Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The quiet renovation at Bitwarden

blog.ppb1701.com

Post reply on HN
Print view View original

211–220 of 333 posts

Re: The quiet renovation at Bitwarden

#211

Post by thewebguyd »

kjuulh wrote: post #205

At this point it is too high of a risk to store my password elsewhere. I've been screwed over by dashlane, lastpass, potentially bitwarden now, I am with 1password now, but I've had my passwords in all these places, and I've had to change them each time, probably missing a few. I like 1password, it is by far the highest quality product I've used in this category. I moved from BitWarden back then because their browser…

Keepass has been my go to since forever, highly recommend. I never jumped on the SaaS password manager train when they started coming out, always just kept it local. There were times I thought I was missing out on some convenience but I'm glad I never moved.

Depending on your threat model, you can even just keep the .kdbx in cloud storage somewhere and point your keepass client to that. I'd recommend using a keyfile in addition to your master password though so that if anyone does happen to get a hold of the database they can't just make brute force attempts against it.

Re: The quiet renovation at Bitwarden

#212

Post by venusenvy47 »

inexcf wrote: post #146
gchamonlive wrote: post #94

Earlier quoted context omitted.

Yes, but vaultwarden isn't something you can casually run by yourself without some careful thinking. You are hosting secrets whose longevity is important, so if deploying yourself, take good care of backups and do regular drills, so you validate that the backups work, that they aren't corrupted and that you keep a copy off-site.

Me and some friends have each been hosting vaultwarden casually for years now. What problem do you see? I mean if the Server goes down and gets completely corrupted, worst case, all my devices still have the version of the vault they recently used. Technically every device has it's own backup of the vault.

You need a VPS, correct? Are there any concerns about hardening your VPS from attackers? I worry about my ability to harden a public - facing service that is handling something so critical for myself.

Re: The quiet renovation at Bitwarden

#213

Post by jamiek88 »

welder wrote: post #27

I don't care about raising prices, I'm worried about the new CEO having a PE mindset. That means Bitwarden will now focus on extracting value while the product stagnates and degrades in quality. Time to jump ship before their security and quality goes down the drain.

Can anyone name a PE purchase that made a company better?

Re: The quiet renovation at Bitwarden

#215

Post by void-star »

duckmysick wrote: post #103
giancarlostoro wrote: post #92

Earlier quoted context omitted.

Not my project but Vaultwarden is an open source (in Rust) alternative backend for Bitwarden. I believe its been around a while, and is still maintained. https://github.com/dani-garcia/vaultwarden

Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?

I have my vaultwarden running on a container on my home-lab server acessible only from Tailscale. The container itself is only accessible as its own node on my Tailscale private network and can’t be reached any other way (there are no inbound port forwards for the container itself, tailscale handles this)

My phone and laptop both use tailscale to access this and a few other containers I have set up similarly. I also have tailscale ACL rules to limit just “me” or whomever I want to allow to use it (family etc) also on my tailnet.

Backups are encrypted and stored locally as well as to AWS glacier.

I love it and it works great.

Re: The quiet renovation at Bitwarden

#216

Post by akerl_ »

JimBlackwood wrote: post #121
duckmysick wrote: post #103

Earlier quoted context omitted.

Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?

I’ve used Vaultwarden for at lesst 7 years, I’m sure for longer but I’m not sure how long. Never had an issue with Vaultwarden itself. Restored from backups several times for a variety of reasons (migrating host, corrupt hard disk, re-installs) and that always worked first try. In regards to hardering, the wiki has a good guide: https://github.com/dani-garcia/vaultwarden/wiki/Hardening-Gu... .

That guide is wild. By default it allows public registration, shows password hints, requires a reverse proxy for robust TLS but then passes tokens via GET params, runs in the container as root. Recommends fail2ban because it doesn't have any coverage against brute force. Recommends using a custom path for security.

This feels less like a guide on hardening Vaultwarden than a guide on why I should be skeptical about it.

Re: The quiet renovation at Bitwarden

#217

Post by void-star »

pocksuppet wrote: post #140
giancarlostoro wrote: post #92

Earlier quoted context omitted.

Not my project but Vaultwarden is an open source (in Rust) alternative backend for Bitwarden. I believe its been around a while, and is still maintained. https://github.com/dani-garcia/vaultwarden

Is there an alternative frontend as well, or are you still locked in?

https://github.com/doy/rbw Is an alternative Bitwarden cli front end. Probably has plenty of scaffolding to build a GUI frontend based on it.

Edit: Just a bit of googling turned up these as well.

https://github.com/AChep/keyguard-app https://github.com/sgolub/bitclient

Re: The quiet renovation at Bitwarden

#219

Post by akerl_ »

hypeatei wrote: post #119
duckmysick wrote: post #103

Earlier quoted context omitted.

Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?

> Anything I'm overlooking here? Not technical, but the person behind that project now works for Bitwarden so there's some risk of a rugpull. Of course it's OSS but you'll need to trust a fork or maintain it yourself if said rugpull happens.

The expansion of "rugpull" to encompass "a company or open source developer changing the roadmap or level of investment in something they develop" is fascinating.

Re: The quiet renovation at Bitwarden

#220

Post by rmadriz »

JuniperMesos wrote: post #191
varbhat wrote: post #78

I have moved to KeepassXC[1] on my desktop from Bitwarden. On phone, I use KeepassDX[2] which is Android client compatible with KeepassXC. On browser, I use KeepassXC Browser extension which connects with the desktop client. Since KeepassXC operates on a single file, you can use any Filesystem syncing tool to sync that file between devices or to store it in the cloud. I am really happy with the move. [1]: https://kee…

The file syncing, particularly between Android phone and multiple desktop machines, is my biggest worry with this workflow. Will the synced Keepass file get corrupted if I add a new password on the phone and also on desktop, and then later try to merge them?

Been using this setup for many years and never had any problem at all. I sync between desktop and mobile with Syncthing[0]. You can configure Syncthing to do file versioning, it has many options (Trash Can, Simple, Staggered or External file versioning) so if some weird conflict happens you'll never lose data. But honestly, I have never had any issues, and I have been running this setup for many years. So I'm sure I have run into all kind of edge cases and it just works.

As side note, Syncthing is an amazing piece of software. I sync everything for my other devices into a central PC and from there I do the backups.

- [0]: https://syncthing.net/

Post reply on HN