Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

131–140 of 162 posts

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#131

Post by arsome »

mjthompson wrote: post #101
sofixa wrote: post #95

Earlier quoted context omitted.

What do you mean Electron based? There's no such thing as an "Electron-based UX". Bitwarden clients have the same UX across OSes and platforms ( browser extension, mobile app, thick client". The thick clients are indeed Electron based.

I think what was being said is the fact an app uses Electron rather than being native can diminish UX. I think it was clear enough from the post, at least from context. I'm actually a bit confused by 'the same UX across OSes'. What does this mean? The mobile UI is completely different to the desktop apps and web app.

I was about to complain about how their mobile UI made me click a tiny button in the top right instead of using the massive button that did something entirely useless, went to check what the button actually was and found out they've now fixed it.

Props to the Bitwarden guys for fixing the only thing that really bothered me with the UI.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#132

Post by the_duke »

zzyzxd wrote: post #105
FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

> The peace of mind in having all your sensitive data under your control is totally worth it. I used to have some illusions that "if I self host, I am in control", and "if I don't connect my home infra to the internet, I am safe". Later I realized neither is true. I can't trust all the consumer grade devices in my network, I don't trust a software just because it is open source. And I don't have time to keep up with…

Agreed, managing secure servers is a full time job.

The situation with Bitwarden is a bit different though. Secrets are encrypted on the clients, the server never sees decrypted data.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#133

Post by dsissitka »

fraktl wrote: post #109
Macha wrote: post #21

Earlier quoted context omitted.

> It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road. It's a trust issue. I don't trust my passwords on someone else's server. I don't trust free services to remain free forever. I don't trust paid services to not increase the fees 4x over a few years. The alternative to bitwardenrs or bitwarden/server is not bitwarden.com for me given th…

> It's a trust issue. I don't trust my passwords on someone else's server. They don't have your decryption key, therefore they save encrypted blobs and have no means to obtain your password. This takes care of trust issue - it simply is not an issue and never will be. Even if malicious employee does something out of the ordinary or "hacker" gets the database, they still have the impossible task of breaking the encryp…

> ...therefore they save encrypted blobs and have no means to obtain your password.

Sure they do. The web vault. Plenty of functionality isn't available anywhere else.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#134

Post by ClumsyPilot »

jillesvangurp wrote: post #99
ClumsyPilot wrote: post #62

Earlier quoted context omitted.

"3) if you don't trust the OSS code, audit it or at least look through it. That's the whole point of OSS." Thats an outright fantasy, every day I rely on like 50 pieces of software written in 20 different languages and frameworks. They are updated multiple times a month. How many man hours would it take? 1000 a week? Proffesional developers couldn't find heartbleed for years, you really think anyone would notice a hi…

The keyword in that sentence is trust. Either trust or check. Your choice. Most people choose to trust certain software providers based on their reputation. But if you have serious doubts and you don't check, that would be your problem. Whining about an open source project maybe being insecure basically means either check it or don't use it. Nobody is twisting your arm to risk your passwords on some wonky self hosted…

I am not taking a stab at bitwarden or OSS, but this talking point about trust is total tripe.

It is a choice to obey the law of gravity? Because Its physically impossible for one person to check all security critical code they come in contact with even if they know every single programming language and have a Phd in cryptography. So stop with the accusatory language about 'whining' and pontification about choice.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#135

Post by dastx »

imwillofficial wrote: post #108

Even if using this, remember to get a bitwarden license. It’s $10 for a whole year and keeps their dev afloat.

Please please please do this. I have plenty of issues with their prioritisation but at the end of the day, Bitwarden is extremely cheap, and is a great product. There is little to no reason to not pay that $10 a year.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#136

Post by eeZah7Ux »

freeopinion wrote: post #126
eeZah7Ux wrote: post #31

Earlier quoted context omitted.

Unfortunately fragmenting the opensource ecosystem with too many implementations harms it.

I feel the same way about ice cream. Why are there 8 different types of vanilla ice cream, including 4 from the same brand? French Vanilla, Canadian Vanilla, Vanilla Bean, Double Churned Vanilla, 3 different plain Vanilla. This harms the ice cream ecosystem.

Absurd comparison.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#137

Post by eeZah7Ux »

coldtea wrote: post #34
eeZah7Ux wrote: post #31

Earlier quoted context omitted.

Unfortunately fragmenting the opensource ecosystem with too many implementations harms it.

People don't always give a fuck about the "opensource ecosystem", they just want to program something they find fun...

Unfortunately a lot of people don't give fucks about others.

Publishing a weekend fun project on github and taking contributors away from from other projects is not always nice.

If it's just a "fun project" put a clear warning that it's not meant to be trusted, used, contributed to.

Github, by design, defaults to showing issue trackers & so on, giving the impression that a project is "real".

Then you go looking for something to use and find 100 half alive projects instead of 2 good ones.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#138

Post by Cu3PO42 »

fraktl wrote: post #111
Cu3PO42 wrote: post #32

Earlier quoted context omitted.

Because it’s fun? Because they just felt like it? Why are people wasting their time watching movies, reading books or doing literally anything that doesn’t create immediate value? Beside all of that, the reason given is an extremely good one. The official server deployment suggests you should have multiple GB of free RAM for it. Bitwarden_rs uses orders of magnitude less. Right now it's sitting at 20MB on my server.

I run Bitwarden official on a Hetzner dedicated box, the machine costs ~40€ a month, Bitwarden usage does not even register as statistical error, therefore resource consumption is really not such a concern. There's really no objective reason to use bitwarden_rs. Subjectively - we can do whatever we like, I'm not trying to challenge anyone into providing their reasons or into justifying their decisions, there's no rig…

Interesting. I haven't tried running the official server, I just went by what they list on their website [1]. It says "Minimum 2GB", "Recommended 4GB". To me this suggested massive resource consumption: my server with a bunch of services including bitwarden_rs running uses just about 1GB.

[1] https://bitwarden.com/help/article/install-on-premise/

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#139

Post by hda111 »

arsome wrote: post #106
zzyzxd wrote: post #105

Earlier quoted context omitted.

> The peace of mind in having all your sensitive data under your control is totally worth it. I used to have some illusions that "if I self host, I am in control", and "if I don't connect my home infra to the internet, I am safe". Later I realized neither is true. I can't trust all the consumer grade devices in my network, I don't trust a software just because it is open source. And I don't have time to keep up with…

Just set up backups, enable apt unattended upgrades for major security patches and forget the rest. If you want to really get paranoid, pass it all through wireguard or ssh tunnels, but for bitwarden at least it's all client side encrypted anyways, you could probably run it on a very out of date system without issue.

It’s not everything encrypted. The server sees what domains you have passwords for. So there is a lot of metadata visible on the server. You have to trust the server also if you use the web client because the web client is loaded from the server. It could leak all your data if the server is compromised and you log in via web.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#140

Post by hda111 »

jillesvangurp wrote: post #42
malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

You are in control here. It's like every other bit of software you run yourself: it's your problem to do it properly. 1) if you worry about people replacing the docker image you are using, build your own. It's not hard. Alternatively, use a specific version of the docker image by specifying the version or the hash (if you are really paranoid). Of course after you review the Dockerfile. Minimum at least glance through…

4) this not 100% true. To get someone’s passwords you just have to compromise their bitwarden_rs to include a malicious web client that sends the master password to the attacker if the user logs in. This is a different story of course when the web client is never used. Then it is impossible to get the passwords because it’s encrypted at client side.
Post reply on HN