@inlandempire@jlai.lu , I said I’d write about bitwarden and here I am. Trollaccount69: promises made, promises kept.

Bitwarden is good. People saying it’s bad are either mistaken from not reading news reports closely enough, completely unwilling to accept a company as opposed to a small open source project or don’t consider cloud services worthwhile when they could be self hosted.

I’ll start with the last one first.

I self host a lot of stuff. Many people have a little computer in the closet, some have mini racks, a few have full size frac racks. I have two full size racks in different physical locations separated by miles. The point of saying that is not to brag or flaunt undiagnosed mental illness but to make it 100% clear that I am not opposed to self hosting by any measure.

A few years ago I was in a natural disaster. It wasn’t predictable or common and while some of the conditions that precipitated it had a generous parry window the effects were outsized and still linger to this day.

My local server was rendered inoperable and my offsite was damaged beyond recovery. Conditions in the area prevented consistent access to the internet so my cloud backup was not an option. Afterwards I did not have power or Internet at either my home or offsite location for two weeks. Even in the case that I did, my focus was on keeping my family warm, fed and housed.

The experience immediately afterwards had a lot of what might get called second factors or one time tokens or just shit you gotta write down and every group involved wanted to mediate the process through their website or some other computer system not least of which is the us federal governments now monolothic login.gov (what a fucking name).

Maybe you see where I’m going with this.

If it weren’t for bitwardens ability to access secrets securely through a web browser on an untrusted computer I would have had a much different experience toting handwritten copies of important logins, passwords, tokens, codes and even just notes to remember in sweat soaked waterlogged pockets.

Bitwarden isn’t the only cloud password thingy that has that functionality but it’s the one with the longest history of dudes popping up to “well actually” out the way their website access works when someone says “browser? That’s not secure!”. So I’m not gonna waste your time with that. It is secure and you can do your own research and come to that conclusion yourself.

The point of writing all that is you probably would be what a disgusting race of people with bad teeth from an overcast island in the North Atlantic would describe as “proper fucked” in their nasty, brutish imitation of the English language if you couldn’t get to your selfhosted passwords. Imagine if that coincided with a bonafide cortisol experience.

Cloud services can be described as a lot of things. A safety net against local disruptions is part of that.

Alright working backwards from that mess, it’s fine to be skeptical of companies but they do represent stores of expertise and often act as the benevolent supporters of open source projects either through a direct relationship like Bitwarden, keeping the maintainers of an open source project employed so they can continue working on the project (often as part of their job responsibilities) like Bitwarden or even just using the profits to prop up the free side uh, like Bitwarden.

Off the dome, and I will not be looking this shit up, the first thing comes from people seeing some small indicator and freaking the fuck out. Recently it’s a change to an acronym that describes the companies values. Literally come on. Red hat is basically the IG Farben of open source but no one is fleeing the Linux kernel because of their involvement. Another recent freak out came from a new ceo who took on venture capital. The company intends to broaden its user base and provide its service as a trusted third party in an increasingly fractured world, that takes capital and the part no one seems to be willing to hand to ceos, leadership. There have not been tangible changes to bitwardens free service as a result of these events.

My favorite Bitwarden freak out is the tos data collection one. Someone posted the terms of service and highlighted that user data could be collected and used. Now that’s something! Wait, it was the terms of service of the website, not the service (an important legal shield in some jurisdictions) and was just boilerplate. There was no evidence ever provided that Bitwarden collected user data in any way other than that which is part of rendering a web page (how big is the viewport, what protocols do you support etc.).

If you take anything away from this, hell, if you even read down to the bottom and see this sentence: don’t discount cloud password vaults, you may end up relying on them during a trying time.