Bring Your Own Password Manager: Portable BitWarden on a Pi Zero • Hacker News Board

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#91

Post by cricalix » Wed, Nov 02, 2022, 7:18 AM UTC

giobox wrote: post #67

GekkePrutser wrote: post #61

Earlier quoted context omitted.

IMO Letsencrypt is way too difficult to bother with for such scenarios: devices that are not open to the internet. The hassle of forwarding the ports for their verification and having to do it so regularly (3 months) is a real pita. I used to just pay for yearly certs for this reason but prices have gone up so now I'm back to using self signed. I'd love to set up my own PKI but the tool chain is so complex and many O…

Lets encrypt is staggeringly easy for devices that are not "open" to the internet - it supports or has plugins to manage ACME DNS challenge records fully automatically even for private IPs in your home network, and this is just one way to do it. Using letsencrypt to get valid SSL certs easily, automatically and for free for private IPs behind a NAT is something I love using it for! You never need to expose a webserve…

The pain point here is something like .home.arpa, which is nominally the recommended domain to use for home networks (not .local to avoid conflicts with mDNS IIRC).

There's still no good solution if you're using a domain that's not valid on the net. LE's lookup has to be able to reach the DNS server for the domain. I think it's something the industry as a whole has failed at - ensuring even LAN devices have good security without doing things like "your home network must have a publicly resolveable domain" or "run your own CA".

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#92

Post by synergy20 » Wed, Nov 02, 2022, 3:20 PM UTC

joshka wrote: post #86

synergy20 wrote: post #45

What about using the $4 rp2040 to make an open source yubikey instead?

You'd want some sort of TPM for that to be viable.

forgot that key piece indeed, thanks! not sure if there is an external approach(with a separate chip) to add TPM-alike functions though.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#93

Post by dspillett » Wed, Nov 02, 2022, 6:02 PM UTC

pmontra wrote: post #66

dspillett wrote: post #64

Earlier quoted context omitted.

> What's the use case for sharing passwords? For personal use: none for me. Instructions for deriving/obtaining my master password and physical key will be made available in any will or power of attorney documentation I get around to drawing up. In DayJob there are several, though they are usually only temporary needs, such as: 1. We often get sent password-protected documents by clients, that more than one of us nee…

> Distributing initial credentials for new assets or to new people Sometimes I write the password in a file in the home directory of a server we both access in ssh. It doesn't happen often, maybe not every year. A customer has no servers, not a chance with them.

Internally I do something very similar: drop the information to a share on my machine with read permissions set to the right people.

As you say, things can be more complicated for externals. I often don't have write access to much that they can read from, without putting in a request through infrastructure, for obvious separation-of-concerns reasons, because things we host/manage directly for them are well locked down, anything at their end is too, and most of our clients have white-list-only access to other resources.