Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

21–30 of 162 posts

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#21

Post by Macha »

fraktl wrote: post #11

I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach ou…

> It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road.

It's a trust issue. I don't trust my passwords on someone else's server. I don't trust free services to remain free forever. I don't trust paid services to not increase the fees 4x over a few years.

The alternative to bitwardenrs or bitwarden/server is not bitwarden.com for me given the areas I'm concerned with, it's going back to KeePass + Syncthing.

I think the reticence to provide the group features in bitwarden_rs may come from being unwilling to too blatantly step on the toes of Bitwarden LLC by producing a $0 drop in alternative to their paid service. bitwarden_rs is open source and bitwarden/server is _mostly_ open source (Some SSO related features are not), so it seems worthwhile to get along and not need to fork the ecosystem.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#22

Post by alpaca128 »

jamescontrol wrote: post #8
Macha wrote: post #6

Earlier quoted context omitted.

Isn't this true for any service? We're just trusting that the bitwarden/server image or bitwarden.com won't do the same? Also this is only a risk if you use the provided Web vault. If you use the desktop, mobile or browser extension clients, it would require both Bitwarden LLC and dani garcia to conspire against you as the server doesn't control code those clients run and the API only provides it data in encrypted fo…

Yes, but if a company does this, they are essentially killing themselves. They have presumably spent a lot of time creating a company, gain customers etc, whereas a single(?) maybe anonymous open source developer does not have that much to lose.

> if a company does this, they are essentially killing themselves

...or they have to do it because of the NSA and weirdly 99% of users don't care or don't have the means to do anything about it.

Companies aren't trustworthy, they are bigger targets but also targets with thicker armor.

I just go with the offline route, KeepassXC runs well enough for me and is compatible with phones. I need to handle data sync myself but it's not like I change or add new passwords every day.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#23

Post by CivBase »

ianpurton wrote: post #12
malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

You can avoid this by only storing part of your password in Bitwarden. The random part. Then when you log into somewhere add another secret (which you keep in your head) to the end of the password you stored in Bitwarden. Switch on 2FA everywhere you can. Sleep at night.

That's actually a cool idea for a password manager in general. After logging in, you input a "salt" value that is appended to the end of all your passwords. That value is never sent to the password server, so even if the server is compromised your associated accounts aren't.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#24

Post by StavrosK »

Macha wrote: post #21
fraktl wrote: post #11

I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach ou…

> It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road. It's a trust issue. I don't trust my passwords on someone else's server. I don't trust free services to remain free forever. I don't trust paid services to not increase the fees 4x over a few years. The alternative to bitwardenrs or bitwarden/server is not bitwarden.com for me given th…

Agreed, especially with how easy bitwarden_rs is to deploy (I wrote a three-line file and deployed it to my Dokku server and that was it).

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#27

Post by jaegerma »

CivBase wrote: post #23
ianpurton wrote: post #12

Earlier quoted context omitted.

You can avoid this by only storing part of your password in Bitwarden. The random part. Then when you log into somewhere add another secret (which you keep in your head) to the end of the password you stored in Bitwarden. Switch on 2FA everywhere you can. Sleep at night.

That's actually a cool idea for a password manager in general. After logging in, you input a "salt" value that is appended to the end of all your passwords. That value is never sent to the password server, so even if the server is compromised your associated accounts aren't.

There's actually a name for that: pepper

Instead of a salt, which is random for each entry and has to be stored along the hash, one single pepper is added to each password before hashing and kept secret.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#28

Post by polote »

There is really something broken in the dev word. Why are people wasting their time rebuilding things that already exists ?

If that was a side project to learn Rust, to learn the API of bitwarden, or to add new features I would understand, but that doesn't seem to be the case.

I'm really curious why? "perfect for self-hosted deployment where running the official resource-heavy service might not be ideal" is that really the reason ?

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#29

Post by colejohnson66 »

Majromax wrote: post #14
malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

With any password manager, encryption happens client-side. A malicious or compromised host could make off with your encrypted vault, but that would not by itself compromise passwords.

OP is arguing that the software could be changed to upload your encrypted version as usual, but also silently upload your unencrypted version. Either unintentionally (bug) or intentionally (tin foil hat saying NSA)

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#30

Post by colejohnson66 »

polote wrote: post #28

There is really something broken in the dev word. Why are people wasting their time rebuilding things that already exists ? If that was a side project to learn Rust, to learn the API of bitwarden, or to add new features I would understand, but that doesn't seem to be the case. I'm really curious why? "perfect for self-hosted deployment where running the official resource-heavy service might not be ideal" is that real…

Because sometimes people do things just because they can. Not every programming project needs to make sense.
Post reply on HN