Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The quiet renovation at Bitwarden

blog.ppb1701.com

Post reply on HN
Print view View original

151–160 of 333 posts

Re: The quiet renovation at Bitwarden

#151

Post by Snow_Falls »

hypeatei wrote: post #119
duckmysick wrote: post #103

Earlier quoted context omitted.

Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?

> Anything I'm overlooking here? Not technical, but the person behind that project now works for Bitwarden so there's some risk of a rugpull. Of course it's OSS but you'll need to trust a fork or maintain it yourself if said rugpull happens.

The maintainer has said that they've been given permission to maintain it in their free time. All it takes is a bad quarter and the CEO decides they don't want to be supporting a competitor and that goes away. It's possible that a community continuation could happen but I wouldn't rely on something so uncertain for something as important as credentials.

Re: The quiet renovation at Bitwarden

#152

Post by EvanAnderson »

JimBlackwood wrote: post #121
duckmysick wrote: post #103

Earlier quoted context omitted.

Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?

I’ve used Vaultwarden for at lesst 7 years, I’m sure for longer but I’m not sure how long. Never had an issue with Vaultwarden itself. Restored from backups several times for a variety of reasons (migrating host, corrupt hard disk, re-installs) and that always worked first try. In regards to hardering, the wiki has a good guide: https://github.com/dani-garcia/vaultwarden/wiki/Hardening-Gu... .

Pretty similar experience for me, albeit I've only been managing it for about a year.

Restore from backup testing was straightforward. We haven't had any problems w/ the application itself.

I used that that hardening guide for my setup. The one I manage is exposed to the Internet and I'm bringing traffic into it via a reverse proxy.

Re: The quiet renovation at Bitwarden

#153

Post by saila »

websap wrote: post #143

How hard is it to fully migrate from Bitwarden to Apple Passwords / Google Passwords? I guess I'm going to have to spend 2 hours on this next weekend.

If you have Bitwarden installed on an iPhone, you can export directly to Apple Passwords with no intermediate steps or trying to figure out where to save the unencrypted CSV file. I just did this and it looks pretty good so far.

Re: The quiet renovation at Bitwarden

#154

Post by inexcf »

gchamonlive wrote: post #148
inexcf wrote: post #146

Earlier quoted context omitted.

Me and some friends have each been hosting vaultwarden casually for years now. What problem do you see? I mean if the Server goes down and gets completely corrupted, worst case, all my devices still have the version of the vault they recently used. Technically every device has it's own backup of the vault.

If I stay offline for more than 30 days, can I still access my local passwords? Honest question, because if that's the case it's nice, but I think you'd need to somehow authenticate before accessing your local vault.

Thanks for making me check. Did not know this: "Offline Vault sessions will expire after 30 days. Except for mobile client applications, which will expire after 90 days." But for me that is enough time to feel safe, still will do backups regularly.

Re: The quiet renovation at Bitwarden

#155

Post by cobertos »

duckmysick wrote: post #103
giancarlostoro wrote: post #92

Earlier quoted context omitted.

Not my project but Vaultwarden is an open source (in Rust) alternative backend for Bitwarden. I believe its been around a while, and is still maintained. https://github.com/dani-garcia/vaultwarden

Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?

I've never had a reliability issue with Vaultwarden. Hosted it 5+ years now. Even with random off/on of the server and other bumps in the road in life, the Docker container I run has had no issues with hosting. The user interface is friendly but can be just a little slow.

Mine is not exposed to the public internet, though some friends of mine do. I use a VPN when I need to access fresh data from the home server, otherwise both the Firefox client and Android client will generally keep a cache of the last data pull when they had connection (so it wasn't an issue the 4 or so years I didn't have a VPN yet).

Re: The quiet renovation at Bitwarden

#156

Post by jnovek »

bglusman wrote: post #150
jnovek wrote: post #136

Earlier quoted context omitted.

I just sent them a message along these lines. I’m happy to pay for good services, but M&A means cost-cutting measures to make the company look good for acquisition and that makes me uncomfortable with letting them store secure data for me. Switching is going to be a pain.

It is really easy to self-host, and do so securely...

I’m not buying hosting from a password manager, I’m buying security. I don’t have complete confidence that I can secure a self-hosted password manager and it’s not an area where I want to take risks.

Re: The quiet renovation at Bitwarden

#157

Post by kreyenborgi »

flanbiscuit wrote: post #105
kn100 wrote: post #48

Good post. I switched from Bitwarden to KeepassXC / KeepassDX / Syncthing across my Android phone, Linux PC, and Windows PC. This was the setup I had prior to using Bitwarden for the first time. The Keepass experience is significantly better these days! Importing from Bitwarden is trivial too. Recommended!

I was using this but when I switched to iOS I switched to Bitwarden. What are you using for Syncthing on Android? There used to be an official Syncthing app for Android but then they stopped maintaining it. There was a popular fork but then that person stopped as well. I looked into using Syncthing on iOS but there was only Möbius Sync and it didn’t run in the background. This is was made me finally switch to Bitward…

I use syncthing-fork from fdroid, works great

Re: The quiet renovation at Bitwarden

#158

Post by kreyenborgi »

krupan wrote: post #112
jillesvangurp wrote: post #84

I got my parents using bitwarden a few years ago. This was a massive improvement over them writing passwords in a little notebook in a drawer (yes, really!). But Keepass is a bridge too far for them. I'm not that enthusiastic about it myself to be honest. The UX is a bit meh (for the clients/extensions I've tried) and file syncing and handling is not something I can in good conscience push to a non technical user. It…

KeepassXC is much better than older keepass clients. Syncthing runs quietly in the background. It's really not much harder to use that other password managers once you set it up

Ehh.. much as I love syncthing, I wouldn't recommend it to nontechnical people. I mean, here the dad has android the mom iphone amd they want to sync a keepass file? Maybe with a browser addon on a desktop as well? And the most popular third party android app is discontinued (I use the nerdily named syncthing-fork) and the ios apps i never managed to get to work for my family (maybe sushitrain works now?). But if you live close to parents I guess it can work. This kind of software can be good for social cohesion and less isolation =P

Re: The quiet renovation at Bitwarden

#159

Post by ViAchKoN »

schnitzelstoat wrote: post #39
Havoc wrote: post #32

After the LastPass fiasco I switched to selfhosting a password manager (bw). Rapidly starting to think even a vibecoded solution may be a better plan relying on commercial options. High risk of don’t roll your own crypto mistakes but realistically that’s not the threat model here anymore for the random individual. It’s online breaches or perhaps a wrench attack not highly skilled crypto adversary. Plus there are prob…

The LLMs also help a script kiddie become a highly skilled crypto adversary though. Especially if the concerns around Mythos are well founded.

I don't think concerns around Mythos are well founded. Highly doubt it will happen.

Re: The quiet renovation at Bitwarden

#160

Post by trinsic2 »

zeroonetwothree wrote: post #109
0x262d wrote: post #67

Earlier quoted context omitted.

I'm getting really tired of the enshittification cycle. Learning about android verification and captcha changes recently has been another big frustration point. I moved to android as a more open alternative to apple just a few years ago, and to bitwarden from lastpass around the same time. I would like to just have these infrastructural services work well and quietly without thinking about them for many years. Do I r…

Bitwarden hasn’t “enshittified” anything. It’s all entirely speculative

Looks pretty bad regardless of speculation. There are enough red flags to warrant actions and to consider this another enshitification.
Post reply on HN