Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

bitwarden.com

Post reply on HN
Print view View original

21–30 of 138 posts

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#21

Post by zikduruqe »

heresjohnny wrote: post #16
sschueller wrote: post #3

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

Just use passwordstore.org and stand up a bare git repo. It really doesn't need to be terribly complicated.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#22

Post by thewataccount »

xoa wrote: post #20
thewataccount wrote: post #11

Earlier quoted context omitted.

I've been considering vaultwarden, question though. I assume bitwarden's implementation has been more thoroughly reviewed. Assuming there is a critical bug in vaultwarden, what is the severity/what information is exposed? Is it relatively safe even then because of the E2E?

As well as what sibling said about it being E2EE and just using a standard API for storage, there are awesome tools these days so you can (and I think should) lock down your instance fairly well. Now when I run services like that I access them exclusively via WireGuard or Nebula, no exposure to the public internet at all. It's reliable, dependable and performant enough to pretty much put everything inside of by defau…

Thanks for the explination!

> if you don't have a fixed IP can bounce through even the cheapest VPS instance and still store nothing in the cloud

I've been meaning to look into this with wireguard, but I'm having trouble searching for/finding how to do this. Is "bastion host" what I'd want? Also is there a way to ensure the VPS cannot access the network as well, and just tunnels it essentially?

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#23

Post by cweagans »

Someone1234 wrote: post #17
x3n0ph3n3 wrote: post #9

Earlier quoted context omitted.

No, it's because it uses _several_ docker containers and runs mssql.

"No" then go on to reinforce my explanation. Those minimums are taken from Docker. The person above asked why they were what they were, I answered. You're just further reinforcing what I explained.

Running something in a Docker container adds very very little overhead - to the point that it's almost immeasurable. The resource utilization is specifically because of the services that have been packaged in the containers.

If you were running the Bitwarden server on bare metal (which you can definitely do), the requirements would still be the same.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#24

Post by turmeric_root »

Someone1234 wrote: post #4
sschueller wrote: post #3

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/

Because it uses Docker and that is what Docker requires.

Vaultwarden's Docker images are much smaller: https://hub.docker.com/r/vaultwarden/server

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#25

Post by sam_goody »

heresjohnny wrote: post #16
sschueller wrote: post #3

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

Sure.

Hosting your own is a twenty minute setup, more or less, and $5/mo on Hetzner. Uptime, in my experience, is 5 nines.

With SaaS, I am losing the main reason that I am using Bitwarden - that I don't want the X agency to force Bitwarden to give them my passwords.

And I know that if said agency (it varies by country and target) could definitely hack the VPS if I was important enough, that is not part of my threat profile. Self hosted is far less likely to get auto vacuumed than SaaS data.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#26

Post by iso1631 »

heresjohnny wrote: post #16
sschueller wrote: post #3

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

Yup, it's not rocket science if you already run your own services. An entire generation of techies seem to be completely scared of running their own machine and think it's some kind of massively difficult task.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#27

Post by koevet »

heresjohnny wrote: post #16
sschueller wrote: post #3

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

I have been running Vaultwarden (formerly known as bitwarden_rs) for years in a docker container and I don't remember a single time that it went down.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#28

Post by Yujf »

heresjohnny wrote: post #16
sschueller wrote: post #3

I just looked at the requirements to host your own Bitwarden server. Why does a password manager need 2GB of ram (4GB recommended) and 25GB[1] of storage? That seems quite excessive, how much data and traffic does this thing need to handle for me plus family members? [1] https://bitwarden.com/help/install-on-premise-linux/

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

Better security for sure. Bitwarden is a massive target while I am not. The chance that bitwarden has a databreach is way bigger than the chance that my server gets hacked. No one cares about my server, I am nobody not worth attacking. As long as I don't leave any big holes that can be found by an untargeted attack (which I won't, I run everything behind a personal VPN) it is safer.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#29

Post by idiotsecant »

sam_goody wrote: post #25
heresjohnny wrote: post #16

Earlier quoted context omitted.

Honest question: do you believe that you’ll be able to guarantee the same/better uptime, performance, and security compared to the SaaS version? Hosting your own password manager seems like something you really shouldn’t do, just like hosting your own e-mail. This stuff is critical to your life.

Sure. Hosting your own is a twenty minute setup, more or less, and $5/mo on Hetzner. Uptime, in my experience, is 5 nines. With SaaS, I am losing the main reason that I am using Bitwarden - that I don't want the X agency to force Bitwarden to give them my passwords. And I know that if said agency (it varies by country and target) could definitely hack the VPS if I was important enough, that is not part of my threat p…

I think if X agency wants your information the $5 wrench attack will probably bypass your self-hosted server infrastructure.

Re: Passwordless Authentication – Access Your Bitwarden Web Vault Without a Password

#30

Post by sakisv »

That's very nice, well done!

For a moment there I had hoped that maybe it would solve the problem in the opposite direction: I'm typing the master password so mechanically when I'm on my laptop, that I really struggle to remember it when I have to type it on a screen - to the point that I must go sit at a computer open a notepad, let muscle memory take over and then look at the screen to see what I typed /facepalm

Anyway, in all seriousness, while this is a scenario that happens very rarely, it still makes me wonder if it would be possible to do the pasdwordless login the other way, i.e. authenticate the phone using a trusted laptop (maybe a fingerprint enabled one)?

Post reply on HN