$10/yr is not a big price for what you get. I don't think I even use the extra features you get with the subscription, but supporting the maintenance and development of a product I would like to use for years to come is important.
I switched to bitwarden when last pass announced they were changing there free model so you can only use your passwords on browser or mobile but not both. Liked bitwarden way better and immediately did the yearly sub to support them.
That's pretty good, I still wonder how long will it take for companies to actually implement them in practice though. Steam still uses its frustrating steamguard instead of just letting us use any generic 2FA provider like aegis for example, I doubt they'll implement this any time soon.
I am not that desperate to get it working there, it was just an example, but still good to know thanks! Hopefully they add proper psaswordless support eventually.
How is Bitwarden having all the actually needed things for free, still developing, be most open and community-friendly of cloud-synced managers, allow self-hosting everything for free and still cost just 10$/year for managed premium???
I bought premium just for the 2FA codes support and recently they announces btw it is free now. Like, buying premium for me now would be like donating, they give me anything I want anyway.
Their service is probably set up so the per-user overhead is low.
Think about it- what does your 'using it' actually consume? a few hundred KB of disk space and a little bandwidth?
I agree it's a great value though. Signed up a few weeks ago and haven't looked back.
I'd imagine their business and enterprise service is what currently or will pay the bills for them. Either way, I love their approach and the fact that it's open source.
I am still a little unclear on what this means. Isn't the idea of passkeys that they're stored on your PC's TPM? What does Bitwarden "supporting passkeys" mean in that case? Are they not stored on the device if you use Bitwarden?
You're thinking about "device-bound passkeys". Bitwarden and any other third-party credential manager leverages "synced passkeys" because they don't control the hardware.
Synced passkeys are actually called out in the FIDO Alliance's FAQs as preferred since they more closely align with the desired replacement of traditional passwords.
No, TPM isn't involved here. There's a few kinds of passkeys.
Hardware bound keys are locked up in a physical device like a TPM or a YubiKey. That physical device has its own security to unlock it- TPMs often work with fingerprints, or a YubiKey usually has a PIN (aka password).
A passkey can also be done in software, and that's what's happening here. BitWarden stores the encryption key within the BitWarden vault, so it can (eventually) be accessed by any device signed into your BitWarden account. Thus the same passkey works on your computer, laptop, phone, tablet, etc.
It's worth noting that Google and Apple both do it this way- the passkey is stored in their password manager, and you use Face ID or fingerprint ID to unlock that.
I like to think of it this way in my little bubble. :) I have a Yubkey 5 with NFC. I use passkeylogin into Authentik so all I have to do is plug in my key, unlock it with my master password for the key and touch the disk and I'm logged into my site. If I view the contents of my key with the ykman software, then I can see that I have two logins, one for mobile and one for my site. Each has is different so it knows which one is mobile and which is desktop.
The same principle may apply with the PC's TPM. Your credentials may apply the same way there. I'm not 100% familiar with the TPM process but think as long as it works with Fido2 , you should be fine.
How does this work when I want to log in from a device that doesn't have bitwarden, for example my android phone (for now at least) or my TV or otherwise? Can you manually type in a passkey?
My naive understanding would be: a passkey replaces a password for an individual login; a biometric authentication replaces a password for the vault that stores individual login passwords.
so basically: right now, I have a master password, and I can set up Bitwarden to bypass the master password with biometrics. With passkey set up, I will no longer have a master password, and biometric will be the only login method?
With Passkeys you are creating a encryption key pair for use for each service you want to log into as a kind of unquie virtual hardware key that gets stored in a cloud. Acess to that cloud is then contoled by an actual hardware key like the one built into your phone. That means rather than using a hardware key to unlock a vault of passwords which is what you're doing now, you're using it to unlock a vault of key pairs.
The main advantages of this is the services you log into only hold a public key, not a password, but doesn't have to interact with your hardware key just your passkey provider. Meaning if you need to change your hardware key you only have to change it in one place instead of across everything you login to. That being one of the biggest pain points for getting people using hardware keys even now their built into a lot of platforms.
The major issue with Passkeys so far has been that it's been pushed by 3 big single sign on providers, Apple, Google, and Microsoft. And there's been some worry about being forced to use big corpate closed source providers. But with now with Bitwarden introducing them it's a big step towards this becoming the future.