All these people keep saying that Vaultwarden won't work because it relies on bitwarden's API but if there is an incompatibility then wouldn't vaultwarden just be left in a functional limbo? Like it'll still work because self hosted but no more new features in parity with official client? Or have I misunderstood the connection between the two

That's why I'm just using KeePass. It's just an encrypted file that you can store on whatever storage you want and sync with existing solutions like Syncthing etc.

Yes it's a bit finicky when you edit the file on multiple devices before they've synced but it works very well for me..

You can use KeePass on mobile, look for KeePassDX on fdroid.

Having only ever used keepass, what was the advantage of bitwarden? That you didn't need to sync it yourself?

Both backend and frontend revolve around the API, and Bitwarden owns that not Vaultwarden.

If Bitwarden decides to modify the API so that only their closed-source backend has the full spec, and only gives that spec to their own apps, everything else (Vaultwarden and 3rd-party apps) will fall behind or become unusable.

To counter that, Vaultwarden and the 3rd-party apps need to declare their own API and prepare to fly solo completely independently from Bitwarden.

Such a move would force Bitwarden to show their true colors. If they really mean to stay true to the open version they will keep cooperating and keeping their API in sync with the Vaultwarden API.

It's because being abusive was able to bypass some of their guardrails.

The api is implemented in Foss front&back end.... I don't know what you are talking about

Fine to me as long as this doesnt impact Vaultwarden

That's the main benefit yeah.

I use the send tool as well for sensitive files

That you didn't need to sync it yourself?

and that you have to never deal with sync conflicts. It's a huge deal for those who are using tech but not understanding it, and a convenience for the rest

this year there were 2 separate updates to bitwarden clients that fucked up vaultwarden servers, because the bitwarden developers "accidentally" reused a variable name in the data that was unused for a few years. but vaultwarden forgot to remove it, and now it is used in a different way, and the clients bugged away so hard that you had to uninstall them, because even if you was fortunate to be able to get to your passwords list you could not get it to sync otherwise

If there are two version of Bitwarden backend (closed and FOSS), and the closed one changes its API, and the closed Bitwarden apps also switch to the closed API, then what value does the FOSS API have anymore?

What is "the API"?

The API is implemented by the bitwarden back end.

The API is also implemented by the vaultwarden back end.

The open source bitwarden client does talk the current version of this API. The open source client can be forked, so there is without much effort a version speaking this protocol in this version and is FOSS. Just the name will be different. I guess "vaultwarden client" would be fitting, but what ever.

It's also way easier to have shared passwords for family accounts.

What is "the API"?

Good question. When you have multiple implementations of an API, the API (the authoritative version) is what gives the reference spec that all other apps must follow.

If the authoritative version will be fully implemented only by the closed backend and in the closed apps, it will cripple the FOSS backend and apps.

This is a common tactic used by companies that want to sideline the FOSS options and slowly make them irrelevant.

Yes, today all apps talk to both Bitwarden and Vaultwarden the same way. Be on the lookout in case that changes.

I'd totally see the risk if the clients were not available as open source. But they are. So I'm not.

They might diverge, but vaultwarden users will just fork. Nobody who is using official clients with vaulwarden will be "oh dang, now I have to buy bitwarden, so long vaulwarden, was fun...."

It currently doesn't work with Vaultwarden. The Linux client doesn't accept custom certificates. And the Android client is paid. It is a dead-end for self-hosting.

The license is also stupidly a single sentence. Which means that use could be nuked at any minute, and any money you use to pay the developer means nothing. If they wanted to kill the project today and nuke the repo, you have no legal rights, the project dies and fuck you and your passwords. That doesn't exactly inspires confidence.

Side note: I just tried switching to KeePassXC and it seems pretty fine, except for one caveat. If you installed your browser (probs FF or Librewolf) through flatpak or snap on Linux, the browser extension will not work.

I had to change to the non-Flatpak ver of Librewolf on my Fedora PC, which sucked a little lol 😅

wow, setting up vaultwarden quadlet to work with my selfhosted OIDC sso was stupid easy. Migrating my bitwarden setup to it took no time at all. The extra step was setting up some extra pocketid passkeys to be stored on non-vaultwarden hosted systems (ie. google) to prevent myself from being locked out in case vaultwarden crashes (which probably was a good idea to do regardless). Just need to add the data volume to my regular backup.

I pay for their product and its totally worth. It was $10 for the longest time and much like everything in the last few years has increased price to what it is actually worth. To be honest $20 a year is still stupid cheap and worth it to keep them developing the product. Bitwarden is also one of the few password managers that hasn't had a user data breach.

Roger that. Thank you for the clarification that you meant the actual term, and not just the fact of no mandatory payment and it having an the source available for public.

I get what you mean, yet frankly, I do not believe such projects may be always free that are supposed to always be up-to-date for another system they have no official relation to, and keep it as a responsible hobby other people depend on.

I really hope they don't go that route.

A different licence for the commercial version isn't a bad thing in se, in my opinion

Have you tried fixing it using flatseal and manually changing the config folder location for the browser in keepassxc? Librewolf too, even as native package, requires that location edit

Thank you for pointing this out- I'd managed to completely miss that it seems. That's unfortunate

Thank you for pointing out that the license is not FOSS, I hadn't noticed that. I suppose I'll be exploring my options again.

I'd been using the Android client from f-droid and hadn't needed to pay for it, which was working with my VW server. On my desktop/laptop I use rbw, so I hadn't noticed the cert issues with the kekeyguard desktop client.

There isn’t anything wrong with passkeys that can’t also be made wrong with passwords, and there isn’t anything more secure about passwords, at all.

Please don’t tell me you took that article that was spammed all over here a few days ago at face value…

I see.. Thank You!

It's syncing it to my work laptop that would be the issue.

Ah of course, perhaps i'll give that a go and see how it goes.

I just keep my KeePass file in a Nextcloud and occasionally synchronise manually via WebDAV.