Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

bitwarden.com

Post reply on HN
Print view View original

11–20 of 138 posts

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#11

Post by thewataccount »

alyandon wrote: post #5
sschueller wrote: post #3

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/

Check out Vaultwarden instead - https://github.com/dani-garcia/vaultwarden . It is written in Rust and is much lighter on resource requirements. CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS ecce485b8b3a bitwarden 0.06% 46.58MiB / 1.937GiB 2.35% 1.63MB / 28.1MB 17.5MB / 81.9kB 11

I've been considering vaultwarden, question though.

I assume bitwarden's implementation has been more thoroughly reviewed.

Assuming there is a critical bug in vaultwarden, what is the severity/what information is exposed? Is it relatively safe even then because of the E2E?

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#13

Post by Alupis »

castrodd wrote: post #6
teruakohatu wrote: post #2

Is 2FA still hidden behind the paywall? While bitwarden does this they are doing a major disservice to the averge (unpaid) user. Edit: thanks, sounds like 2fa is now free.

Isn’t it like $10 per year for a premium account?

Yes, and worth every penny in my experience. It's really a great app, and a great service.

Happily paid my $10 after using it around the office for a few months (paid Teams account).

We came from KeePass, so the whole cloud thing was new. But it's "just worked" remarkably well.

The multiple-profiles feature was a game changer, allowing me to access both my work credentials and personal credentials from the same app, while keeping them entirely separate is really nice.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#14

Post by OJFord »

thewataccount wrote: post #11
alyandon wrote: post #5

Earlier quoted context omitted.

Check out Vaultwarden instead - https://github.com/dani-garcia/vaultwarden . It is written in Rust and is much lighter on resource requirements. CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS ecce485b8b3a bitwarden 0.06% 46.58MiB / 1.937GiB 2.35% 1.63MB / 28.1MB 17.5MB / 81.9kB 11

I've been considering vaultwarden, question though. I assume bitwarden's implementation has been more thoroughly reviewed. Assuming there is a critical bug in vaultwarden, what is the severity/what information is exposed? Is it relatively safe even then because of the E2E?

Aiui, the server's really just a storage backend implementing the correct API - vaultwarden can't really do any harm, it just stores what the client (encrypts and) tells it to. Worst case it doesn't store, and you still (but only) have a copy on the client.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#16

Post by heresjohnny »

sschueller wrote: post #3

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#17

Post by Someone1234 »

x3n0ph3n3 wrote: post #9
Someone1234 wrote: post #4

Earlier quoted context omitted.

Because it uses Docker and that is what Docker requires.

No, it's because it uses _several_ docker containers and runs mssql.

"No" then go on to reinforce my explanation.

Those minimums are taken from Docker. The person above asked why they were what they were, I answered. You're just further reinforcing what I explained.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#18

Post by gpm »

OJFord wrote: post #14
thewataccount wrote: post #11

Earlier quoted context omitted.

I've been considering vaultwarden, question though. I assume bitwarden's implementation has been more thoroughly reviewed. Assuming there is a critical bug in vaultwarden, what is the severity/what information is exposed? Is it relatively safe even then because of the E2E?

Aiui, the server's really just a storage backend implementing the correct API - vaultwarden can't really do any harm, it just stores what the client (encrypts and) tells it to. Worst case it doesn't store, and you still (but only) have a copy on the client.

Eh, worst case you access it via the web-ui, it has been taken over, and it serves a malicious copy of the front-end that steals your password.

But... that seems reasonably unlikely.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#20

Post by xoa »

thewataccount wrote: post #11
alyandon wrote: post #5

Earlier quoted context omitted.

Check out Vaultwarden instead - https://github.com/dani-garcia/vaultwarden . It is written in Rust and is much lighter on resource requirements. CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS ecce485b8b3a bitwarden 0.06% 46.58MiB / 1.937GiB 2.35% 1.63MB / 28.1MB 17.5MB / 81.9kB 11

I've been considering vaultwarden, question though. I assume bitwarden's implementation has been more thoroughly reviewed. Assuming there is a critical bug in vaultwarden, what is the severity/what information is exposed? Is it relatively safe even then because of the E2E?

As well as what sibling said about it being E2EE and just using a standard API for storage, there are awesome tools these days so you can (and I think should) lock down your instance fairly well. Now when I run services like that I access them exclusively via WireGuard or Nebula, no exposure to the public internet at all. It's reliable, dependable and performant enough to pretty much put everything inside of by default. And for something as lightweight as this it should be fine running it at home off of most connections, if you don't have a fixed IP can bounce through even the cheapest VPS instance and still store nothing in the cloud (or run something like Nebula and automate that bit so that it's an encrypted mesh and only a minimal Lighthouse node need be 3rd party). If your instance is just for yourself then even the server can still be another of your devices. Selfhosting absolutely has its challenges and costs but the surface area for exploiting bugs drops a lot when there is no 3rd party or shared environment involved.
Post reply on HN