141–150 of 162 posts
My company used to use the unmaintained "CorporateVault", but switched to Bitwarden_rs after Flash (which CorporteVault used for copying to the clipboard) was deprecated. Bitwarden_rs was chosen because it had a relatively painless install compared to pretty much everything else I looked at, requiring only one Docker container. It's not bad.
a simple rsync client that could extract passwords from the data would be nice
Earlier quoted context omitted.
People don't always give a fuck about the "opensource ecosystem", they just want to program something they find fun...
Unfortunately a lot of people don't give fucks about others. Publishing a weekend fun project on github and taking contributors away from from other projects is not always nice. If it's just a "fun project" put a clear warning that it's not meant to be trusted, used, contributed to. Github, by design, defaults to showing issue trackers & so on, giving the impression that a project is "real". Then you go looking for s…
Earlier quoted context omitted.
People don't always give a fuck about the "opensource ecosystem", they just want to program something they find fun...
Unfortunately a lot of people don't give fucks about others. Publishing a weekend fun project on github and taking contributors away from from other projects is not always nice. If it's just a "fun project" put a clear warning that it's not meant to be trusted, used, contributed to. Github, by design, defaults to showing issue trackers & so on, giving the impression that a project is "real". Then you go looking for s…
That can be solved with curation. Where are the curating organizations/websites?
Earlier quoted context omitted.
My self-hosted bitwarden server is only accessible from the LAN. Since the full password database is cached locally on each client, you can use it to lookup existing passwords just fine without a connection to the server. Bitwarden does require a connection to the server to add passwords, as it isn't a distributed architecture, so this setup does prevent you from adding new passwords while you are out and about, but…
For home use, and to a limited extent - when all your users are proficient - for corporate use, I really enjoy pass ( https://www.passwordstore.org/ ). It has a decentralized architecture where passwords are synchronized via git, making it excel at situations where you need to generate or store secrets on the go. Unfortunately, the Windows client is not stellar, and the (unofficial?) Android app doesn't seem to have…
Switched to Bitwarden instead.
Earlier quoted context omitted.
Just set up backups, enable apt unattended upgrades for major security patches and forget the rest. If you want to really get paranoid, pass it all through wireguard or ssh tunnels, but for bitwarden at least it's all client side encrypted anyways, you could probably run it on a very out of date system without issue.
It’s not everything encrypted. The server sees what domains you have passwords for. So there is a lot of metadata visible on the server. You have to trust the server also if you use the web client because the web client is loaded from the server. It could leak all your data if the server is compromised and you log in via web.
The server does not see the domains you have passwords for. The following data are saved in plaintext:
- A list of "equivalent domains" (this starts out with a default list, but individuals can change this). This totally can be used to deduce which websites you have an account for, but that's not really enough information, as most websites will not have an entry here.
- Some metadata such as your email, master password hint
- Most of the boolean values (mfa enabled, email verified, premium)
- Custom field types (types only, field name, and value are both encrypted)
- Revision date
- Bunch of UUIDs
Here is what a single password entry looks like when retrieved from the /sync endpoint, which happens before decryption: https://pastebin.com/FLr19qiN
> You have to trust the server also if you use the web client because the web client is loaded from the server.
This is true! However, the android app, cli, and other clients do not get loaded from the server, thus, in theory, you can inspect the source of them, possibly compile it yourself, and use that. In those scenarios you do not have to trust the server.
My company used to use the unmaintained "CorporateVault", but switched to Bitwarden_rs after Flash (which CorporteVault used for copying to the clipboard) was deprecated. Bitwarden_rs was chosen because it had a relatively painless install compared to pretty much everything else I looked at, requiring only one Docker container. It's not bad.
You give in trust your company’s passwords to a random dude’s open source project that was never audited professionally. Seems a very risky thing to do.
Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.
> The peace of mind in having all your sensitive data under your control is totally worth it. I used to have some illusions that "if I self host, I am in control", and "if I don't connect my home infra to the internet, I am safe". Later I realized neither is true. I can't trust all the consumer grade devices in my network, I don't trust a software just because it is open source. And I don't have time to keep up with…
An attacker can justify allocating a lot of resource to pwn bitwarden.com. If you manage to break into the vaults you're bound to find something juicy, just because of how large the target is.
Or you could decide to pwn me. Figure out where my bitwarden is hosted, what my config looks like, what mistakes I might have made setting it up, then maybe find a way in. Then it's just the start, since the passwords are encrypted on disk, so at best you have access to an encrypted sqlite database. Now you need to find a way to get me to leak my vault key. Maybe I sometimes use the web interface? Maybe not. Who knows.
After all of that you may realize that all of my passwords are either not super important or require some form of 2FA, therefore wasting your time.
But hey, you can log into my hacker news account!
Security through irrelevancy.
Earlier quoted context omitted.
If I'm not mistaken it should be mostly fine as long as you trust the desktop/phone versions of Bitwarden not to send off the (unhashed) key to the server Edit: Noting that there have been discussions about the default number of iterations. https://github.com/bitwarden/jslib/issues/52
Even if the takeaway from that conversation was that sha256 is good enough, it concerns me how the Bitwarden team handled that issue.