Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

novamostra.com

Post reply on HN
Print view View original

61–70 of 93 posts

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#61

Post by GekkePrutser »

grepLeigh wrote: post #58

Great write-up, thanks for sharing this! One thing I would add: a self-signed certificate is not adequate for password transmission. In some ways, it's even worse than transmitting over clear-text http because it provides an illusion of security. Any actor on your network can man-in-the-middle, provide their own certificate, and you'd be none the wiser. I'd suggest provisioning LetsEncrypt leaf-node certificate on a…

IMO Letsencrypt is way too difficult to bother with for such scenarios: devices that are not open to the internet.

The hassle of forwarding the ports for their verification and having to do it so regularly (3 months) is a real pita.

I used to just pay for yearly certs for this reason but prices have gone up so now I'm back to using self signed. I'd love to set up my own PKI but the tool chain is so complex and many OSes like Android allow apps to opt out of user -added root certificates which makes it very hard to deal with.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#62

Post by snapplebobapple »

GekkePrutser wrote: post #61
grepLeigh wrote: post #58

Great write-up, thanks for sharing this! One thing I would add: a self-signed certificate is not adequate for password transmission. In some ways, it's even worse than transmitting over clear-text http because it provides an illusion of security. Any actor on your network can man-in-the-middle, provide their own certificate, and you'd be none the wiser. I'd suggest provisioning LetsEncrypt leaf-node certificate on a…

IMO Letsencrypt is way too difficult to bother with for such scenarios: devices that are not open to the internet. The hassle of forwarding the ports for their verification and having to do it so regularly (3 months) is a real pita. I used to just pay for yearly certs for this reason but prices have gone up so now I'm back to using self signed. I'd love to set up my own PKI but the tool chain is so complex and many O…

you could use the dns authentication, just set the ip to the local one this box for the domain you own/will be always use then all you have to be able to do is hit external dns and letsencrypt to update the cert.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#63

Post by dec0dedab0de »

antisthenes wrote: post #50
zmxz wrote: post #46

Earlier quoted context omitted.

What happens when there's more than you who uses the Keepass file and how do you store new passwords to the file when you create new accounts on the web (for various services)? What's the usage flow? Is there browser extension that allows you to interact with it without opening Keepass program? Maintenance you described is easy, but what about the actual usage and sharing passwords?

What's the use case for sharing passwords? I've never had the need to share one in 20+ years of being a power user. If I end up dead, my master password will be shared in my will with appropriate parties. > Is there browser extension that allows you to interact with it without opening Keepass program? I sure hope not.

Others have mentioned shared family accounts, I could also imagine storing shared wifi keys, or the admin password for the router. In the case of a business/project, there is also storing API keys, and maybe also admin passwords for devices. There could also be non-digital secrets stored in the vault, like bank accounts and social security numbers. The easy solution is just to have a separate keepass file that is meant to be shared, and/or have everyone maintain a separate vault with some of the data duplicated, and manually tell everyone when its time to update their info.

At work we use hashicorp vault, ansible vault, and cyberark for different things, but I still store my stuff in keepass. For personal use, I use keepass on dropbox, and it's worked incredibly well for almost 15 years now.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#64

Post by dspillett »

antisthenes wrote: post #50
zmxz wrote: post #46

Earlier quoted context omitted.

What happens when there's more than you who uses the Keepass file and how do you store new passwords to the file when you create new accounts on the web (for various services)? What's the usage flow? Is there browser extension that allows you to interact with it without opening Keepass program? Maintenance you described is easy, but what about the actual usage and sharing passwords?

What's the use case for sharing passwords? I've never had the need to share one in 20+ years of being a power user. If I end up dead, my master password will be shared in my will with appropriate parties. > Is there browser extension that allows you to interact with it without opening Keepass program? I sure hope not.

> What's the use case for sharing passwords?

For personal use: none for me. Instructions for deriving/obtaining my master password and physical key will be made available in any will or power of attorney documentation I get around to drawing up.

In DayJob there are several, though they are usually only temporary needs, such as:

1. We often get sent password-protected documents by clients, that more than one of us needs to read. It pains me how often I see an attached document on an email containing the password needed to open it… A shared password manager where someone can record the credential and mark who should be able to access it (or better have all credentials encrypted by the public keys of those who should be able to access them rather than just trusting a flag) would be less daftly insecure.

2. Distributing initial credentials for new assets or to new people, where those assets are not integrated with single-sign-on so nothing needs to be distributed anyway.

There are other ways to manage such situations of course, but a password management arrangement with a well-defined way of sharing credentials may encourage behaviour more secure than some of the ad-hoc solutions people regularly use.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#66

Post by pmontra »

dspillett wrote: post #64
antisthenes wrote: post #50

Earlier quoted context omitted.

What's the use case for sharing passwords? I've never had the need to share one in 20+ years of being a power user. If I end up dead, my master password will be shared in my will with appropriate parties. > Is there browser extension that allows you to interact with it without opening Keepass program? I sure hope not.

> What's the use case for sharing passwords? For personal use: none for me. Instructions for deriving/obtaining my master password and physical key will be made available in any will or power of attorney documentation I get around to drawing up. In DayJob there are several, though they are usually only temporary needs, such as: 1. We often get sent password-protected documents by clients, that more than one of us nee…

> Distributing initial credentials for new assets or to new people

Sometimes I write the password in a file in the home directory of a server we both access in ssh. It doesn't happen often, maybe not every year.

A customer has no servers, not a chance with them.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#67

Post by giobox »

GekkePrutser wrote: post #61
grepLeigh wrote: post #58

Great write-up, thanks for sharing this! One thing I would add: a self-signed certificate is not adequate for password transmission. In some ways, it's even worse than transmitting over clear-text http because it provides an illusion of security. Any actor on your network can man-in-the-middle, provide their own certificate, and you'd be none the wiser. I'd suggest provisioning LetsEncrypt leaf-node certificate on a…

IMO Letsencrypt is way too difficult to bother with for such scenarios: devices that are not open to the internet. The hassle of forwarding the ports for their verification and having to do it so regularly (3 months) is a real pita. I used to just pay for yearly certs for this reason but prices have gone up so now I'm back to using self signed. I'd love to set up my own PKI but the tool chain is so complex and many O…

Lets encrypt is staggeringly easy for devices that are not "open" to the internet - it supports or has plugins to manage ACME DNS challenge records fully automatically even for private IPs in your home network, and this is just one way to do it. Using letsencrypt to get valid SSL certs easily, automatically and for free for private IPs behind a NAT is something I love using it for!

You never need to expose a webserver to the public internet to use letsencrypt to get a valid SSL certificate, even if IP is in the private RFC range (192.168.x.x, 10.x.x.x, etc etc).

Every single webapp I run internally has a two line automated Caddy/letsencrypt auto configuration, that just works.

To suggest it is way too difficult suggests you haven't tried recently, or are familiar with very old http-based DNS authentication challenges. You do not need to use http-based challenges to use letsencrypt for a long time, although still supported.

> https://caddyserver.com/docs/automatic-https

> https://caddy.community/t/how-to-use-dns-provider-modules-in...

No port forwarding required, ever.

This feature also exists in plain ole letsencypt, their "dns-01" challenge support:

https://letsencrypt.org/docs/challenge-types/#dns-01-challen...

The list of DNS providers who support this is massive now too:

https://community.letsencrypt.org/t/dns-providers-who-easily...

It is now so absurdly easy to do, all my personal projects just have valid SSL by default now, even on my internal LAN. All letsencrypt needs is proof of domain ownership- thanks to DNS TXT records, no one needs to host a website/port forward to accomplish that.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#68

Post by riedel »

zmxz wrote: post #46
qwerpy wrote: post #42

I've seen so many interesting password manager solutions over the years, but I have yet to move away from a Keepass file hosted on cloud storage. I can read and write to it using apps from every device I use: windows and linux PCs, iOS and Android devices. The file is versioned so accidentally clobbering it isn't a concern. There is zero maintenance, and if my home server goes down my passwords are unaffected. If I'm…

What happens when there's more than you who uses the Keepass file and how do you store new passwords to the file when you create new accounts on the web (for various services)? What's the usage flow? Is there browser extension that allows you to interact with it without opening Keepass program? Maintenance you described is easy, but what about the actual usage and sharing passwords?

We have been encrypting the key file with our SSH keys and share it along the database in a private GitHub repo. Additionally we have a single memorable password as preshared key. Works well for our small admin group.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#69

Post by [deleted] »

snapplebobapple wrote: post #62
GekkePrutser wrote: post #61

Earlier quoted context omitted.

IMO Letsencrypt is way too difficult to bother with for such scenarios: devices that are not open to the internet. The hassle of forwarding the ports for their verification and having to do it so regularly (3 months) is a real pita. I used to just pay for yearly certs for this reason but prices have gone up so now I'm back to using self signed. I'd love to set up my own PKI but the tool chain is so complex and many O…

you could use the dns authentication, just set the ip to the local one this box for the domain you own/will be always use then all you have to be able to do is hit external dns and letsencrypt to update the cert.

[deleted]

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#70

Post by password4321 »

If you have an old Android phone you might be interested in https://github.com/tejado/Authorizer

> Authorizer is a Password Manager for Android. It emulates an HID keyboard over USB and enters your credentials on your target device. Additionally it supports OTP

Post reply on HN