Earlier quoted context omitted.
The desktop[1] and mobile clients have a local database, so if the server is offline, you still have all of your data, you just can't sync. [1]: Note that the Bitwarden desktop client has a major remote code execution vulnerability that the developer has closed WONTFIX, so I don't recommend running the stock one without patching that out (as well as the spyware they embed in it).
Any more information on your claims? This is the first time I hear of this...
Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
51–60 of 162 posts
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#52Earlier quoted context omitted.
Bitwarden has a CLI tool which is pretty good.
what I mean is that why do you need bitwarden at all?
This is going to sound sketchy because any software project involving cryptography is automatically sketchy unless it has hit some nebulous and ill-defined 'accepted' status, but I've been working on a CLI tool to manage my passwords for a while that I'm honestly not ready to share, but the architecture so far is very simple:
Each 'service block' is an encrypted file consisting of service name, service password (autogenerated), kv-store, some metadata for regenerating new passwords. The key to each service block is the hash of a primary password. The name of the 'service block' file is the hash of the service name. All of the service blocks are stored together in a folder that can be rsynced wherever.
My worry is obviously in the crypto. While I'm not doing anything too fancy I worry about timing attacks because an attacker will have the full encrypted block so the system is vulnerable to that sort of thing.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#53Earlier quoted context omitted.
The desktop[1] and mobile clients have a local database, so if the server is offline, you still have all of your data, you just can't sync. [1]: Note that the Bitwarden desktop client has a major remote code execution vulnerability that the developer has closed WONTFIX, so I don't recommend running the stock one without patching that out (as well as the spyware they embed in it).
Not linking to the "major RCE vulnerability" is sensationalist posting at its finest. I can assume you are referring to... the automatic updater? https://github.com/bitwarden/desktop/issues/552
What other options would there even be for updates? That bug report describes every updater I've ever seen.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#54I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?
If I'm not mistaken it should be mostly fine as long as you trust the desktop/phone versions of Bitwarden not to send off the (unhashed) key to the server Edit: Noting that there have been discussions about the default number of iterations. https://github.com/bitwarden/jslib/issues/52
Even if the takeaway from that conversation was that sha256 is good enough, it concerns me how the Bitwarden team handled that issue.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#55I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?
Isn't the same thing true for every password manager? What's stopping LastPass from pushing an update that steals all my passwords? What's stopping Chrome from auto-updating to a version that sends every password I enter to Google?
It's not fair to single out just Bitwarden IMO.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#56I switched to Bitwarden when LastPass changed their policy for multi-device users. I'm happy to say the transition was completely painless.
Did you consider KeePass or one of the variants?
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#57I set it up in a couple of minutes using Docker-compose with Traefik. I love that Bitwarden has clients and plugins everywhere (FF and iOS being most relevant to me) and I can self-host. The sweetspot for me. I have had too many conflicts with my KeepassXC database on Nextcloud in the past, time for a solution with integrated sync.
Btw the "custom server" setting is a bit hidden, it is behind the cogwheel in the upper left in most cases.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#58Earlier quoted context omitted.
Not linking to the "major RCE vulnerability" is sensationalist posting at its finest. I can assume you are referring to... the automatic updater? https://github.com/bitwarden/desktop/issues/552
What other options would there even be for updates? That bug report describes every updater I've ever seen.
You are misunderstanding the issue. It's not asking before the update (as most programs that prompt you to update do).
By the time that dialog box is displayed, the application has already replaced itself on disk (with code chosen arbitrarily by the bitwarden developers, or anyone in possession of their credentials), and the new code will be executed automatically without user intervention the next time the app is launched, which happens automatically if the computer is rebooted (like if there is a momentary power failure, or you hit "okay" on an OS update, or your battery dies and later you plug it back in to power).
This grants the developers (as well as anyone who can compromise their credentials) unlimited remote access to your entire password vault the next time you unlock it.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#59I switched to Bitwarden when LastPass changed their policy for multi-device users. I'm happy to say the transition was completely painless.
Same here. I switched from LastPass and I really like the UX more than LastPass. It is less intrusive and feels more polished and snappier.
Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust
#60I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?
You are in control here. It's like every other bit of software you run yourself: it's your problem to do it properly. 1) if you worry about people replacing the docker image you are using, build your own. It's not hard. Alternatively, use a specific version of the docker image by specifying the version or the hash (if you are really paranoid). Of course after you review the Dockerfile. Minimum at least glance through…
Bitwarden server phones home every install. In order to remove the phoning home bit, you must recompile the entire codebase. I wonder if this rust alternative makes that easier to remove...