Back up your Bitwarden vault in a future-proof and secure way
davidisaksson.dev
Back up your Bitwarden vault in a future-proof and secure way
1–7 of 7 posts
Re: Back up your Bitwarden vault in a future-proof and secure way
#2My future-proof and secure backup: Exported to csv - printed on a piece of paper + a copy on a SD card. Locked in my safe.
Re: Back up your Bitwarden vault in a future-proof and secure way
#3You should never store unencrypted secrets, like this export file, on an unencrypted disk. Not even temporarily.
Instead, create a small encrypted drive on a pendrive or as a file with LUKS or Veracrypt, mount it, and save the file _directly_ there.
Re: Back up your Bitwarden vault in a future-proof and secure way
#4You should never store unencrypted secrets, like this export file, on an unencrypted disk. Not even temporarily. Instead, create a small encrypted drive on a pendrive or as a file with LUKS or Veracrypt, mount it, and save the file _directly_ there.
I imagine that’s why the post talks about PGP encrypting the file?
Re: Back up your Bitwarden vault in a future-proof and secure way
#5If your self hosting bw then there is a better way. The vault is encrypted at rest. Just back that up via borgbackup. No questionable plain text step. No reminders, just nightly incremental backup
Re: Back up your Bitwarden vault in a future-proof and secure way
#6You should never store unencrypted secrets, like this export file, on an unencrypted disk. Not even temporarily. Instead, create a small encrypted drive on a pendrive or as a file with LUKS or Veracrypt, mount it, and save the file _directly_ there.
I imagine that’s why the post talks about PGP encrypting the file?
Yes, that's correct. The script takes the output from bw-cli and pipes it directly (sort of since we also store it in a variable to calculate the number of rows) to gpg which then encrypts it.
The only secret we have in plain text here is the API token for Todoist which I'm OK with. It's always the balance between security and comfort.
Re: Back up your Bitwarden vault in a future-proof and secure way
#7If your self hosting bw then there is a better way. The vault is encrypted at rest. Just back that up via borgbackup. No questionable plain text step. No reminders, just nightly incremental backup
That's true! Self hosting opens up possibilities for a better backup system.