Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vaultwarden: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

31–40 of 124 posts

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#31

Post by lern_too_spel »

HeatrayEnjoyer wrote: post #20
tjoff wrote: post #12

Earlier quoted context omitted.

The passwords are still stored client side, they won't disappear. Your family won't be able to add new passwords, but they can export them at their leisure.

It's often not possible to open a vault until internet access is restored

If you've opened it once on a device and haven't logged out, the encrypted vault is still available on that device and can be unlocked and read. You just can't modify it. There were bugs in the browser extension that made it log out without the user asking it to, but those should be fixed.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#32

Post by Uvix »

andix wrote: post #13
tssge wrote: post #10

Earlier quoted context omitted.

>Genuine question, in what scenario is the self hosting setup and maintenance worth it? Maybe if you're a huge org with a dedicated security team and so on, which could easily handle managing such service. I guess at a certain point it would bring cost savings at a scale in comparison to using Bitwarden, where it costs per team member or seat. Inhouse team has fixed costs in comparison. Of course for smaller orgs or…

The official Bitwarden server is also available for self hosting. For larger orgs this is probably the way to go instead of Vaultwarden. The official server needs a lot of different services and resources, so it’s not suitable for smaller deployments.

The official server has a simplified deployment approach in beta that gives a very Vaultwarden-like experience for smaller deployments. https://bitwarden.com/help/install-and-deploy-unified-beta/

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#33

Post by Mattwmaster58 »

davidee wrote: post #26

After being fed up with AgileBits' (1P's owner) shenanigans (hiding critical threads on their user forum, ignoring customer voices wilfully, being generally dismissive of criticism), I decided to give Bitwarden a try. I used it in conjunction with Vaultwarden for a year with the idea that I'd evaluate it as a family-wide replacement for 1P. In the end I went back to 1P. 1P does some things amazingly well. Here's the…

> Bitwarden is slow, slow, slow

Agreed. The good news is this is changing, they have native apps already in beta: https://bitwarden.com/blog/native-mobile-apps/

I'm using the Android beta and can confirm it's much faster.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#34

Post by Mattwmaster58 »

rkwasny wrote: post #25

Unfortunatelly I had to move from Bitwarden after I realised it's sometimes impossible to unlock the password store without connection to server.

This does not appear to be true - just tried with the beta and regular Android app with wifi + data off, and was able to access my credentials just fine.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#35

Post by jasode »

tjoff wrote: post #12
cdman wrote: post #7

Earlier quoted context omitted.

Another reason for NOT self hosting: I want the passwords for my family to be available in the event something happens to me. The probability of Bitwarden being more resilient (at least mid-term) is much higher than any self hosting solution I would come up with.

The passwords are still stored client side, they won't disappear. Your family won't be able to add new passwords, but they can export them at their leisure.

>The passwords are still stored client side, they won't disappear.

Offline access in Bitwarden client only works for 30 days. : https://bitwarden.com/blog/configuring-bitwarden-clients-for....

This was one of the main reasons why I switched from self-hosted Vaultwarden to KeePass.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#37

Post by sethammons »

HeatrayEnjoyer wrote: post #20
tjoff wrote: post #12

Earlier quoted context omitted.

The passwords are still stored client side, they won't disappear. Your family won't be able to add new passwords, but they can export them at their leisure.

It's often not possible to open a vault until internet access is restored

I've never had that issue in multiple years with spotty internet. What I have is clients that stay out of date and don't always immediately sync. Even when the Internet is fine. Sometimes even a restart wont force a sync.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#38

Post by einichi »

davidee wrote: post #26

After being fed up with AgileBits' (1P's owner) shenanigans (hiding critical threads on their user forum, ignoring customer voices wilfully, being generally dismissive of criticism), I decided to give Bitwarden a try. I used it in conjunction with Vaultwarden for a year with the idea that I'd evaluate it as a family-wide replacement for 1P. In the end I went back to 1P. 1P does some things amazingly well. Here's the…

I actually swapped over from 1P to Bitwarden because the experience on Mac just got worse and worse over time, bloated and buggy.

Bitwarden isn't rapid, but at the time it was, to my surprise, a better experience than 1P, at least on MacOS.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#39

Post by flatline-84 »

My main issue with Vaultwarden is that there doesn't appear to be any way to migrate a Bitwarden self-hosted instance to it. I run a Bitwarden server for myself and something like 5-10 family & friends so manually migrating everyone's data is tough.

I'd really love to try Vaultwarden as Bitwarden is pretty heavy on the little server it runs on

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#40

Post by cyrnel »

When you all self-host this, you also do the following, right?

- Create threat models that identify weaknesses in the design of your self-hosted setup.

- Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering.

- Deploy an intrusion detection system to know if you've been compromised.

- Perform all OS and app patching automatically, or regularly without fail.

- Follow CVE feeds in case a zero day needs to be fixed before the next patch window.

- Arrange for an expert to perform regular penetration tests.

- Deploy a tool that detects and alerts on things like firewall misconfigurations.

- Regularly test your backup and recovery methods, since if you also store 2FA codes and backup codes in there, you could be permanently locked out of your accounts.

Post reply on HN