Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

101–110 of 162 posts

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#101

Post by mjthompson »

sofixa wrote: post #95
nwah1 wrote: post #78

Earlier quoted context omitted.

The UX is actually kind of bad. I think it is electron-based, the menus are far from a work of art, and the folder management seems very primitive. But that said, it is by far the best product despite this.

What do you mean Electron based? There's no such thing as an "Electron-based UX". Bitwarden clients have the same UX across OSes and platforms ( browser extension, mobile app, thick client". The thick clients are indeed Electron based.

I think what was being said is the fact an app uses Electron rather than being native can diminish UX. I think it was clear enough from the post, at least from context.

I'm actually a bit confused by 'the same UX across OSes'. What does this mean? The mobile UI is completely different to the desktop apps and web app.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#102

Post by prophesi »

ClumsyPilot wrote: post #62
jillesvangurp wrote: post #42

Earlier quoted context omitted.

You are in control here. It's like every other bit of software you run yourself: it's your problem to do it properly. 1) if you worry about people replacing the docker image you are using, build your own. It's not hard. Alternatively, use a specific version of the docker image by specifying the version or the hash (if you are really paranoid). Of course after you review the Dockerfile. Minimum at least glance through…

"3) if you don't trust the OSS code, audit it or at least look through it. That's the whole point of OSS." Thats an outright fantasy, every day I rely on like 50 pieces of software written in 20 different languages and frameworks. They are updated multiple times a month. How many man hours would it take? 1000 a week? Proffesional developers couldn't find heartbleed for years, you really think anyone would notice a hi…

With the official Bitwarden repos, this is solved by having reputable teams periodically run security audits. Sadly, it's unlikely this Rust implementation will be audited any time soon.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#104

Post by Majromax »

colejohnson66 wrote: post #29
Majromax wrote: post #14

Earlier quoted context omitted.

With any password manager, encryption happens client-side. A malicious or compromised host could make off with your encrypted vault, but that would not by itself compromise passwords.

OP is arguing that the software could be changed to upload your encrypted version as usual, but also silently upload your unencrypted version. Either unintentionally (bug) or intentionally (tin foil hat saying NSA)

That would require changes to the client as well, however, and as I understand it bitwarden_rs still uses the standard client-side Bitwarden addon/applications/apps.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#105

Post by zzyzxd »

FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

> The peace of mind in having all your sensitive data under your control is totally worth it.

I used to have some illusions that "if I self host, I am in control", and "if I don't connect my home infra to the internet, I am safe". Later I realized neither is true.

I can't trust all the consumer grade devices in my network, I don't trust a software just because it is open source. And I don't have time to keep up with all the security patches and do security auditing / vulnerability scan routinely...etc.

It is fine to self host hobby stuff for fun, but professionally managing sensitive data is a full time job.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#106

Post by arsome »

zzyzxd wrote: post #105
FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

> The peace of mind in having all your sensitive data under your control is totally worth it. I used to have some illusions that "if I self host, I am in control", and "if I don't connect my home infra to the internet, I am safe". Later I realized neither is true. I can't trust all the consumer grade devices in my network, I don't trust a software just because it is open source. And I don't have time to keep up with…

Just set up backups, enable apt unattended upgrades for major security patches and forget the rest.

If you want to really get paranoid, pass it all through wireguard or ssh tunnels, but for bitwarden at least it's all client side encrypted anyways, you could probably run it on a very out of date system without issue.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#107

Post by cromka »

arkitaip wrote: post #10
jamescontrol wrote: post #8

Earlier quoted context omitted.

Yes, but if a company does this, they are essentially killing themselves. They have presumably spent a lot of time creating a company, gain customers etc, whereas a single(?) maybe anonymous open source developer does not have that much to lose.

The single dev has their reputation and professional career to lose whereas companies can and regularly engage in all kinds of legal and or judo to avoid any responsibility towards users.

A single dev is an exploitation sitting duck. They can get hacked, they can be stoled from, they can be targeted by the NSA (or FSA, ...), they can make a small but fatal mistakes, and I doubt they conform to the level of policies that companies like FAANG impose on their security-critical teams.

And all of the above are very good plausible deniability excuses, such that this single developer could, after all, be malicious and still not loose his reputation simply by claiming he got targeted by a 3rd party.

Let that sink in: a single developer and their PC is a gatekeeper of everyone's safety.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#109

Post by fraktl »

Macha wrote: post #21
fraktl wrote: post #11

I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach ou…

> It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road. It's a trust issue. I don't trust my passwords on someone else's server. I don't trust free services to remain free forever. I don't trust paid services to not increase the fees 4x over a few years. The alternative to bitwardenrs or bitwarden/server is not bitwarden.com for me given th…

> It's a trust issue. I don't trust my passwords on someone else's server.

They don't have your decryption key, therefore they save encrypted blobs and have no means to obtain your password. This takes care of trust issue - it simply is not an issue and never will be.

Even if malicious employee does something out of the ordinary or "hacker" gets the database, they still have the impossible task of breaking the encryption (which for all intents and purposes is impossible as of right now).

This returns us back to my starting point - there's *no objective* reason to use bitwarden_rs, apart from curiosity and/or convenience. I'm not saying it SHOULD not be used. We are all free to make choices as we see fit and don't need to justify them, however the reasons you listed are not reasons at all because the concerns you have don't exist.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#110

Post by RedComet »

sneak wrote: post #58
ryan29 wrote: post #53

Earlier quoted context omitted.

What other options would there even be for updates? That bug report describes every updater I've ever seen.

You are misunderstanding the issue. It's not asking before the update (as most programs that prompt you to update do). By the time that dialog box is displayed, the application has already replaced itself on disk (with code chosen arbitrarily by the bitwarden developers, or anyone in possession of their credentials), and the new code will be executed automatically without user intervention the next time the app is la…

Why don't you just disable the updater then?

https://github.com/bitwarden/desktop/issues/552#issuecomment...

Post reply on HN