the encrypted data to the frontend, which then decrypts it with the key in the URI fragment. It's neither audited nor open source just yet, so I don't recommend using it for actual secret sharing until then.
Thanks for the link to Hawkpost, it looks really cool!
I'm probably going to have to leave LastPass later this month. Bitwarden seems like it ticks all my boxes, especially around self hosting. There's a Rust server implementation made by the community that doesn't require much resources so I could stuff it on an existing crowded server I rent.
I just switched last week, so can confirm that as of very recently, it is still far superior to lastpass.
Two notes worth highlighting
- UX is much lighter and more reliable for Bitwarden on web
- iOS implementation of Bitwarden is faster, more reliable, and has better interaction with the keyboard than last pass. I find the Bitwarden experience on iOS a considerable upgrade.
I've tried LastPass and 1Pass before, and switched to Bitwarden 2 years ago. It's the best!
A very interesting addition indeed to Bitwarden. I still personally prefer my own setup as I'm guaranteed not to run any risks of being siloed but I've started pointing others towards Bitwarden because of this and their strong commitment so far towards Open Source [0]
You'd think such a thing should have been directly implemented in Chat apps and related communication channels long ago considering how much demand there is in the industry, but nope. Signal is the only one among popular texting apps that implements disappearing messages correctly.
I like the feature, but if it requires somebody to creates an account, it's a hard sell.
If they got a signal account, which is more likely than a bitwarden account, I'll ask them to use that. If they don't, then something like 0bin.net will likely be easier to use (no account necessary, just copy/paste).
Now, bitwarden allows you to send any type of file, which is better than 0bin, being very limited in size, and to text and pictures. But you need a pro account for this.
So I'm not sure how it's better than the competition. Although I'm posting this comment so that someone on HN can show be I'm missing something.
The idea of the other party needing to setup an account is off-putting to me.
The way I handle this currently is to use https://onetimesecret.com without any added context, just the password string, and then send an email / message such as:
Here are the credentials that you requested:
Username: foobar
Password: https://onetimesecret.com/secret/6usoxihjgv1d (this link only works one time within X days)
You could even setup a separate link for the username, etc.
What are some other secure ways to send varying file sizes from my computer to one/many others e.g. how would you securely send 1MB, 1GB, 1TB?
I'm thinking once you're past 1TB, you're better off mailing an (encrypted) physical drive but I'm curious about other solutions especially if you have gigabit internet at home
I just tried it. Here's one saying Hi HN:
https://send.bitwarden.com/#aSBOPtnJT0qjwqzpAOZM_w/Moum7wc6k...
The promise of this is great and being a feature of Bitwarden, which is already fairly well trusted, is a plus in terms of peace of mind. But did anyone else find the demonstration a bit underwhelming?
I've used sites like One Time Secret[0] before and one of the big benefits is that it's pretty fast to store the sensitive data, grab the link and send back to the colleague. Bitwarden Send looks as though you need to be logged in to the Bitwarden site, dig out the feature page among the rest of your password manager and fill out a whole form in order to get a link to send, which would add a barrier to entry for the whole process that wouldn't encourage its use.
Maybe it's just me. It certainly looks like a good feature either way.
This claims to be end to end encrypted. One hard requirement for effective end to end encryption is that a user has a method to confirm that they are actually exchanging data with who they think they are exchanging data with (e.g. Signal's safety numbers).
I don't see anything like this here. So unless I have missed something, the E2EE claim is bogus and Bitwarden ends up being a trusted third party in this system. The identity management seems to work on the basis of an email address verification entirely under the control of Bitwarden.
It's been nice to see the recent additions to Bitwarden (share my passwords if I die, Send, ability to copy TOTP to clipboard from search list).
Send is nice, we had a vendor use pwpush.com recently to send us a password. Was skeptical because I'd never heard of them before, but it seemed to work fine.
I've been using Bitwarden for around 18 months for my family and a year at work. I like it, but it does have some rough edges.
Was just discussing it a few days ago and one of my coworkers asserted: "It has UI issues that should probably be considered security problems." and I can't argue with that.
The primary one is that when adding a new entry via Mobile, the "who owns this" is down past the bottom of the screen, and the "save" button is at the top, so you can complete the password add without selecting the account/collection portion, it's just invisible down there. Leading to the password being in the wrong place. The default is a selected value, rather than "no choice", so it won't throw an error if you don't go down there and complete it.
Other than that, I'm fairly happy with Bitwarden. I do wish that there was a key to generate values into the custom fields, which I use for "security question" answers, so I have to generate them in another app and really can't use Bitwarden in mobile with sites that require setting up security questions.
My wife uses it, but says it's ugly. So, that might be the thing that causes me to change to another provider... :-) (combined with my coworkers not really liking BitWarden's UI)
Maybe I'm missing something, but how can this be end-to-end encrypted when the password is optional, and there is no fragment in the shared URL?
Update: Turns out fragments are used for key sharing after all. This (in my opinion crucial to anyone aware about the difference between query parameters and fragments) bit is left out from the promotional video.
This is very exciting news for the Bitwarden team, if only beacuse Firefox Send went away and there's not really been a suitable replacement since. There was onetimesecret, but I never really trusted it...
However, FF Send was shut down because keeping up with nefarious users uploading illegal content was a full-time job in and of itself... I wonder what Bitwarden will be doing to solve the problem.
I love the fact that it's not just a seperate product, but it's also included in the existing bitwarden password safe. That's just awesome. I can't wait for v1.40 to be released on monday for self-hosted instances.
Best 10 bucks I spend annually, tbh...
As a self-hosted alternative if one already has Vault (or is OK with a provided single-node installation), this[0] is great. I use it when sharing private stuff over unsecured channels regularly.
I use http://transfer.sh for sending large files between machines on different networks - you don't even need an account to use it. I presume there must be a maximum file size, but I haven't hit it (yet).
Still, nice to have another option incase transfer.sh goes away!
Might be related:
https://github.com/pglombardo/PasswordPusher/
Password Pusher - Open source secure password transfer
Review by Crosstalk Solutions here:
Has anyone figured out how to do this from the firefox browser extension yet?
Also does anyone know what the difference between 'deletion date' and 'expiration date' is?
I love Bitwarden, but this move is something that I don't like that much because it fragments more the way we have to share passwords between people / companies.
For some reason GPG frontends (such as Keybase) aren't a trending thing, and therefore the average guy in IT doesn't even know how to deal with an encrypted gpg file - let alone creating one given my public key. Unfortunately it seems like emails are more straight forward, or encrypted e2e messages via Signal / Telegram / you name it.
I would very much appreciate if somebody created something like Keybase and made it popular - this is a security improvement I would love to see in everyone's life. Things like Bitwarden Send, unfortunately, are probably not going to be the best solution to this problen and not even strong enough (e.g: not E2E encrypted). I wouldn't feel safe in using it to be honest.
In any case, everything is definitely better than sharing credentials in plain text, so there is that :-)
I not NOT get why the demo'd and encouraged way of sending is considered secure. The email is not encrypted. It contains a link in plain text. It's not stipulated that secure email servers (TLS) are used, and if non-secure, the plain text of the link could potentially be sniffed out by anyone with access to one of the nodes along the chain of transmission of the email data. Further, if the email server on either end is gotten to, the URL is sitting there in plain text, so the attacker has it.
Now, once you have the URL, you have direct access to the secret info, without any challenge.
Modulo this method making it possible to shorten the time the info is available, and to take the info away after the info has been accessed, what is secure about this?
Couldn't you have the same effect essentially by sending the secret through email and then mutually agreeing on both sides to delete the email message immediately after sending (by the sender) and receiving (by the receiver)?
I find it interesting how many business models and ideas are obsolete if there was a wider and easier adoption of gpg. It's over two decades old, but not aged in a bad way. I wonder why it isn't integrated better in OS-es, or part of education, as it's such a useful tool. I get why these products pop up, because they solve the initial inertia and make it accessible. Maybe it's OSS licensing, maybe US laws regarding crypto, hm. Does anyone have thoughts on this?
Edit: my ability to communicate seems to be pretty bad today, so let me clarify. The question is about enhancement/integration in terms of usability, and not lack of adoption "as is". I'm well aware that the reason why it's not more adopted is because it isn't easy to use, otherwise these services wouldn't be popping up that makes it more user friendly. Hence the "... obsolete if there was a wider and easier adoption of gpg"
Interesting project! Great to see new features coming out of BitWarden.
One concern that is going to put me off using the feature though is that sharing my password manager account email with the person I've sent the file/text to seems unnecessary.
Not everyone we share data with (particularly in the world of messaging) should be privy to the sender's email address.
Anyone knows how does it different from Firefox Send. What is the features will restrict users from abusing it.
FYI, Firefox Send was discontinued due to security reason.
Great feature, happy Bitwarden user BTW.
Off-topic: For Rocket Chat users if you want temporary-encrypted messages exchange you could try OTR https://docs.rocket.chat/guides/user-guides/messaging/off-th...
We are using it in one-to-one chat context to exchange temporary data like passwords, keys, etc.
So the basic package says you can share passwords with one other. But it also says core features and sharing are 100% free. But when you click on that box that mentions core features you (I mean me) expect to see what core features are. Instead I'm asked to create an account. For a thing that's supposedly free. So no sell. I'm really sorry because I want to like software like this, but not like this.
I recently (2 days ago) had an attempted login into one of my accounts. The password was randomly generated by bitwarden and not reused anywhere. Luckily I had 2fa which alerted me to the attempt. This is beyond puzzling to me as there is no possible way someone could have guessed or downloaded this password from a DB leak. Can anyone suggest what this could be? (The attempt came from a country that is not my own)
Regarding the self-hosted version: ARM support would be nice. I dug in a bit more, and bitwarden is written in .NET core and SQL Server T-SQL.
.NET core is open source these days, but not SQL Server from what I can tell. I wonder if making it portable (to other architectures/BSD) would be a complete rewrite, or if there’s some easy path forward.
There are number of open source projects that do the same thing such as https://privatebin.info
Adding some marketing on top seems like a good thing as pasting passwords in chat happens too often in many organisations.
IIRC, Firefox Send shutdown because it was getting abused - I see you need an account to use Bitwarden Send, which I imagine helps mitigate against that, but it's also a barrier to use. Would be interesting to know what other anti-abuse mechanisms are in place.
I don't know about anyone else, but I'm leery of apps that say "proven security and compliance" and then don't offer any obvious details, or proof, about what that "compliance" is. ISO 27001, SOC2, what?
Using "trusted" in a description of their own product doesn't look right, especially when it's the only occurrence of "trust" on the whole page.
It's just a marketing spin, rather than a meaningful technical description.
Just switched over from lastpass and very happy with it. Glad i made the jump
More detail: https://bitwarden.com/help/article/about-send/
Nice way for browser plugins and script to access sensible information via dom! Even with a title suggestion the applications it is for! No more context sensitive chats i have to spy on
i like the "Emergency access" that Roboform has, it can handle this sharing very well
https://help.roboform.com/hc/en-us/articles/115005664827-Wha...
Roboform is not recognized in the industry, but gets the job done, plus, it has secure notes, identities, markers, etc... all encrypted, and hasnt fail to me for over 4 years
Messengers are not per se insecure.
Sending via Matrix should be fine as well - why use another tool?
Any advantage to using this over pwpush.com in terms of security?
For just sending plain text that gets destroyed after it's seen, like sending passwords, etc., I've used https://foxcry.pt