Android

Bitwarden is reasonably consistent, but you have to have recently logged into it. Before I open an app that needs auth, I open bw and unlock my vault. Most applications popup login with bitwarden and it can handle 3 stage logins usually even when the ask for 2fa before password.

Bitwarden(Vaultwarden for me) works fine for me. It does have few hiccups here and there but 90% it works flawlessly.

My only complaint is the passkey support for Firefox variant(Fennec in my case). Kinda weird design choice to have select browsers as trusted and make no other browsers work.

It’s better on android than Apple. The biggest problem on Android seems to be sites not following standards in identifying their fields which breaks autofill.

On iPhone this same problem exists, but you also have to deal with iCloud sporadically taking over and messing up the workflow, adding fun new ways for it to fail.

Apple does better than the Android experience described in the article, but it also isn't perfect. There are apps that don't recognize that you need a password and are difficult to trigger the autofill (especially with a third party manager), and on very rare occasion it fails in the browser, too. It handles multi-page passwords just fine though.

Not trying to measure dicks or whatever, just giving a point of comparison. Without investigating, I wonder if some sites/apps don't correctly indicate to the browser/OS that they're passwords and what they're for. I haven't had real issues on my Android reader with proton pass, though that isn't a huge set of apps I use.

I have no specific basis to say so, but I distrust browser-based password managers on the principles of separation of function and mitigating risk. Strong my credentials in a browser just feels hinky, even with a master password. Too obvious of an attack vector. Rather, I use the KeepassDX variant with its MagicKeyboard feature. When I'm presented with a login prompt, I can use the keyboard switcher to launch KeepassDX, unlock my vault, and select the credentials entry. Then I can switch back to the browser (or app) and have MagicKeyboard enter the credentials for me.

It's a few more taps than just that, but it's a straightforward workflow that should mitigate leakage from my usual keyboard, clipboard snooping, and any hypothetical attacks against the in-browser vault workflow.

Plus, I know where my credentials are stored, can apply 2FA, and even back up the vault file to offline archives.

It works for me. "Cool story bro," I guess, is my point.

Yeah, I agree using Bitwarden in Android can be a mess, but I find it works pretty well with Firefox, now that I mention it, why do people get the Bitwarden extension if the app already works well?

I have access to an iOS device (girlfriend's) and I see it works well and I have never heard her complaining...

That's quite unfortunate to hear. I use Bitwarden along with Gboard and very rarely run into issues - I believe most password managers have a quick settings toggle that you can add into your notification drawer to maybe get around this? From what I know though, these generally use the Accessibility framework to function, and thus will heavily depend on your password manager - it also gives a lot more access to those apps than the built in autofill framework.

Conversely I remember Bitwarden's autofill support on iOS being quirky when I last used it (which to be fair, has been a while - I'm sure its improved since then). IIRC it pretty much always worked in Safari (and Safari Web Views within apps), but the actual applications themselves wouldn't always give me the autofill prompt.

For me though, regardless of the platform it still is far more worth using a password manager and unique passwords per-site than to use a single password (or even a handful) across sites. I hope autofill support improves for those that it doesn't work well with.

Autofill is total shit I agree, but I've been copying and pasting from my password manager for over a decade and it's been fine. I get that autofill would be much less friction, but I really don't mind copying and pasting.

My experience has gotten much better in the last several years. Now across apps, Firefox and whatever it's more often than not it autofills or brings up bitwwrden just fine. It's becoming the minority now when I encounter issues

Why Google allows apps to block a system service from inputting information is beyond my understanding, but it’s absolutely infuriating, and just discourages the use of these tools.

This is the really annoying bit

I've recently switched from Firefox' vault to bitwarden.

I'd say it works 50% of the time. On desktop Firefox it just doesn't manage to autofill things some days and I end up copy-pasting my credentials.

On mobile is happy to present me with suggested logins for a page. If I have one, pick or generate one, then it's all dandy. If I decide I'd rather not, then there's no way out of that view. I end up force-killing Firefox mobile. Maybe the app works better than the browser extension.

FWIW some of the problems are on website/app developers. Not sure on specifics on the app side, but with websites if the dev doesn't use semantic html input elements with the correct type attribute to denote the password form, autofill won't work (since neither android or the password manager know its time to do stuff)

Nothing wrong with username/password on different screens (one at a time is good for several accessibility-minded reasons) but again, there are some best practices to follow which allow screen readers and password managers to still act as you would expect.

I'd assume android app dev is similar.

That said... I do think it's gotten a bit clunkier at times in ways I dont recall being problematic in the past. I use 1password and heliboard or floris board and while those keyboards seem to bug out a bit, sometimes the bigger problem seems to be that android isn't always telling 1password enough info to find the right account. Idk how apps "inform" the password manager (maybe via url's in a metadata file or maybe passwors managers have ro keep theor own internal db?), but apps that use web wrappers (specifically the old and/or shitty ones) report their url as http://localhost since the wrapper just renders a local page in a web view. that'll wreck a password managers day real quick.

Idk if Android is worse than iOS here, not that it is a reason for google to punt on improving it. iOS has its own autofill quirks thay can be just as annoying. Esp constantly asking if you want to use your app or apple keychain without a way to just pick a default...

Proton Pass uses the keyboard to identify and fill passwords. It works really well.

my issue with androids password manager feature is the main site I use it on is Firefox, but Firefoxes autofill for password manager is in a constant fight with keepass on who shows, and there's no menu to tell it which one I want to use so I have to leave the field join the field till it shows or manually copy from the manager. It's so obnoxious