Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

11–20 of 162 posts

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#11

Post by fraktl »

I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach out to maintainers to see whether the feature could be implemented and paid for their effort but.. let's just say the answer was "No.".

Long story short - we use official Bitwarden and are paying for it and couldn't be happier. Bitwarden_RS looks like a cool toy, but I can't see any reason why anyone would run it. It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#12

Post by ianpurton »

malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

You can avoid this by only storing part of your password in Bitwarden. The random part.

Then when you log into somewhere add another secret (which you keep in your head) to the end of the password you stored in Bitwarden.

Switch on 2FA everywhere you can.

Sleep at night.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#13

Post by mnutt »

malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

This is the use case that something like sandstorm.io tries to solve, by locking down system calls on the backend and (slowly but surely) CSP on the frontend. I don’t think BitWarden has been ported yet, though.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#14

Post by Majromax »

malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

With any password manager, encryption happens client-side. A malicious or compromised host could make off with your encrypted vault, but that would not by itself compromise passwords.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#15

Post by chillfox »

malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

You could always write your own password manager if you are that paranoid.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#16

Post by rbut »

fraktl wrote: post #11

I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach ou…

I run bitwarden_rs for exactly the reason you stated, for personal passwords.

It took a few seconds to add to my portainer (docker) server and now I host my vault and keep it safe within my LAN.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#17

Post by rbut »

malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

The same could be said of every docker image on dockerhub, or any open source project on github, or any distro of linux.. I could keep going.

Unless you review the source code of everything you use, and compile it yourself, there’s always that risk.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#18

Post by throwaway8581 »

malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

Because of the way bitwarden works, I think as long as the client is secure, compromise of the server is not a major concern except for data loss. Your vault is encrypted client-side.

The real threat is that someone takes control of the bitwarden browser extension and pushes a malicious update.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#19

Post by vbezhenar »

throwaway8581 wrote: post #18
malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

Because of the way bitwarden works, I think as long as the client is secure, compromise of the server is not a major concern except for data loss. Your vault is encrypted client-side. The real threat is that someone takes control of the bitwarden browser extension and pushes a malicious update.

> The real threat is that someone takes control of the bitwarden browser extension and pushes a malicious update.

That's why I don't use any KeePass extensions. I just don't trust browser enough to be able to get any of my passwords.

I'm thinking about writing my own extension which will communicate with KeePass in a way that suits me (basically: when I'm pressing button in browser, it'll popup KeePass window with search field filled with server domain. Then I can either auto-type password from KeePass or copy it to clipboard, either way I'm only using KeePass and browser extension have no way to get any information.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#20

Post by fullstop »

fraktl wrote: post #11

I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach ou…

I ran bitwarden_rs for a bit on a digital ocean node, but ultimately decided to buy a premium membership because it was less than $5/mo and I think that they will do a better job securing the system and keeping things up to date than I would in my spare time.
Post reply on HN