undefined | Better HN

0 pointsdrdaeman8y ago0 comments

The linked article is very light on details to be called a comparison.

Let me try to make it a little bit more detailed.

====================

Bitwarden:

- Is essentially a service (with FLOSS client software and FLOSS server code).

- Quite polished browser integration (to the extent browsers allow it).

- Third party server holding the encrypted data. Proprietary (in a "completely unique, not compatible with anything else" sense) sync protocol.

- Symmetric encryption key is encrypted with master key but it is NOT changed (with re-encrypting all the entries) when master password is changed. I'm not sure if there is an option to re-encrypt the data in case the symmetric key is compromised, although this should be doable via APIs.

- Data is encrypted and signed, but some of the data structure (folder layout, TOTP existence, revision dates) is (theoretically) accessible to the service owners. Check out snippets at https://github.com/jcs/bitwarden-ruby/blob/master/API.md for info.

- Has some nice extras built-in, like domain equivalence logic.

- Self-hosted option is available (official Docker images using .NET Core and Microsoft SQL Server and unofficial third-party implementation in Ruby). I'm not sure how this works with licensing.

====================

Keepass:

- Is primarily a standalone application. Or, better say, applications, as there are multiple independent implementations for many platforms.

- Has browser integration, but all options (KeepassXC-Browser and PassIFox) are feel somewhat less polished.

- Has composite credentials (in addition or instead of master password it can use i.e. keyfiles). Supported mechanisms vary with implementation.

- If the encryption keys are compromised you can trivially re-encrypt the database to avoid further leaks.

- File format is essentially a large encrypted and signed XML file (data block) with some extensible header that defines the crypto details. https://keepass.info/help/kb/kdbx_4.html

- You handle the sync however you want it. For KeepassXC you need make database available in a filesystem. For Keepass and Android app there are also SFTP, WebDAV, Dropbox, Google Drive and some other options available. The only sync that's in the app is a logic for merging databases.

====================

Please correct me if I got something wrong. Thanks.

0 comments

4 comments · 1 top-level

zie8y ago· 3 in thread

I don't see anything wrong, but will add:

Bitwarden has a desktop app(electron .. sigh but is cross-platform) and has integrations with all the major browsers (Safari, Firefox, Chrome, IE)

Bitwarden also has Mobile support (iOS, Android & UWP).

KeepassXC only does Chrome(and family) and Firefox I believe.

Running your own bitwarden server is not difficult, and there are 3 implementations that I know about:

    The original .NET: https://github.com/bitwarden/core
    The Ruby one: https://github.com/jcs/bitwarden-ruby/
    The Go one: https://github.com/VictorNine/bitwarden-go

varjolintu8y ago

FYI: the new browser extension KeePassXC-Browser relies on native messaging which is not supported by Safari. IE/Edge support could be done in the future.

zaarn8y ago

KeepassXC supports KDBX4 so any client that can read KDBX4 can be used alongside it. KeepassXC is also definitely a desktop app, it can do autotyping and similar things.

There is Android and iOS support via keepass2android and <insert ios app name here>.

You can safely put your KDBX file on dropbox/gdrive/nextcloud/ipfs.

zie8y ago

Yes, I wasn't trying to say KeepassXC can't in some way also do most of these things. But the experience is very different.

Bitwarden is basically identical across all the platforms. KeepassXC is not, since it's totally different apps for mobile, etc.

j / k navigate · click thread line to collapse