# Bitwarden going proprietary? **URL:** https://discuss.privacyguides.net/t/bitwarden-going-proprietary/21641 **Category:** General **Tags:** software **Created:** 2024-10-20T11:48:12Z **Posts:** 140 ## Post 1 by @D0loresH4zePH — 2024-10-20T11:48:12Z > > > Pull request #10974 introduces the `@bitwarden/sdk-internal` dependency which is… needed to build the desktop client. The dependency contains a licence statement which contains the following clause: > ``` > You may not use this SDK to develop applications for use with software other > than Bitwarden (including non-compatible implementations of Bitwarden) or to > develop another SDK. > ``` > This violates freedom 0. > > It is not possible to build desktop-v2024.10.0 (or, likely, current master) without removing this dependency. --- ## Post 2 by @null — 2024-10-20T12:09:35Z > > > Pull request #10974 introduces the `@bitwarden/sdk-internal` dependency which is… needed to build the desktop client. The dependency contains a licence statement which contains the following clause: > ``` > You may not use this SDK to develop applications for use with software other > than Bitwarden (including non-compatible implementations of Bitwarden) or to > develop another SDK. > ``` > This violates freedom 0. > > It is not possible to build desktop-v2024.10.0 (or, likely, current master) without removing this dependency. --- ## Post 3 by @ikelatomig — 2024-10-20T12:11:45Z Let’s see how it turns out. Instead of attacking. --- ## Post 4 by @asanyan — 2024-10-20T13:13:01Z that’s unfortunate. Was considering switching to bitwarden for their browser extension but now I’m definitely not doing so anymore --- ## Post 5 by @pika — 2024-10-20T13:32:18Z As this story develops and we receive more clarity , I would like to say that even if a service or a product decides to make their code proprietary doesn’t necessarily mean that the service or product is going to be bad. Yes there maybe issues regarding its transparency but all trust is not lost and if they provide us good services at a very cheap price , only closing source wouldn’t be a deal breaker. Also to consider that bitwarden is a company and would be spending a lot on the developers and employee cost to make this project up and running. Doing a business with opensource model and products might not be profitable venture for everyone (we already have seen an example with skiff) and the ways to monetize it maybe difficult while tackling competition in the market. Also i am not sure how profitable is there business and team offerings So in the long term a closed source approach may help the company to better sustain the project and ensure its survival. I am not aware at this point the reasons behind such decision but i would rather use a service which ensures its long term sustainability of the product and promises continuous improvement than the one which would keep false promises. Being a bitwarden user for a long time i would certainly want them to have a more sustainable business model than fail on promises at later point. --- ## Post 6 by @exaCORE — 2024-10-20T13:36:43Z This is hugely concerning. I guess this is just what happens with VC companies. Extremely disappointing --- ## Post 7 by @asanyan — 2024-10-20T13:39:42Z At least BW is _only_ a password manager; users aren’t locked in as it should b e easy to export your database and switch to something else. --- ## Post 8 by @overdrawn98901 — 2024-10-20T13:45:43Z Proprietary is not the same as source available with restrictions. If the code is still available for public viewing, this is what is most important for security and privacy. How they combined a GPLv3 license with a restrictive one and if that’s even GPL compatible, I have no idea. From my super brief view in the commit, it looks like the SDK is opt-in, so default builds don’t include it? Not sure. But the client is still GPLv3, so that’s as free as you get for client code. Overall, saying it’s proprietary is just plain wrong. It may violate Freedom 0 of GPL, but so does FUTO with their software. --- ## Post 9 by @exaCORE — 2024-10-20T14:01:02Z I consider FUTO to not be open source. I think there are benefits of open source software that go beyond security and privacy concerns, hence why i am extremely disappointed with this pivot --- ## Post 10 by @overdrawn98901 — 2024-10-20T14:06:39Z I agree it’s disappointing for similar reasons, at least in terms of freedom. However, I’ll take source available over proprietary if it’s coming from corpos. Even then, the client is still GPLv3, with the SDK their source available license, so the SDK can be swapped from a OSS one (I believe). --- ## Post 11 by @asanyan — 2024-10-20T14:08:47Z Also, cloud based password managers are possibly the most sensitive applications you can possibly run and therefore any potentially negative change should be taken very seriously by everyone who uses it. If let’s say an emulator became proprietary, you could just put it in a sandbox, deny the network permission and forget about it, but you can’t just brush something like this off for a password manager that must connect to the internet and by design is to be highly trusted by the user. --- ## Post 12 by @overdrawn98901 — 2024-10-20T15:14:54Z Only way to validate server side code is indeed running the code is through AGPL. With this, their server code is a combination of AGPL and their business like license. In other words, while you don’t have the freedom to fork and rebrand, you’ve got the freedom to request the source code for audit and validation. That’s pretty good for security and privacy. --- ## Post 13 by @anon63378630 — 2024-10-20T16:12:15Z The Bitwarden SDK, which is a core component of their apps has already been proprietary for a long while. See: - [sdk-sm/LICENSE at 6460db27b098bf58983632430380c0a2886d3796 · bitwarden/sdk-sm · GitHub](https://github.com/bitwarden/sdk/blob/6460db27b098bf58983632430380c0a2886d3796/LICENSE) - [bitwarden (!15353) · Merge requests · F-Droid / Data · GitLab](https://gitlab.com/fdroid/fdroiddata/-/merge_requests/15353#note_1995132756) ianal but since the apps are actually GPL-3.0 this can do two things: - make the clients “look but don’t touch” since they depend on a proprietary blob, effectively becoming source available - or since GPL is toxic, actually invalidate the license of the proprietary blob, since they author it too I’ve been bringing this up in my chat over the past few weeks and getting people to switch, because it is not a good direction. --- ## Post 14 by @asanyan — 2024-10-20T17:02:28Z What password manager do you recommend? --- ## Post 15 by @asanyan — 2024-10-20T17:05:23Z Yeah, but one problem is that now people will be less incentivized to look at the codebase if they can’t do anything with it. I’m not saying that it’s necessarily the end of the world but it’s a problem, in my opinion --- ## Post 16 by @anon63378630 — 2024-10-20T17:07:31Z The tried and true KeePass and KeePassXC: GPL without a bullshit CLA and offline as God intended. --- ## Post 18 by @redoomed1 — 2024-10-20T18:17:22Z 4 posts were split to a new topic: [Financial side of privacy-focused FOSS software and projects](/t/financial-side-of-privacy-focused-foss-software-and-projects/21652) --- ## Post 19 by @exaCORE — 2024-10-20T17:28:33Z Isn’t Proton Pass proprietary (at least the backend?) --- ## Post 24 by @anonymous208 — 2024-10-20T18:12:17Z They locked the GitHub discussion too. This is not a good sign --- ## Post 25 by @redoomed1 — 2024-10-20T18:18:31Z A post was merged into an existing topic: [Financial side of privacy-focused FOSS software and projects](/t/financial-side-of-privacy-focused-foss-software-and-projects/21652/5) --- ## Post 26 by @anon80779245 — 2024-10-20T18:28:14Z See their [answer](https://github.com/bitwarden/clients/issues/11611#issuecomment-2424865225) > Hi [@brjsp](https://github.com/brjsp), > Thanks for sharing your concerns here. We have been progressing use of our SDK in more use cases for our clients. However, our goal is to make sure that the SDK is used in a way that maintains GPL compatibility. 1. the SDK and the client are two separate programs 2. code for each program is in separate repositories 3. the fact that the two programs communicate using standard protocols does not mean they are one program for purposes of GPLv3 Being able to build the app as you are trying to do here is an issue we plan to resolve and is merely a bug. --- ## Post 27 by @anon63378630 — 2024-10-20T18:29:09Z but that just shows their true intent. --- ## Post 28 by @anon80779245 — 2024-10-20T18:34:32Z Well, the sdk can be used for Bitwarden or any other implementation of it. I don’t see where is the problem. --- ## Post 29 by @anonymous208 — 2024-10-20T18:35:25Z It can’t, though. > You may not use this SDK to develop applications for use with software other > than Bitwarden ( **including non-compatible implementations of Bitwarden** ) or to > develop another SDK. --- ## Post 30 by @anon80779245 — 2024-10-20T18:37:02Z But what non-compatible mean ? In my view, any client that can connect with their server is compatible, but I could be wrong. --- ## Post 31 by @anonymous208 — 2024-10-20T18:37:54Z > [@anon80779245](#): > > But what non-compatible mean ? In my view, any client that can connect with their server is compatible, but I could be wrong. Exactly, it’s quite vague. It’s not clear whether Vaultwarden would be counted as a “non-compatible” implementation. So it wouldn’t be safe to use it. Not to mention, it’s not a FOSS license anyway See [License is not FOSS-compatible. · Issue #898 · bitwarden/sdk-sm · GitHub](https://github.com/bitwarden/sdk/issues/898#issuecomment-2226928362) --- ## Post 32 by @certainty — 2024-10-20T18:46:25Z BW is strong, battle tested and in the industry for long. Apart from the outdated UI, BW did not integrate the password management and data breach alerts to their apps. It can’t find its place among other apps. Proton has a bunch of products, its users will try it for sure, some proton unlimited would also consider switching. 1password has ample customization so users who prefer ease of use would surely go for it. Then there’s Keepass and its family for offline usage. > [@Anon47486929](#): > > Unfortunate. Is Proton Pass now the only big option for a cloud synced password manager? Maybe. I like lot of features in proton pass but I don’t like its webapp showing passwords in very large font. I use custom fields in BW extensively which doesn’t get perfectly imported in other password managers. Lets wait and see where this path goes. --- ## Post 33 by @anon80779245 — 2024-10-20T18:48:26Z That’s sad, but also understandable as a business strategy. Bitwarden is fully self-hostable, and so maybe Bitwarden has seen that third party client were gaining too much popularity. I know we all like to say how companies are evil, etc. – but at the end of the day they need to make money to keep the lights on. Proton Pass has done this with a freemium model, a proprietary backend, integration with their own allias, etc. 1 Password has done this through a paid-only service. --- ## Post 35 by @anon80779245 — 2024-10-20T18:56:20Z > [@Anon47486929](#): > > The sudden change without discussion Well, they have a public Github repo and anyone can track Pull Requests. of course, they aren’t to actively promote this change, But if they ask, wouldn’t everyone say it’s a bad idea without proposing alternatives? > [@Anon47486929](#): > > similar bad faith actions in the past such as ? --- ## Post 37 by @anon80779245 — 2024-10-20T19:11:21Z > [@Anon47486929](#): > > Yeah, lemme just follow the development cycle of all the services I use to ensure they don’t sneak in shit. You don’t have to, but some people will and that’s the original goal of journalists. > [@Anon47486929](#): > > and it’s usually not my job to propose alternative unless I am getting a consulting fee. sorry but what ? You say they didn’t seek user feedback, but you wouldn’t propose alternatives if they didn’t pay you… > [@Anon47486929](#): > > If Google suddenly made AOSP proprietary (they can’t) everyone would be crucifying them. Well, having one source-available dependency is really not the end of the world. After all, Android has Google services. And yes, I do make a difference between a small company and one of the largest company in the world. --- ## Post 39 by @anon80779245 — 2024-10-20T20:35:10Z > [@Anon47486929](#): > > AOSP has no google services attached to it. Are you sure ? > [@Anon47486929](#): > > They sold the service by saying it’s fully open source. I paid on that premise. Then they made a change to that condition on which I paid them, without informing me. That’s deception. Is that clear? I understand, but I’m not sure whether including a dependency that isn’t open-source but only source-available is a violation of open-source principles. For example, Mozilla includes DRM Google plugin But I understand you are angry, especially if you are a paid customer, > [@Anon47486929](#): > > What? I don’t think auditing pull request on GitHub repos is the original goal of journalists. My point was that Tech journalists should (and some are doing a good job) check PRs for open-source projects as it would allow to talk about upcoming features, or possible bad changes like this one. The original goal of journalists is to dig into documents so people don’t have to. > [@Anon47486929](#): > > Bitwarden is not some mom and pop project run by a single maintainer. They are a service provider with end users, contracts, and companies they support. Maybe I underestimated their size. Also, and I am bit contracdicting myself here, but we might see here a race for profits as they have to make money for the 100 millions dollars they raised, [https://productmint.com/how-does-bitwarden-make-money/](https://productmint.com/how-does-bitwarden-make-money/) --- ## Post 40 by @asanyan — 2024-10-20T20:47:53Z > [@anon80779245](#): > > Mozilla includes DRM Google plugin You must enable it manually within the browser, and only after you enable it the required binaries are downloaded and run. It’s not included out of the box and isn’t a dependency required for the browser to work. --- ## Post 41 by @Breeze7846 — 2024-10-20T20:52:23Z Ah crud, this makes me concerned. I _just_ was recommending bitwarden to a friend yesterday too… @jonah what is PG’s take on all this? --- ## Post 42 by @Quantum — 2024-10-20T21:38:12Z Maybe I am misunderstanding something but I don’t understand why this is such a big deal from a security perspective. If the code remains source available, and therefore auditable, nothing stops anyone from finding and reporting issues. If the complaints are that a company is spending money developing code and others cannot use it for free anymore than…well I don’t really care. Bitwarden has to make money and if they paid for the code development I don’t see any issue with them not giving it away for free. For what it’s worth, they still have this section on their website with a link to GitHub: > **[Open Source Password Manager | Bitwarden](https://bitwarden.com/open-source/)** > > Bitwarden is an open-source password manager that is committed to ensuring source code transparency as a primary requirement for security solutions. --- ## Post 43 by @overdrawn98901 — 2024-10-20T21:49:21Z As an end user, I also bad not understand why this is a big deal, even as a FOSS enthusiast. Are people afraid of rug pulling of the license? Why does this negatively affect you today? --- ## Post 44 by @xe3 — 2024-10-20T22:09:22Z To me it feels like a lot of people are knee-jerk reacting without taking a moment first to understand what the issue is (or the context). Some relevant links and comments: Comment #1 (from the original person who created the issue) [too long to quote but worth reading, here is a link.](https://github.com/bitwarden/sdk/issues/898#issuecomment-2425052091) * * * Comment #2 (from a bitwarden developer) > Hi, Thanks for sharing your concerns here. We have been progressing use of our SDK in more use cases for our clients. However, our goal is to make sure that the SDK is used in a way that maintains GPL compatibility. > > - the SDK and the client are two separate programs > - code for each program is in separate repositories > - the fact that the two programs communicate using standard protocols does not mean they are one program for purposes of GPLv3 [https://www.reddit.com/r/Bitwarden/comments/1g7uwa2/desktop\_version\_2024100\_is\_no\_longer\_free/lstss5i/](https://www.reddit.com/r/Bitwarden/comments/1g7uwa2/desktop_version_2024100_is_no_longer_free/lstss5i/) * * * Comment #3 (Community Member) > As a suggestion, next time spell out SDK at least once. Some people are thinking it has something to do with the desktop app, instead of Software Development Kit. And maybe write a clearer statement for the Reddit community, which isn’t that technical. I saw a lot of panicked users here who clearly have no idea what this issue is all about. [https://www.reddit.com/r/Bitwarden/comments/1g7uwa2/desktop\_version\_2024100\_is\_no\_longer\_free/lsutauq/](https://www.reddit.com/r/Bitwarden/comments/1g7uwa2/desktop_version_2024100_is_no_longer_free/lsutauq/) --- ## Post 45 by @FlipSid — 2024-10-20T22:31:54Z Thanks for the links @xe3 At first I was starting to search for an alternativ (1Password / Keypass2 maby), but I figure I’ll just keep using good old trusty Bitwarden after reading this. I’ll keep an eye on it for a few days, to make sure I did not missunderstand. So far I’m understanding as @Quantum and agree --- ## Post 46 by @anon63378630 — 2024-10-20T22:37:45Z The SDK in this context is clearly just a library for doing the real stuff and they deliberately made it proprietary. This isn’t some extra bonus fun for other people to use like an SDK would usually be. This has been known for months, again I posted above this is why [F-Droid.org](http://F-Droid.org) won’t include Bitwarden because to reiterate again it is a proprietary dependency. --- ## Post 47 by @overdrawn98901 — 2024-10-20T22:38:57Z This seems perfectly valid to me. They still ensure they section out their source available code and still publish a significant portion as FOSS as you get. --- ## Post 48 by @anon63378630 — 2024-10-20T22:39:45Z > [@overdrawn98901](#): > > This seems perfectly valid to me But why tolerate it? It wasn’t like this before. This is a blatant rug pull, especially for customers who paid for a FOSS solution. Y’all gotta resist more and stop tolerating this bullshit. --- ## Post 49 by @Quantum — 2024-10-20T22:46:40Z For me as an end user this doesn’t affect my service. I’m still getting the same service/software I’m already paying for, including the security benefits of source available code. This just restricts what _others_ can do for free. --- ## Post 50 by @anon29374801 — 2024-10-20T22:51:43Z > [@Quantum](#): > > I’m still getting the same service/software I’m already paying for, including the security benefits of source available code. This just restricts what _others_ can do for free. This a jarringly selfish response. I guess we should only care if the project is free (as in freedom) when were personally affected by it. --- ## Post 51 by @Quantum — 2024-10-20T23:12:47Z Or we should be willing to pay for products and services we use. Why should Bitwarden be expected to work for free? --- ## Post 52 by @FlipSid — 2024-10-20T23:20:37Z > [@anon29374801](#): > > This a jarringly selfish response. I guess we… I dont find it selfish. He makes the best decisons, based on his best knowlege, for him and the services he uses. Just as you. And me. And others. :slight_smile: As for what others do, or dont do, I’m not worried about that part. I’ll still follow the topic some to see where it goes. If find Im wrong I’ll just switch, if not I’ll stick with BW. Simple --- ## Post 53 by @ikelatomig — 2024-10-21T02:46:04Z > [@anon80779245](#): > > Bitwarden is fully self-hostable, and so maybe Bitwarden has seen that third party client were gaining too much popularity. You are right. Vaultwarden doesn’t need any money to host. Whereas Bitwarden self-hosting requires a subscription based licence. Potentially companies opted into it, cost-savings. That is why, they did the thing to keep the enterprise market ? As previously said. Source available is better than going closed source. --- ## Post 54 by @ikelatomig — 2024-10-21T02:50:24Z I think people are going too hard on the FSF motto. Maybe people need to think about it factually and logically based on the present time. --- ## Post 56 by @anon48875053 — 2024-10-21T05:16:44Z 1Password - alost 1 billion in VC funding and is completely proprietary. Bitwarden - over 100M in VC funding and going proprietary? Just go with Proton Pass… --- ## Post 57 by @anon83749493 — 2024-10-21T05:27:41Z Protonpass also has proprietary backend. --- ## Post 58 by @anon70581596 — 2024-10-21T06:24:01Z That’s bad, I guess I’ll just have to find a new password manager now. Can anyone recommend a trustworthy alternative with a decent iPhone app ? unfortunately Strongbox it’s open source either. --- ## Post 59 by @anon48875053 — 2024-10-21T06:41:07Z Which doesn’t matter because Proton Pass isn’t self-hostable and is E2EE. --- ## Post 60 by @anon21666177 — 2024-10-21T06:41:23Z Strongbox is open source under the AGPL license: [GitHub - strongbox-password-safe/Strongbox: A KeePass/Password Safe Client for iOS and OS X](https://github.com/strongbox-password-safe/Strongbox) --- ## Post 61 by @anon48875053 — 2024-10-21T06:47:48Z > [@anon63378630](#): > > Y’all gotta resist more and stop tolerating this bullshit. That’s how the world gets shittier every day because people tolerate this kind of bullshit and show that other companies can join on it too. --- ## Post 62 by @anon48875053 — 2024-10-21T06:48:58Z > [@anon70581596](#): > > Can anyone recommend a trustworthy alternative with a decent iPhone app ? unfortunately Strongbox it’s open source either. Proton Pass or check out KeePassium? --- ## Post 63 by @exaCORE — 2024-10-21T07:00:28Z > [@anon48875053](#): > > Proton Pass isn’t self-hostable Hence why in many people’s view, it is not a suitable alternative to BW --- ## Post 64 by @anon83749493 — 2024-10-21T07:03:20Z Makes no sense. If I dont care about proprietary backend, why would I not just use Bitwarden. --- ## Post 65 by @MrRight — 2024-10-21T07:34:09Z They built themselves up as the open-source password manager. Its what people know them as. Even after this change people will still believe that. Worse of all, it seems they would have stayed quite if it wasn’t brought up, thats a problem. You can’t just build up a reputation, then discard it once you’ve grown big enough and expect people to not get upset with you. --- ## Post 66 by @anon83749493 — 2024-10-21T07:43:07Z Nope, SDK has been proprietary for a while now. If you want FOSS, use Keepass or one of the forks. If you dont mind proprietary stuff, Bitwarden is still pretty good. --- ## Post 68 by @anon73250778 — 2024-10-21T08:28:04Z I guess Bitwarden would have more money if it wasn’t sponsoring podcasts left and right like Nord VPN and Raid Shadow Legends do. I feel torn about this. On one hand, I want BW to have a successful business model and on the other hand this seems like fuck\*ng the self-hosting crowd. And a lot of Linux people are into self-hosting. I got tired of managing my KeePass \*.kdbx backups and want to have a cloud based password manager for my sanity. I hesitate to go to Proton Pass to avoid the _all eggs in one basket_ kind of situation but it seems like there is no avoiding it as BW seems to operate in a bad faith sort of way, betraying its FOSS spirit. --- ## Post 69 by @anon48875053 — 2024-10-21T08:28:58Z By many people? Selfhosting a password manager is wild, you really need to know how to do it properly, how to keep it secure, and then maintain it instead of leaving it to dedicated professionals. Selfhosting Bitwarden is niche and kind of advanced, not many people are doing it, and not many people should. --- ## Post 70 by @anon48875053 — 2024-10-21T08:32:17Z Proton has stated from the start that they will not open source their backend code for any of its services because their services aren’t selfhostable and there is a lot of anti-abuse logic that would get exposed. Meanwhile, Bitwarden was always open source, and now they’re just doing a rug pull, and it makes me sad to see people defending this move. Sigh. --- ## Post 71 by @anon48875053 — 2024-10-21T08:37:17Z Both 1Password and Bitwarden are running on massive amounts of VC funding, one is proprietary, and the other is going in that direction. Meanwhile, Proton has zero VC money, has a sustainable business model, and turned itself into a non-profit to keep users trust, which Bitwarden just threw away by doing this rugpull. I will let you choose which company has your best interests in mind. * * * Notesnook made this blog post a while ago: [It's time to leave Bitwarden](https://blog.notesnook.com/its-time-to-leave-bitwarden) A lot of people called it FUD, but now we can all see the consequences of VC funding. --- ## Post 72 by @null — 2024-10-21T11:35:10Z Living the good life in keepass land :sunrise::sunglasses: Is sad bitwarden was a easy recommendation to non-tech people. --- ## Post 73 by @Dkama — 2024-10-21T11:52:20Z > [@anon48875053](#): > > Which doesn’t matter because Proton Pass isn’t self-hostable and is E2EE. Have you seen Tresorit’s [vulnerability](https://discuss.privacyguides.net/t/end-to-end-encrypted-cloud-storage-in-the-wild-a-broken-ecosystem-sync-pcloud-icedrive-seafile-and-tresorit/21417)? > - **Tresorit** ’s public key authentication relies on server-controlled certificates, which attackers can replace to access shared files. Metadata is also vulnerable to tampering, allowing attackers to alter file creation details and mislead users. > From [BleepingComputer] ([Severe flaws in E2EE cloud storage platforms used by millions](https://www.bleepingcomputer.com/news/security/severe-flaws-in-e2ee-cloud-storage-platforms-used-by-millions/) )? E2EE doesn’t really suffice if you’re sharing passwords. Then, you’re relying also on the server’s security. --- ## Post 74 by @Shampoo — 2024-10-21T12:16:19Z > [@anon80779245](#): > > The original goal of journalists is to dig into documents so people don’t have to. The original goal of journalists was to report on things that were happening publicly. Digging into documents was a great way to get thrown in jail/die back when people ruled by divine right. --- ## Post 75 by @anonfox — 2024-10-21T12:18:49Z E2EE doesn’t rely on server security. It’s about client side encryption. Even if the server is malicious, proper E2EE won’t be affected --- ## Post 76 by @anon2844160 — 2024-10-21T12:20:16Z > [@anon48875053](#): > > Meanwhile, Proton has zero VC money Proton had 2 rounds of VC money. What I have not heard about and did not find in searching is either how did they remove the VC investment, or how did they get them to go along with the non-profit idea? --- ## Post 77 by @anonymous208 — 2024-10-21T12:39:00Z The whole USP of Bitwarden is that it has foss client and server and self hostable --- ## Post 78 by @overdrawn98901 — 2024-10-21T13:04:55Z Depends on one’s priorities. As someone who wants to use software that is public and available on request, it checks that box. Can’t do that with Proton Pass. However, I am under no false pretense they are providing source code because of the community and they love FOSS. Rather it’s a selling point to security critical software. I will never expect a company to maintain FOSS standards, as they will utilize it insofar it gives them profits. FOSS and capitalism pretty much grind gears. Given this, Bitwarden has at least sectioned off their poisoned code from proper GPL / AGPL code, instead of doing an entire bait/switch via SSPL like ElasticSearch or Redis. If that happens, I’ll probably consider switching then and sending them many colorful emails (I’ve already send them an email on this situation). Currently, they’ve done a partial rug pull, where we have less, but not nothing. My options are stick with Bitwarden, or jump to a proprietary Proton Pass. I have no intention on using a local only password manager either. This news has not changed my initial position. --- ## Post 80 by @Cyber-Typhoon — 2024-10-21T14:13:00Z From my point of view, I agree that it doesn’t alter the features offered, but it opens a door that was previously closed. This precedent creates uncertainty, suggesting that at any given point, things can take a turn for the worse and become unbearable. Right now, it’s a warning, but the question remains: are you willing to take that risk? --- ## Post 81 by @anon29374801 — 2024-10-21T14:20:39Z Bitwarden did [respond](https://xcancel.com/Bitwarden/status/1848240810795372589#m) to this on X/Twitter as well. > It seems like a packaging bug was misunderstood as something more, and the team plans to resolve it. Bitwarden remains committed to the open source licensing model in place for years, along with retaining a fully featured free version for individual users > [@FlipSid](#): > > As for what others do, or dont do, I’m not worried about that part. disregarding others and only caring about your own needs is the literal definition of selfish lol. > [@Quantum](#): > > Why should Bitwarden be expected to work for free? You are thinking of the wrong type of “free”. --- ## Post 83 by @Cyber-Typhoon — 2024-10-21T14:25:59Z Perfect timing, I just expressed opinions on this. If confirmed that they are not changing their license model we should in the future be more cautions about assuming positions. I’m not sure if they stepback after getting caught. Not sure why they didn’t responded in Github. --- ## Post 84 by @FlipSid — 2024-10-21T15:26:42Z > [@anon29374801](#): > > disregarding others and only caring about your own needs is the literal definition of selfish lol. Not really, read what I write and dont interpret, so again: It means I take responsibility for my, and only my, actions (and no actions). So in this case, if you (and others) dont want to use BW because of this, go ahead. So far I dont see a problem, so I’ll keep using it. Clearer now? --- ## Post 85 by @anon29374801 — 2024-10-21T15:36:51Z > [@FlipSid](#): > > Not really, read what I write and dont > interpret, so again: ok… this is is what your wrote… > [@FlipSid](#): > > As for what others do, or dont do, I’m not worried about that part. if you meant… > [@FlipSid](#): > > It means I take responsibility for my, and only my, actions (and no actions). then write that. You have completley changed what you you were saying. I can’t divine that you would decide to change your answer. My point still stands, you only care about yourself as you have now stated two different times. Thats inherently selfish, it makes sense that you and @Quantum agree. --- ## Post 86 by @FlipSid — 2024-10-21T15:44:56Z Seems like your still not understanding my point of view, or what I’m saying (or both :sweat_smile:), but lets just agree to disagree, and just get on with using, or not using BW :wink: --- ## Post 87 by @overdrawn98901 — 2024-10-21T16:12:31Z > [@Anon47486929](#): > > It is the same situation. Frontend clients are open source with MIT for redis too, with backend being source available. There is literally no difference. Look here: [Redis · GitHub](https://github.com/redis) Redis’s backend is licensed under `Redis Source Available License 2.0 (RSALv2) Agreement`. Bitwarden backend is dual licensed under `AGPL` and `Bitwarden License v1.0` whereas the latter is located under `/bitwarden_license` folder in source code. Redis front-end libraries are licensed under `MIT`, while front-end on Bitwarden is dual licensed under `GPLv3` and `Bitwarden License v1.0` whereas the latter is located under `/bitwarden_license` folder in source code. This is **not** the same. If it was the same, then it would be the same licenses with the same clauses. I find it disingenuous to lump together licenses solely based on being able to view the source code. * * * Licenses aside, the goal of enshittification is likely the same, but I’m thinking this will be a slow poison rather than a quick one. > [@Cyber-Typhoon](#): > > This precedent creates uncertainty, suggesting that at any given point, things can take a turn for the worse and become unbearable. Right now, it’s a warning, but the question remains: are you willing to take that risk? This is my take. I’m cautious, but I’m sticking with it for the time being. If the copy-left aspect of the client or server side code are removed, then I’m off to Proton Pass without hesitation. --- ## Post 89 by @overdrawn98901 — 2024-10-21T16:32:12Z As a final follow-up, see [this commit on May 9, 2022](https://github.com/bitwarden/clients/commit/7ae9fec6d41a8c00b6ca9bc175e33da3b21a25aa) where they added the dual license capability. Regardless, anyone who is a paying customer should contact the support and let them know you are considering switching because of this. Vote with your wallet, and let them know paying customers are unhappy with this slow movement away from FOSS. I doubt this will be a huge dent. Corpos listen to money, not philosophy. --- ## Post 90 by @mycobee — 2024-10-21T17:34:32Z Very sad. My consulting company is using passbolt internally and have had a good experience, so perhaps I will go with that for personal too. What a massive disappointment. Gross. --- ## Post 91 by @anon41112412 — 2024-10-21T20:05:14Z Another FOSS project, proving that it’s not viable to earn enough money to sustain itself. Most users using FOSS software never donate/pays for the Project, Nor do they want ads in those softwares or might use adblockers to block ads on those softwares and when the software finally either shuts down or go proprietary, makes shocked pickachoo face. Some then even have audacity to harass developers online. If the product is really essential, they may still use any tool in their disposal to block the software from making money. I think it’s a high time where people in FOSS community should understand that money is required for regular development and maintainance of a software and support their favourite projects with monetary support . Yes, some people may start FOSS projects as hobby projects, unless those projects really have some pretty cool way of earning money, the project is not something to be relied on as it can be EOL anytime as most open source software comes with no warranty nor the developer owes anything to anyone when they have an open source software. --- ## Post 92 by @pika — 2024-10-21T21:43:32Z > [@anon41112412](#): > > I think it’s a high time where people in FOSS community should understand that money is required for regular development and maintainance of a software i understand this point but bitwarden already got vc funding 2 years back i guess and this case is not exactly like skiff , where they are selling of the foss products and closing the service. Also the CEO afaik is still the same. I think the founder and CEO plays major role in how the company is run. Agreed that there maybe new investors who may have significant influence in what path bitwarden takes forward. (which it already has been following since 2 years) So all may not be lost. 1password a closed source app was already recommended by PG , so i don’t think open source is a mandatory criteria to fulfill as far as they are maintain the security standard and don’t track users. --- ## Post 93 by @overdrawn98901 — 2024-10-21T22:18:21Z I contacted support with my concerns and got this reply: > It seems like a packaging bug was misunderstood as something more, and the team plans to resolve it. Bitwarden remains committed to the open source licensing model in place for years, along with retaining a fully featured free version for individual users. --- ## Post 94 by @anon41112412 — 2024-10-22T07:12:45Z But a lot of people don’t understand this point. For them Free in FOSS means Free as in price. Also if you see most proprietary software are also free because they implement ads to earning. This has caused a massive shift where people expect a software to be free without giving anything back to developers. --- ## Post 95 by @anon80779245 — 2024-10-22T07:51:59Z > [@anon41112412](#): > > This has caused a massive shift where people expect a software to be free without giving anything back to developers. To be fair, I think Bitwarden was already making some money. The Problem is they took 100million in VC funding, so they are forced to dramtically increase their profits. --- ## Post 96 by @anon41112412 — 2024-10-22T10:11:03Z Yeah, that’s why people should fund their favourite FOSS project more so that projects don’t have to beg from VCs which in long turn forces them to then change their entire structure, hence alienating old userbase. --- ## Post 97 by @anon80779245 — 2024-10-23T08:14:22Z > [@anon41112412](#): > > Yeah, that’s why people should fund their favourite FOSS project more so that projects don’t have to beg from VCs I mean you are right, but at the same time, raising 100 million ? This seems like a receipt for disaster. --- ## Post 98 by @anonymous208 — 2024-10-23T08:51:26Z Nope. They just make it seem that way on the surface. > [@Remove Strongbox](https://discuss.privacyguides.net/t/remove-strongbox/19613): > > Why should this tool be removed? Now that it has come to light that Strongbox [is not an open source password manager](https://github.com/privacyguides/privacyguides.org/pull/2654), even though they misleadingly claim so, I suggest that we stop recommending it and instead take a closer look at KeePassium, and if we want to recommend it over Strongbox. [Here](https://github.com/strongbox-password-safe/Strongbox/issues/784) is also a relevant thread where a user and the Strongbox developer discuss this matter, which @Jonah has already called: “informative, and unfortunate”. I don’t think it would be wise to continue recommend… --- ## Post 99 by @Quantum — 2024-10-23T19:59:39Z Sounds like plenty of money to be financially viable for a long time and make a competitive product that can succeed against entrenched competitors. Profit isn’t evil. --- ## Post 100 by @overdrawn98901 — 2024-10-25T02:18:07Z > > > Pull request #10974 introduces the `@bitwarden/sdk-internal` dependency which is… needed to build the desktop client. The dependency contains a licence statement which contains the following clause: > ``` > You may not use this SDK to develop applications for use with software other > than Bitwarden (including non-compatible implementations of Bitwarden) or to > develop another SDK. > ``` > This violates freedom 0. > > It is not possible to build desktop-v2024.10.0 (or, likely, current master) without removing this dependency. > We have made some adjustments to how the SDK code is organized and packaged to allow you to build and run the app with only GPL/OSI licenses included. The sdk-internal package references in the clients now come from a new [sdk-internal repository](https://github.com/bitwarden/sdk-internal), which follows the licensing model we have historically used for all of our clients (see [LICENSE\_FAQ.md](https://github.com/bitwarden/server/blob/53ad9df003fc855bbd95b6be93247d902816dca1/LICENSE_FAQ.md) for more info). The sdk-internal reference only uses GPL licenses at this time. If the reference were to include Bitwarden License code in the future, we will provide a way to produce multiple build variants of the client, similar to what we do with web vault client builds. > > The original [sdk repository](https://github.com/bitwarden/sdk) will be renamed to **sdk-secrets** , and retains its existing Bitwarden SDK License structure for our Secrets Manager business products. The sdk-secrets repository and packages will no longer be referenced from the client apps, since that code is not used there. --- ## Post 101 by @overdrawn98901 — 2024-10-25T02:29:17Z This seems like a fair response - unless there is more discussion, I think the above response answers it --- ## Post 103 by @Pragmatic — 2024-10-25T09:23:39Z Stop it, they said it was a bug, move on, I’m still loyal to BW, it’s still open source, every company that respects privacy at some point has had communication problems, Proton, Tuta, Signal, Firefox, DDG, Brave, Orqanic Maps, all of them… And what are you going to do, change every time, at the slightest error in communication or misinterpretation by the community? --- ## Post 104 by @anon73250778 — 2024-10-25T09:37:22Z > [@Pragmatic](#): > > Stop it, they said it was a bug These are the kinds of maneuverings/claims that Microsoft makes, not your usual open source companies. --- ## Post 105 by @Pragmatic — 2024-10-25T09:57:41Z The BW team have said it was a bug/error that was misinterpreted, let’s give them the benefit of the doubt, they’ve been blameless up to now and they’ve stated several times on X, Reddit, Github that nothing was going to change, the matter is supposed to be closed now I don’t understand why there are still people who expect companies to make no mistakes, no miscommunications, no bugs or anything else. Nothing changes, trust is not supposed to erode, what more do you expect, it’s going to stay open source, everything’s fine --- ## Post 106 by @KeepItSimple — 2024-10-25T10:33:49Z That news do not bother me at all, but I was curious about alternatives and actually I allready seen there is a Keyguard, but I did not knew it is a 3rd party Bitwarden client. One of my devices is old and slow and Bitwarden works bad, even crashes. Keyguard is so much better with all the same features and even more! I wonder why nobody ever mentioned this app? --- ## Post 108 by @landordragen — 2024-10-25T10:51:23Z [https://github.com/bitwarden/sdk-internal/commit/db648d7ea85878e9cce03283694d01d878481f6b](https://github.com/bitwarden/sdk-internal/commit/db648d7ea85878e9cce03283694d01d878481f6b) --- ## Post 109 by @anon2844160 — 2024-10-25T11:32:56Z > [@Anon47486929](#): > > 1. Not clarified that they are not entirely open source as claimed by them, Including the multiple mentions of open source backend in marketing. > 2. Downplayed the issue by saying it’s a bug when caught. Having to change the repository due to licensing issues is not a bug. It’s a well defined next step in creating modularity so that they can replace bits with proprietary code whenever they wish to. > 3. Have just shifted the backend proprietary bits from being integrated to being something it calls over APIs. 1. I believe they have clarified the situation. As I understand it the password manager is open source and the intention is to keep it open source. The proprietary parts are the enterprise and extended functions like Bitwarden Send. 2. This is a common scenario. Some programmer far below senior management has a great idea, they can simplify the code base by merging all the different libraries into the SDK. Their immediate manager things “great idea lets do it”. Then when the community flags it the senior management becomes aware of it. The director or VP or whatever thinks “what are those idiots doing” goes down and points out to them that the password manager part is supposed to be open source, and that is the company model. The programmer who had the great idea goes “oops” and gets to undo all the merging they have done. I would think very few large projects would not have had something similar happen. 3. As I understand it, there is no change here. The base password manager is open source and intended to be open source. The proprietary parts relate to enterprise and extended features and have been kept separate so that the password manager parts can be kept under GPL. All that has happened is that more people are aware that there are the 2 sets of code. One of the issues with this forum is that there are many people who immediately react (knee jerk reaction) and start extrapolating a worst case scenario without gathering the facts. As I see it, someone within Bitwarden had what they thougth was a great idea, and actioned it and this time no one within the company caught it so it came into public view. The great thing is being open source it was possible for the community to see this and bring it to Bitwarden’s attention. They seem to have put it back on the correct path. I am sure there will be more such incidents in the future but as long as they are corrected, I see this as a normal part of development. --- ## Post 110 by @Pragmatic — 2024-10-25T11:41:17Z I translated what I wrote from French to English, maybe there was a misinterpretation, I didn’t mean to be disrespectful, I just wanted to say that officially it was a bug and that according to BW it was a misinterpretation by the community (which isn’t stupid) and that this kind of reaction can have harmful effects. Even before the BW team had a chance to explain or defend themselves, loads of articles, posts, topics etc were published explaining that BW was no longer open source and that people should think about changing their password manager, whereas nothing is going to change, the trust remains the same, the open source aspect, everything… The risk is that, in the long term, some people (newcomers) will form the wrong opinion or judgement about a solution because of a bug or misinterpretation, and I don’t think that helps the open source community. We’ve had problems with Proton, Tuta, GOS, Signal, Firefox, Brave, DDG, Organic Maps, Linux etc. --- ## Post 111 by @Pragmatic — 2024-10-25T11:46:43Z Thanks for the summary, I completely agree, that’s what I meant, there’s no drama, nothing changes and that’s just as well, no need to over-react to officially misinterpret a bug by the community. --- ## Post 112 by @cupcake — 2024-10-25T12:09:09Z Glad that they fix it promptly. I thought the incident was blown out of proportion too. That being said I’ve slowly looking into keepass since the incident. The reason I’ve originally chosed to use bw was that i aren’t confident enough with my ability to secure and sync the database myself. Turns out it wasn’t that hard with few cloud storage in the mix. Still using bw though, with currently have both bw and keepass on my devices but mainly used keepass as main autofill. --- ## Post 114 by @Pragmatic — 2024-10-25T12:47:40Z You’re losing trust over a bug and/or a misinterpretation—it’s ridiculous. If you want to make a change, then go ahead… change, create your own password manager even, if you feel the need :slightly_smiling_face: --- ## Post 116 by @deviancy — 2024-10-25T13:08:21Z The SDK has been re-licensed over to the GPL. Can all the chicken-littles please chill out now? --- ## Post 117 by @bigdzi — 2024-10-25T13:17:10Z TBH Im NOT suprised at all. It was predictable. Most of projects that start as FOSS ends like this. Its question of time only. --- ## Post 118 by @anon48875053 — 2024-10-25T13:25:13Z > **Off Topic** > > Let me guess, your solution is to go deep into Apple’s ecosystem? :grinning: --- ## Post 119 by @bigdzi — 2024-10-25T14:18:44Z @anon48875053 not this time… my solution is to … go with KeePass(X). Excellent product. --- ## Post 120 by @ikelatomig — 2024-10-25T14:28:03Z > [@Anon47486929](#): > > For me doubts still stand. Both of these situations should be perfectly fine, it’s an opinion. Then ask their support and tell us. If you have doubts clarify it. Not use it as banner. --- ## Post 121 by @starkle — 2024-10-25T15:14:49Z > [@Anon47486929](#): > > 1. Slight error in communication > 2. Or community is stupid to misinterpret it. That person never called you or the community stupid. You chose to put that word in their mouth. > [@Anon47486929](#): > > Again, rude to characterize that there are “many” people who “give knee jerk reactions”. Not sure how this is this a rude thing to say. Especially when you immediately go on to characterize “BW community members” in a similarly unfashionable light. There’s no need to get so defensive. Just discuss the facts of the matter, no need to cry name-calling or rudeness where it didn’t happen. --- ## Post 123 by @overdrawn98901 — 2024-10-25T15:32:57Z I’d argue this thread should be closed. No new discussion points are coming out of this thread, just seems to be bickering. I think it’s safe to say that Bitwarden remedied the immediate issue. Whether or not you wish to stick with them really seems to be a matter of personal opinions about FOSS. --- ## Post 124 by @starkle — 2024-10-25T15:35:10Z In my opinion Bitwarden has expressly decided to 1. Write a [non open source license](https://github.com/bitwarden/sdk-internal/blob/9c30b635ec86339233b0e9784875bc45e2aa1754/LICENSE_SDK.txt) (in the OSI sense) for their SDK 2. Make “open source” software that depends on this non-open SDK (see [F-droid conversation](https://gitlab.com/fdroid/rfp/-/issues/114#note_1995138172), and recently the desktop client) 3. Claim [they are aware](https://github.com/bitwarden/sdk/issues/898#issuecomment-2222992484) of this and that in their opinion, [they are two separate programs](https://github.com/bitwarden/clients/issues/11611#issuecomment-2424865225), so it’s ok. 4. After the backlash, [relicense parts of the SDK](https://github.com/bitwarden/sdk-internal/commit/db648d7ea85878e9cce03283694d01d878481f6b) to allow some apps to be purely GPL / open source. From this I think it’s reasonable to lose trust in Bitwarden and their relationship with open source. I think it’s also reasonable to be satisfied with their corrective steps and remain a customer / user while observing how they act moving forward. --- ## Post 125 by @overdrawn98901 — 2024-10-25T15:36:57Z None of this currently comprises the security of the software, in my opinion, at this time. So users can still safely use Bitwarden. It’s not proprietary, and currently not limited source available (for the most part) - and it seems their current communication says they will try to maintain a GPL compatible build always and will fix it if the build fails. But if strict FOSS matters and you are feeling nervous as a Bitwarden user, others have mentioned some FOSS community driven alternatives like KeePass which might be good to look into. --- ## Post 126 by @Pragmatic — 2024-10-25T15:39:45Z Yes, except that you are making assumptions, officially it is a bug and a misinterpretation of the community, there is no loss of confidence to have, nothing changes, they have clarified very quickly the situation, without tongue in cheek. --- ## Post 127 by @Gnarleyeh — 2024-10-25T15:48:21Z This a helpful narrative here … Perhaps it is wishful thinking that the whole Open Source model can sustain itself and progress as is pointed out here … --- ## Post 128 by @FlipSid — 2024-10-25T15:54:38Z Agree. I was just thinking the same thing, just stick with Bitwarden or choose something different. Yes, life can be that simple, in a broader perspective. I mean its not like there is one Password manager, one woman, one job etc :wink: --- ## Post 129 by @redoomed1 — 2024-10-26T11:51:42Z A post was split to a new topic: [Password manager (aside from Bitwarden) compatible with SimpleLogin API?](/t/password-manager-aside-from-bitwarden-compatible-with-simplelogin-api/21837) --- ## Post 130 by @heruslak — 2024-10-26T20:43:05Z sorry, may i ask what do you mean “sharing passwords”? im trying to understand this vulnerability and how it may affect proton drive and pass --- ## Post 131 by @Astatine — 2024-10-26T21:11:25Z > [@bigdzi](#): > > @Lukas not this time… my solution is to … go with KeePass(X). Excellent product. KeepassX has been [unmaintained](https://www.keepassx.org/index.html%3Fp=636.html) for nearly three years, so you should move to [KeepassXC](https://keepassxc.org) if you’re considering proceeding with that route. --- ## Post 132 by @Dkama — 2024-10-27T01:04:24Z > [@anonfox](#): > > E2EE doesn’t rely on server security. It’s about client side encryption. Even if the server is malicious, proper E2EE won’t be affected Except it’s not E2EE anymore if you’re sharing, genius. If you have a file on Proton Drive, Tresorit, Mega, etc, and you create a sharing link without password, you’re basically sending the decrypted file to server. Forget E2E, it’s not even E anymore. > [@heruslak](#): > > sorry, may i ask what do you mean “sharing passwords”? > im trying to understand this vulnerability and how it may affect proton drive and pass Well, password managers often allow you to share passwords, or even whole vaults, with family members. So you and your wife/husband/kids/etc don’t have to create multiple Netflix entries, one in each person’s password manager. If you’re sharing a file with a password (from a file hosting cloud such as Proton Drive, Tresorit, Mega, etc) it may just reencrypt using a new private key, so I guess you can still keep it E2EE. If you’re sharing between accounts, as password managers do, you need a way to communicate keys between accounts, which seemingly involves some server mediation (see the link I posted, that’s exactly the issue they found with Tresorit). That’s why having an open-source app only doesn’t suffice for when there’s sharing involved, ideally you’ll want the server code to be open source as well. --- ## Post 133 by @heruslak — 2024-10-27T01:27:51Z > [@Dkama](#): > > Well, password managers often allow you to share passwords, or even whole vaults, with family members. So you and your wife/husband/kids/etc don’t have to create multiple Netflix entries, one in each person’s password manager. > > If you’re sharing a file with a password (from a file hosting cloud such as Proton Drive, Tresorit, Mega, etc) it may just reencrypt using a new private key, so I guess you can still keep it E2EE. > > If you’re sharing between accounts, as password managers do, you need a way to communicate keys between accounts, which seemingly involves some server mediation (see the link I posted, that’s exactly the issue they found with Tresorit). That’s why having an open-source app only doesn’t suffice for when there’s sharing involved, ideally you’ll want the server code to be open source as well. ah i see what you mean. well from protons website: If you’re the vault administrator, you can share your vault key and Proton Pass will encrypt it with your recipient’s address key, ensuring only they can access it. After your intended recipient receives your encrypted vault key, they will validate its signature using your address key. This step verifies that the invitation legitimately came from you. Once the signature has been validated, Proton Pass will encrypt the vault key using your recipient’s user key and store it securely. however i do understand what you mean, there is no way to actually verify its doing what it says cause backend is not open source --- ## Post 134 by @Dkama — 2024-10-27T01:39:11Z That’s interesting. It might be actually possible to be all done in the clients by that description. It would be cool if someone could go through the code and pay special attention to that part --- ## Post 135 by @Catalyst2422 — 2024-10-27T10:54:38Z > [@Dkama](#): > > Except it’s not E2EE anymore if you’re sharing, genius. > > If you have a file on Proton Drive, Tresorit, Mega, etc, and you create a sharing link without password, you’re basically sending the decrypted file to server. Forget E2E, it’s not even E anymore. I’m pretty sure that’s not how it works. The file is still encrypted on the server. But the sharing link you create contains a key to decrypt the file. As long as you share the link in a secure manner then nothing is exposed. --- ## Post 136 by @anonfox — 2024-10-27T11:30:56Z > **[How you can securely share passwords using Proton Pass | Proton](https://proton.me/blog/password-sharing)** > > Safely share passwords, login details, and secure notes with end-to-end encryption using Proton Pass. --- ## Post 137 by @bee — 2024-10-27T17:52:06Z > [@Dkama](#): > > It would be cool if someone could go through the code and pay special attention to that part I believe that’s what security audits are for, which proton pass has had :slight_smile: --- ## Post 138 by @Dkama — 2024-10-27T21:23:31Z Tell PG to drop all their “open source” requirement for recommendations, then, since audits are all we need. --- ## Post 140 by @overdrawn98901 — 2025-02-13T00:22:29Z To be candid, this comment is off topic, and I’d argue this topic should be closed. If you have a support question for Bitwarden, it’s likely better to direct it to them. The behavior you are seeing is entirely expected, as to prevent “shoulder surfing”, or people seeing your passwords while they are looking at your screen. You should click the “copy” button, don’t copy/paste the stars. Or for a better UX, consider looking up the hot keys for auto filling on web pages if you use the extension. --- ## Post 141 by @redoomed1 — 2025-10-24T02:37:23Z 4 posts were merged into an existing topic: [Unhappy with Bitwarden: Should I switch to another password manager, and which option is viable?](/t/unhappy-with-bitwarden-should-i-switch-to-another-password-manager-and-which-option-is-viable/26400/19)