41–50 of 124 posts
My main issue with Vaultwarden is that there doesn't appear to be any way to migrate a Bitwarden self-hosted instance to it. I run a Bitwarden server for myself and something like 5-10 family & friends so manually migrating everyone's data is tough. I'd really love to try Vaultwarden as Bitwarden is pretty heavy on the little server it runs on
When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…
When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…
Earlier quoted context omitted.
It's often not possible to open a vault until internet access is restored
If you've opened it once on a device and haven't logged out, the encrypted vault is still available on that device and can be unlocked and read. You just can't modify it. There were bugs in the browser extension that made it log out without the user asking it to, but those should be fixed.
I'd say if it is a problem being fixed, it is not across the board yet.
After being fed up with AgileBits' (1P's owner) shenanigans (hiding critical threads on their user forum, ignoring customer voices wilfully, being generally dismissive of criticism), I decided to give Bitwarden a try. I used it in conjunction with Vaultwarden for a year with the idea that I'd evaluate it as a family-wide replacement for 1P. In the end I went back to 1P. 1P does some things amazingly well. Here's the…
> Bitwarden is slow, slow, slow Agreed. The good news is this is changing, they have native apps already in beta: https://bitwarden.com/blog/native-mobile-apps/ I'm using the Android beta and can confirm it's much faster.
https://play.google.com/store/apps/details?id=com.x8bit.bitw...
Web Android beta link:
https://play.google.com/apps/testing/com.x8bit.bitwarden.bet...
When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…
Unfortunatelly I had to move from Bitwarden after I realised it's sometimes impossible to unlock the password store without connection to server.
This does not appear to be true - just tried with the beta and regular Android app with wifi + data off, and was able to access my credentials just fine.
After being fed up with AgileBits' (1P's owner) shenanigans (hiding critical threads on their user forum, ignoring customer voices wilfully, being generally dismissive of criticism), I decided to give Bitwarden a try. I used it in conjunction with Vaultwarden for a year with the idea that I'd evaluate it as a family-wide replacement for 1P. In the end I went back to 1P. 1P does some things amazingly well. Here's the…
I don't know. I guess it depends on what you compare it to. I've used Bitwarden in some pretty non-technical surroundings and it worked fine. Compared to a "single file" PW manager (like KeePass), I'd say it's still pretty easy to use within a team or group of "non-technical" users.
Granted, not as good as 1PW, but still a lot better than KeePass et al.
When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…
When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…
If the cost of your security policy is greater then the cost of a worst case compromise then you are probably over investing in security.
With that in mind, does your policy seem appropriate to a user securing their Facebook password? Or their homelab service accounts?
*Cost in this case being the combination of literal currency and subjective costs like time/emotional well-being/public perception.