Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

151–160 of 162 posts

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#151

Post by dastx »

sneak wrote: post #48
novium wrote: post #5

Earlier quoted context omitted.

If I'm not mistaken it should be mostly fine as long as you trust the desktop/phone versions of Bitwarden not to send off the (unhashed) key to the server Edit: Noting that there have been discussions about the default number of iterations. https://github.com/bitwarden/jslib/issues/52

Note also that the bitwarden desktop app has a remote code execution vulnerability that the developers refuse to fix, which means that the developers can, at any time, replace your local copy of the bitwarden desktop app with a different version that could steal all your passwords in exactly the manner you describe. You can patch the bitwarden client (and also take the opportunity to remove the spyware they have embe…

Do you have more information on this? A link maybe?

EDIT: Never mind, found it - https://github.com/bitwarden/desktop/issues/552. This isn't exactly an RCE. You can say the same about anything. By your logic Microsoft auto-updates are RCE. Same with pacman/apt-get/yum package managers. Same with pretty much anything else.

I'm not saying they're not valid concerns, however, if you're this worried about all of these things, maybe cloud-based software isn't for you.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#152

Post by Macha »

fraktl wrote: post #109
Macha wrote: post #21

Earlier quoted context omitted.

> It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road. It's a trust issue. I don't trust my passwords on someone else's server. I don't trust free services to remain free forever. I don't trust paid services to not increase the fees 4x over a few years. The alternative to bitwardenrs or bitwarden/server is not bitwarden.com for me given th…

> It's a trust issue. I don't trust my passwords on someone else's server. They don't have your decryption key, therefore they save encrypted blobs and have no means to obtain your password. This takes care of trust issue - it simply is not an issue and never will be. Even if malicious employee does something out of the ordinary or "hacker" gets the database, they still have the impossible task of breaking the encryp…

> however the reasons you listed are not reasons at all because the concerns you have don't exist.

You've only attempted to address 1 of 3, and the other reply indicates that there is absolutely attack vectors from bitwarden.com if bitwarden LLC wanted to, was forced to, or was compromised.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#153

Post by mjthompson »

imwillofficial wrote: post #108

Even if using this, remember to get a bitwarden license. It’s $10 for a whole year and keeps their dev afloat.

I use 1Password and still pay for a Bitwarden licence to support development of a viable open source alternative.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#154

Post by chousuke »

hda111 wrote: post #141
AnIdiotOnTheNet wrote: post #77

My company used to use the unmaintained "CorporateVault", but switched to Bitwarden_rs after Flash (which CorporteVault used for copying to the clipboard) was deprecated. Bitwarden_rs was chosen because it had a relatively painless install compared to pretty much everything else I looked at, requiring only one Docker container. It's not bad.

You give in trust your company’s passwords to a random dude’s open source project that was never audited professionally. Seems a very risky thing to do.

The only thing you have to trust on a BitWarden server is the Javascript client that it serves you, and using that is entirely optional as you can just use other clients. The server could be explicitly malicious and still safe to use.

bitwarden_rs bundles the upstream JS in its default containers, so it's the same code that you'd be running from bitwarden.com

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#155

Post by chousuke »

fraktl wrote: post #11

I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach ou…

I chose to use bitwarden_rs because the official server is huge, and deploying it seemed like a massive pain.

Before installing the rust version I actually went through the code to check that it wasn't doing anything untoward; it wasn't a very thorough review, but it took a couple hours. Given the fact that you don't actually need to trust a Bitwarden server, I'm not too concerned about using an "unofficial" implementation.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#156

Post by imwillofficial »

mjthompson wrote: post #153
imwillofficial wrote: post #108

Even if using this, remember to get a bitwarden license. It’s $10 for a whole year and keeps their dev afloat.

I use 1Password and still pay for a Bitwarden licence to support development of a viable open source alternative.

This is awesome, low barrier to entry, high quality product.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#158

Post by alias_neo »

mjthompson wrote: post #98
alias_neo wrote: post #94

Earlier quoted context omitted.

Bingo. If you're going to host services as home such as your password manager, set up a WireGuard VPN, you can use a Pi and it'll be perfectly sufficient, leave only the VPN open on the internet, VPN in from your phone, laptop, whatever for anything you need access to, and you don't need to rely on Nextcloud or Bitwarden having vulnerabilities discovered in them. I was using Nextcloud previously for password sync bec…

Why would you mount read only, out of interest? How do you keep packages up to date? And what about logging? I'd want to be logging connection attempts.

To save the SD card mostly. I log to a ring buffer in RAM.

I've had my Raspberry Pis kill dozens of SD cards over the years, so read only can helas for updates, I manually remount read/write when I do maintenance and then remount read/only again when I'm done.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#159

Post by wufocaculura »

anyone moved from Keepass(XC) to bitwarden?

I do see advantage of being cloud based as a way to avoid database conflicts (in my case 3 windows machines + mobile), but I wonder what can surprise me here. Is bitwarden's browser integration similar to KeepassXC (Keepass helper + KeepasXC-browser)?

Post reply on HN