Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

novamostra.com

Post reply on HN
Print view View original

21–30 of 93 posts

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#21

Post by the_svd_doctor »

cstuder wrote: post #18

I have a general question regarding the BitWarden server: How would you rate the security between using the official BitWarden server and self-hosting Vaultwarden? I am sympathetic (and capable) of self-hosting, but if my instance and my passwords are compromised, the fallout could be catastrophic for me. Am I better of in the long term by just using the BitWarden server and assuming that they have better security th…

I think the idea is that if you use the official client, there is “no risk” because everything is encrypted client side anyway.

In theory.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#22

Post by jalk »

osrec wrote: post #6
vxNsr wrote: post #4

Earlier quoted context omitted.

Not the OP but maybe bec this is a single use device… why not just install direct on the OS and back the whole thing up?

In case you ever wish to change the operating conditions/environment/hardware in the future. Having a consistent operating environment is a big win, in my opinion.

Yes absolutely, but if the hardware requirements for running docker currently doesn't fit on a keychain (a physical one that is), perhaps its not the best choice today for secure password storage.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#23

Post by _cenw »

xd1936 wrote: post #13

Keeping all of my passwords on a failure-prone SD card acting as a boot drive makes me nervous. I think I'd prefer a SyncThing-based solution for self-hosting a Bitwarden Vault or KeePass file... if I wasn't already a happy customer of Bitwarden's hosting solution.

You can chainload EDK2 builds for the Pi 3 and up (putting them on the SD card) and then boot into generic UEFI capable ARM linux on USB mass storage.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#24

Post by criddell »

resoluteteeth wrote: post #12

Using something like an RPI Zero and carrying this around would make more sense if the device had a display and could be airgrapped.

I’m not sure a RPI makes sense at all for stuff like this. They are so heavyweight compared to a little microcontroller board.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#25

Post by [deleted] »

jeroenhd wrote: post #20
atemerev wrote: post #16

Earlier quoted context omitted.

Yes, Docker is a black box. You don't know anything, you just launch something without understanding what components it consists of, what are they doing individually, what is their attack surface. Not to mention that it encourages sloppiness and software bloat. The password manager could be put on a simple MCU device, instead, we have a large non-transparent multi-component installation swept under the rug with Docke…

The same can be said of any software that you don't review and compile yourself. Whether I run a Docker container or pull in 500 npm/pip/cargo/gems/composer dependencies, the attack service remains. With Docker these individual layers can be separated and inspected at the very least. Based on the name, I expected someone to take vaultwarden and make it an αcτµαlly pδrταblε εxεcµταblε that runs on its own without an O…

[deleted]

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#27

Post by hk1337 »

atemerev wrote: post #19
bheadmaster wrote: post #3

Earlier quoted context omitted.

Why? Sincere question - AFAIK, Raspberry PI OS is a Linux distribution like any other, with dependency/distribution issues like any other. Why would using Docker on it be a sad state of affairs, in contrast to using it on any other distribution?

Because a password manager is a tiny piece of software. Instead, it is now a multi-component black box installation with a general purpose operating system running on a full-scale Linux machine with a containerization platform designed for datacenters. I am not a fan of this kind of redundancy and opaqueness.

BitWarden isn't all that tiny. I am pretty sure the main reasons for the docker container is that is built with dotnetcore and uses sql server for its database. BitWarden is complicated to install for self-hosting as opposed to using it on PiZero.

That said, I am skeptical of running it on a PiZero. I could see running it on a Pi3 or Pi4 where I can leave it connected to my network and cron backups to a NAS.

The BitWarden documentation itself shows 12 containers running. https://bitwarden.com/help/install-on-premise-linux/

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#29

Post by jrexilius »

resoluteteeth wrote: post #12

Using something like an RPI Zero and carrying this around would make more sense if the device had a display and could be airgrapped.

That was our approach. Build it into the keyboard, do all the various secrets management (passwords, TOTP, et al) and message encryption behind a data diode (sorta air gapped). And RPi isn't the ideal compute module for it as you don't want a wireless chip on the inside of the "airgap". https://www.anomie.tech/
Post reply on HN