Hacker News

Great find. This blog post - and specifically the background of the new management team - convinced me to start looking for a Bitwarden alternative. I’m watching the same “boil the frog” strategy unfold at Namecheap, and erode much of the brand trust they had built up over a decade, and it’s a shame.

Excellent now I have to find something else again. You can’t fucking trust anyone not to chase money these days.

Fuck bitwardens creators for selling out. I want them to know they fucking suck.

This post is what triggered me to cancel my subscription and migrate away from Bitwarden in July. I’ve seen too many repeats of this show. This has completely soured me from cloud-backed critical software. Slowly moving toward offline alternatives wherever possible and self-hosting when it isn’t.

Thank you for linking this, the price increase was indeed communicated to me directly via email but not very clearly

> The price is updating to $1.65/month, billed annually.

Followed by a 25% discount for this reveal only.

Have to go back to my old invoice to see it was $10/y and now the new one $19.80/y

I never liked that I needed to pay premium just for 2FA but this abuse of trust is definitely the end of it.

Too bad I won't get a refund for my Oct 1st renewal but I'll happily cancel as soon as I get vaultwarden hosted.

Ok this is doing some damage. What's a possible alternative that works on both mobile and desktop, doesn't require yourself to run a server, and doesn't have worse reputation?

Is there any writing on it that was written by a human? This blog post is clearly AI.

It's somewhat concerning to me that none of the security conscious people in this thread seem to notice that they are changing their privacy practices based on the advice of a language model pretending to be a person.

I hate this. So much software I love keeps doing this. redis, docker, now bitwarden. I was so happy with bitwarden. Been a premium subscriber for many years. I have helped convert many people, including whole companies, to use this. Now they are doing us such a disservice. We need a completely free, no-nonsence, alternative. I wonder if it is possible to do a ipfs/torrent version without a central authority to permanently prevent this type of issue.

I feel like this blog post deserves its own submission to HN

Started humany but degraded into LLM speak towards the end. Especial the Vaultwarden section.

Unfortunately, any "insight" it might contain is ruined by the fact it's clearly written by an LLM instead of a person.

> And it never comes in a single dramatic announcement. It comes in layers. A feature post with a price change inside it. A LinkedIn update nobody made a press release about. A values page that says something slightly different than it did last week. If you’re still on Bitwarden cloud and this is giving you pause — it should. [...] Whether self-hosting stays viable long-term is the real question worth sitting with.

I was at redis when they changed the license (the first time). I begged the new leadership to not change the core license but to do a few things instead.

1) bundle the "source available" modules as part of redis source distribution 2) enable people who only want bsd code to be able to build a "redis_core" 3) commit to the community that the core will remain BSD licensed and that they are committed to making it the best key/value store. 4) increase the amount of source available code that until then had been kept closed (including what we called big redis/RedisOnFlash/MultiTier) 5) Require anyone using the redis trademarks in a commercial setting to ship the entire Redis (which includes the source available portions, so Amazon et al would no longer be able to use the Redis trademarks without a license deal.

Another alternative was to simply go to AGPL (which they went to anyways awhile later).

I failed to convince the leadership about this. I honestly think they squandered huge value in community engagement, but perhaps that's what they wanted. I left a bit after these changes were made as it became clear that the new US led leadership of the company wasn't particularity interested in what was the soul of redis. (previously was heavily Israeli led and a critical mass there was invested in redis as an open source product).

Funny story, the then new/current CEO used to be the head of WebEx at Cisco. We had a Q&A when he was hired and I asked, what did he learn from his time at WebEx about how to maintain market position (as they lost everything to zoom et al). His response at the time wasn't that convincing, but I was willing to give him the benefit of the doubt. I feel its fair to ask if the same thing occurred again.

I’m conflicted. On one hand I’m grateful for the years of trustworthy (and pay-what-you-want) password management. On the other this feels like an attempt to EEE the free version.

I would be with you if they didn't change the owner to private equity in the last year.

The thing I always think about is that they wouldn't have to change the license and tighten the screws if people paid for it. Getting mad that the free hosted password manager has changed the deal a little bit I find to be quite arrogant.

Pay the $20/yr or whatever to have them host it and the whole world keeps turning.

Sorry but the elasticsearch thing was a big stupid take of elastic. It was big corpo against big corpo not the poor elastic company.

Changing licenses is a sick move and companies doing that should be fucked over, because the license made them big. Changing it later on means that they got greedy nothing more nothing less.

Without oss bitwarden would be a paid cloud like all the others that probably would’ve had a hard time getting trusted.

That's not what's happening here. They're making their app closed source with closed source features. Time to find a new provider.

Any more details on this? Like did anyone build a better extension or are you just guessing?

How could you trust a third party (or even you own promoted AI) on this?

It would be nice if the forked client apps & extensions also avoided BC breaks, unline the mainline clients

While keeping feature-parity, right...?

OK, don't leave us hanging like this.

What about it isn't well engineered?

Isn't Vaultwarden using the same clients?

Correct.

Circa earlier this year I found this blog post, and have – as a paying customer nonetheless, mind you – continued to expect a 180-degree turn (which to be clear, this not yet is) ever since:

https://blog.ppb1701.com/the-quiet-renovation-at-bitwarden

Something like TailScale, HeadScale, or NetBird makes it dead simple to securely access and sync

Isn’t the server end of VW zero knowledge?

I’m the same. It’s a paltry price for an outstanding product with great features that improves my life/security greatly

i dont know how many years ive been a subscriber -- the oldest email ive got from them is switching my email 8 years ago, and i know for certain i used it on another email before that... but emails on that previous domain were never long lived, so theyre gone.

anyway, the bigger issue ive with this is the doubling of the price right from the get-go.

with private equity on the steering wheel, i suspect this will keep going up every year from now on, so ... while i too have been a loyal customer to date, i suspect ill be driven out within the next 1-2 years, because if they double the price again next year, its gonna be way beyond the value i get out of it given how decent the alternative have become since.

The latest macOS/native UI refresh is horrible though. It really hasn't improved in terms of speed either after regressing during the UI refresh before the latest.

I think they do that on Android but also have the accessibility based option.

Just to clarify, you mean something like it is done in iOs?

Bitwarden is still releasing free builds but yeah you'd need a new project with a new name to use it from the Play Store or App Store.

Turns out Keyguard, an alternative Bitwarden client is already on the Play Store.

https://github.com/AChep/keyguard-app

Edit: turns out Keyguard is source available but fully copyrighted.

The question is, what structure can protect this in an ongoing way? Say you setup a non-profit foundation, even those seemingly can be perverted to become for-profit businesses with corporate shenanigans (see OpenAI), so if you wanted to somehow "guarantee this group always release things this way", is there any legal structure that can enforce this somehow, "forever"?

KeepAssXC + SyncThing works well if you don't mind tinkering and like independence from corporations

Otherwise 1Password if you like paying money

I have been eyeballing PassPony[0] as a replacement.

The fact that they still do not support Yubikeys is holding me back from switching, but I expect this to be ironed out soon.

[0]: https://passpony.app/

Any suggestions or ideas for where to?

They want money

if you like maintaining servers that are exposed to the web in the age of AI rogue agents

It's how a lot of open-core products work. Basically, when you hold the copyright, you can apply whatever license you wish when distributing the software at any time. People can use existing copies of the code under their old licenses, but they must follow the new terms if they acquire the code through the new channels.

To get any PR merged in Bitwarden, you are forced to sign a CLA that reassigns copyright to Bitwarden Inc so they can relicense as they wish.

> How on earth does that work? Is that something the GPL license even allows?

GPL doesn't apply in this case, since the copy that you are acquiring is entirely under the commercial license.

that's what it always seems like. buy a viable company, load it up with debt until it bankrupts, take your fees, declare bankruptcy.

For most software, sure, but I wouldn't really trust a vibe-coded password manager.

Which LastPass crap?

Them not understanding how PBKDF2 works?

Them leaking all the encrypted user vaults?

Then raising prices and being impossible to work with as corporate customers?

Straight up fuck LastPass.

Thunderbird is a rare counter-example of an open source project that manages to maintain a significant staff through donations. Although affiliated with Mozilla, they are not funded by Mozilla. (I am no longer affiliated with Thunderbird, but I managed the project in the dark years after Mozilla suddenly dropped all funding and tried to get us to leave Mozilla.)

> But let's be honest. "enshittification" here really means "I don't want to pay for my tools and I want it completely for free forever."

That is completely the opposite of what is happening here. Lots of us pay premium Bitwarden subscriptions and are not happy with the way the company is headed, especially for a security company that holds the keys to many of our kingdoms.

"enshittification" here means a company that we trusted is now started to make decisions which erode that trust. Its happened before and it will happen from here unto eternity.

> Only a matter of time until we see "OpenWarden", just like we saw the migration from Redis to Valkey.

Vaultwarden already exists

I "new Firefox design" is hardly "single UI change"

If it was only one change I doubt there'd be much pushback

The new owners are just seeing how gradually they can boil the frog before the userbase moves elsewhere. Gotta maximize returns.