I'm not familiar with Bitwarden. After a bit of Wikipedia and web search research on them, I'm not sure why I'd trust 8Bit Solutions over Google for storage of my PII. Do they have the resources to keep it secure? What is their incentive structure to do so? What happens if they get bought? Should I be concerned about past errors such as "In March 2018, Bitwarden's web vault was criticized for embedding unconstrained third-party JavaScript from BootstrapCDN, Braintree, Google, and Stripe"?
It sounds like it'd add an additional layer of complexity to my situation without an obvious up-side over my existing solution.
um, no? See the famous story of Hushmail [0], which used end-to-end encryption and claimed to have no access to user email until receiving a court order. Then they modified the code they send to one client to exfiltrate encryption keys to law enforcement, and decoded all the "end to end encrypted" email.
Sure, they claim they are open source and that the infrastructure was audited, but this does not prevent them from just configuring their auto-update server to serve a very special update to user at a specific IP.
> Then they modified the code they send to one client to exfiltrate encryption keys to law enforcement, and decoded all the "end to end encrypted" email
This is false. The decryption code was run on the server, which means the password was sent to the server briefly. Hushmail simply stored the password for a few accounts. No client code was modified nor any auto-update changed. In fact, if the criminals had used the Java applet, they'd likely have gotten away with it (assuming they didn't update it)
>However, installing Java and loading and running the Java applet can be annoying. So in 2006, Hushmail began offering a service more akin to traditional web mail. Users connect to the service via a SSL (https://) connection and Hushmail runs the Encryption Engine on their side. Users then tell the server-side engine what the right passphrase is and all the messages in the account can then be read as they would in any other web-based email account.
>The rub of that option is that Hushmail has -- even if only for a brief moment -- a copy of your passphrase. As they disclose in the technical comparison of the two options, this means that an attacker with access to Hushmail's servers can get at the passphrase and thus all of the messages.
It was always like that. If your threat model is three letter agency/Mossad/etc than you have very limited options. Relevant XKCD: https://xkcd.com/538/
Fortunately, since I use Chrome, I was able to log in and get them clouded over. Whew!