I Do Not Recommend Bitwarden

The outward appearance might not be your style, but they make good points, provide facts to support them and most importantly, they remain polite about it.

I personally think the article is worth reading, at least until just before the last chapter, in which the author outlines their own convoluted ideas. And that's where such things belong: in the last chapter.

only to settle on another SaaS

Do you mean Vaultwarden? AFAICS they do not "settle" on it, but they do argue that it is much lighter in almost every respect. And since it is Bitwarden compatible the comparison is valid.

---

Frankly, I think most people just got salty because of the javascript overlay which I found pretty funny; a mild prank and a good demonstration of the power of javascript.

I didn't downvote, but personally I'm upset that this article doesn't give you a good alternative, only a ridiculously complex new setup that is unrealistic and impractical for most users.

How does your phone and laptop outside of the network get to vault warden? Just using a VPN?

i really don’t get it either. i feel like op tends to write well researched and thought out blogs, which are nice to read too.

@op: you do good stuff!

Im one of the folks that reserve important items for local password manager and use bitwarden for all the various sites that if it got taken over it might be annoying but is not the end of the world.

If the domain starts with xn- it's a telltale sign, that it's a punycode domain name. Read: it does contain characters that are not ASCII characters. This is done as domains need to be ASCII only. The format of these domains is usually xn--allASCIIcharacters-allNonASCIIcharactersEncoded.tld. Example: täst.com is xn--tst-qla.com.

If you manually type such a domain (containing characters like äöüéèçč...), many browsers will still display what you entered, but convert the domain into punycode in the background before connecting.

You can decode the domain of this post and it results in マリウス.com.

It's just a punycode domain, it ought be rendered in Japanese:

マリウス.com

Edit: I swear those replies weren't there when I typed mine.

This is puny code, and allows for non ascii characters to be used as a domain name. Your lemmy client probably does not convert it to unicode and displays it as a random looking text https://en.wikipedia.org/wiki/Punycode

they even have a blog post telling you to never click domains that look like the domain of the blog :D

I don't think Bitwarden is a terrible choice. That said, I share the author's concerns in general.

How much does a non-selfhosted password manager cost? Weigh that against the cost of remote-mountable server storage, you can simply put your database there.
(Both costs can be 0 btw)

I prefer 1Password. They use a secure encryption key together with your master password. If you lose the encryption key, your data can’t be recovered. The key is only needed during the initial setup annd after that you unlock the vault on your device with your master password.

This means if their database ever gets hacked, your data is encrypted in a way that not even you could get at unless you have that secure key.

Passbolt seems to be a upcoming competitor. It's EU based, OSS, etc., but has not been audited as much as BW and has not achieved feature parity so far.

But it looks very promising.

Enpass works well for me across platforms.

Use yubikeys

ProtonPass