Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

novamostra.com

Post reply on HN
Print view View original

11–20 of 93 posts

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#11

Post by jeroenhd »

vxNsr wrote: post #4
bheadmaster wrote: post #3

Earlier quoted context omitted.

Why? Sincere question - AFAIK, Raspberry PI OS is a Linux distribution like any other, with dependency/distribution issues like any other. Why would using Docker on it be a sad state of affairs, in contrast to using it on any other distribution?

Not the OP but maybe bec this is a single use device… why not just install direct on the OS and back the whole thing up?

One reason is that software isn't always distributed in normal distro repositories anymore. People can't (or don't want to) deal with dependency management so they ship an entire (slightly outdated version of an) OS with their application to make deployment foolproof.

The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden. If you want to install native binaries, you're going to have to git fetch/checkout/pull the latest release tag and run `cargo build --features sqlite --release` yourself. Doable in a cronjob, but it'll probably take a compile to build a system like vaultwarden on a low-power ARM core.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#13

Post by xd1936 »

Keeping all of my passwords on a failure-prone SD card acting as a boot drive makes me nervous. I think I'd prefer a SyncThing-based solution for self-hosting a Bitwarden Vault or KeePass file... if I wasn't already a happy customer of Bitwarden's hosting solution.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#14

Post by jeroenhd »

atemerev wrote: post #2

On one hand, this is incredibly cool, and brings some great security. On the other hand, docker containers on a RPi Zero? What a sad state of affairs we have in 2022.

I much prefer normal systemd services to sandbox my applications but if the software you want to run isn't packaged in some normal, updateable way (like a standard repository) then Docker is definitely the way to go.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#15

Post by Bluecobra »

Seems pretty complicated to me. There’s lots of steps involved which increases the chance of something going wrong. For example, the self signed cert will eventually expire, how easy would it be to renew it? How do I keep this up to date?

It would just be a heck of a lot easier to just use KeePass and save the database on a SD card.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#16

Post by atemerev »

jeroenhd wrote: post #11
vxNsr wrote: post #4

Earlier quoted context omitted.

Not the OP but maybe bec this is a single use device… why not just install direct on the OS and back the whole thing up?

One reason is that software isn't always distributed in normal distro repositories anymore. People can't (or don't want to) deal with dependency management so they ship an entire (slightly outdated version of an) OS with their application to make deployment foolproof. The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden . If you want to install native binaries, y…

Yes, Docker is a black box. You don't know anything, you just launch something without understanding what components it consists of, what are they doing individually, what is their attack surface.

Not to mention that it encourages sloppiness and software bloat. The password manager could be put on a simple MCU device, instead, we have a large non-transparent multi-component installation swept under the rug with Docker. I do not think this is a good thing.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#17

Post by evernite »

Yeah, it seems to me that if you use a standalone Pi for your self hosted password manager, then why not just run everything as systemd services. I did something similar on a Pi 3 for the CCC congress event last year using NixOS and it's been running ever since.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#18

Post by cstuder »

I have a general question regarding the BitWarden server: How would you rate the security between using the official BitWarden server and self-hosting Vaultwarden?

I am sympathetic (and capable) of self-hosting, but if my instance and my passwords are compromised, the fallout could be catastrophic for me. Am I better of in the long term by just using the BitWarden server and assuming that they have better security than I do, even though they are the even jucier target?

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#19

Post by atemerev »

bheadmaster wrote: post #3
atemerev wrote: post #2

On one hand, this is incredibly cool, and brings some great security. On the other hand, docker containers on a RPi Zero? What a sad state of affairs we have in 2022.

Why? Sincere question - AFAIK, Raspberry PI OS is a Linux distribution like any other, with dependency/distribution issues like any other. Why would using Docker on it be a sad state of affairs, in contrast to using it on any other distribution?

Because a password manager is a tiny piece of software. Instead, it is now a multi-component black box installation with a general purpose operating system running on a full-scale Linux machine with a containerization platform designed for datacenters.

I am not a fan of this kind of redundancy and opaqueness.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#20

Post by jeroenhd »

atemerev wrote: post #16
jeroenhd wrote: post #11

Earlier quoted context omitted.

One reason is that software isn't always distributed in normal distro repositories anymore. People can't (or don't want to) deal with dependency management so they ship an entire (slightly outdated version of an) OS with their application to make deployment foolproof. The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden . If you want to install native binaries, y…

Yes, Docker is a black box. You don't know anything, you just launch something without understanding what components it consists of, what are they doing individually, what is their attack surface. Not to mention that it encourages sloppiness and software bloat. The password manager could be put on a simple MCU device, instead, we have a large non-transparent multi-component installation swept under the rug with Docke…

The same can be said of any software that you don't review and compile yourself. Whether I run a Docker container or pull in 500 npm/pip/cargo/gems/composer dependencies, the attack service remains. With Docker these individual layers can be separated and inspected at the very least.

Based on the name, I expected someone to take vaultwarden and make it an αcτµαlly pδrταblε εxεcµταblε that runs on its own without an OS; instead, this is just a quick tutorial for "how to set up vaultwarden".

Post reply on HN