Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vaultwarden: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

51–60 of 124 posts

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#51

Post by MadnessASAP »

marcus0x62 wrote: post #49
cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

You’re really, really sure your hosted provider does all of that correctly, right?

Not to defend them, but it doesn't matter if a hosting provider does that. So long as you can sue them for your full damages when it goes wrong.

That's the whole point of SaaS isn't it? We pay you to manage this, you manage it appropriately taking advantage of economies of scale, we sue the shit outta you if it goes wrong.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#52

Post by aborsy »

Vaultwarden is impressive. Years of work without issue. It supports Yubikey now.

Eventually, I ended up using Pass though, since I prefer terminal. Pass doesn’t have any database to break: it’s just gpg and git. With Yubikey, every password needs a touch.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#53

Post by llamaimperative »

MadnessASAP wrote: post #50
cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

An important part of security is threat assessment and worst case analysis. If the cost of your security policy is greater then the cost of a worst case compromise then you are probably over investing in security. With that in mind, does your policy seem appropriate to a user securing their Facebook password? Or their homelab service accounts? *Cost in this case being the combination of literal currency and subjectiv…

Is that the type of thing that people self-hosting a password management server are trying to secure?

In that case, it's extra silly. Is the cost of setting this up and maintaining it at all worth securing your Facebook password?

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#54

Post by number6 »

cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

My setup is this: drop all traffic except 80 and 443, autoupdate, Backup the Container-Volumes to Backblaze with restic.

I got hacked less often than 1Password or Okta, so I guess I am on par with the professionals, afaik (I give you that) :)

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#55

Post by number6 »

llamaimperative wrote: post #53
MadnessASAP wrote: post #50

Earlier quoted context omitted.

An important part of security is threat assessment and worst case analysis. If the cost of your security policy is greater then the cost of a worst case compromise then you are probably over investing in security. With that in mind, does your policy seem appropriate to a user securing their Facebook password? Or their homelab service accounts? *Cost in this case being the combination of literal currency and subjectiv…

Is that the type of thing that people self-hosting a password management server are trying to secure? In that case, it's extra silly. Is the cost of setting this up and maintaining it at all worth securing your Facebook password?

We like to host stuff :) If I am faithful to myself I might be paying more than I would if I wouldn't self-host

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#56

Post by rlpb »

MadnessASAP wrote: post #51
marcus0x62 wrote: post #49

Earlier quoted context omitted.

You’re really, really sure your hosted provider does all of that correctly, right?

Not to defend them, but it doesn't matter if a hosting provider does that. So long as you can sue them for your full damages when it goes wrong. That's the whole point of SaaS isn't it? We pay you to manage this, you manage it appropriately taking advantage of economies of scale, we sue the shit outta you if it goes wrong.

> So long as you can sue them for your full damages when it goes wrong.

Generally, you cannot.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#57

Post by jerf »

cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

Well, what I have done is this analysis:

1. If for some reason a state-based actor takes interest in me, I'm boned no matter what I do. I wouldn't trust any hosted service in that circumstance and that includes the service I'm running Vaultwarden on. My vault isn't even what they'd necessarily attack; they'll go straight after my bank and straight after my other high-value accounts and there's nothing I can do about that either.

2. My self-hosted Vaultwarden setup will defeat any random scanner and the majority of random Joe Schmoe Hacker guys. In principle it even defeats a casual insider on my hosting service because just grabbing a disk image actually shouldn't help them much; they need to compromise Vaultwarden (not just the OS generally, Vaultwarden specifically) somehow, and probably actually my Vaultwarden client too.

The rest of your concerns hypothesize a class of attacker I think borders on, but is perhaps not quite, nonexistent. I'm not really concerned about the super-skilled hacker, who is limited to only my vault as their attack vector, and apparently has very fresh if not zero-day vulns that they are willing to deploy against me and specifically me, only me, their payoff for their personalized and specialized hacking effort is just that they get specifically my (encrypted) vault and nobody else's. That is a very specific level[1] of interest in me this hacker, that is not defeated by my current setup, but is defeated by what you outline, has in me.

Edit: Actually what makes me the most nervous overall is compromises of the client, not the self-hosted server I run. For practical purposes 100% of my risk in this setup is there.

[1]: https://www.shamusyoung.com/twentysidedtale/?p=55166

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#58

Post by tjoff »

cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

The bigger risk is likely your client, which might even be inside your browser, gets hacked / compromised. And that is the same regardless if you self-host.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#59

Post by teekert »

patwoz wrote: post #46
cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

My vaultwarden server is behind a vpn, so I just don't need any security measurements at all :)

Yeah, so nice to just have it on the tailnet as https://vaultwarden

That said, I got a Proton family account and switched, in Proton Pass it is much more intuitive and easy to share with family (just say: share this folder with that fam member, read or read/write), since you don't need the whole "Organizations" layer needed in Bit/Vaultwarden (which also has it's ups, I know). Happy to report that Vaultwarden exported everything nicely to .json and importing into Proton Pass was flawless.

I also find Proton Pass to be a bit more helpful in associating urls with credentials, + I now use the 1 alias per login (each credential set has a unique email address) without any effort, Vaultwarden can't do that (yet? Although seems complicated to implement), only (paid) Bitwarden I guess.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#60

Post by spiffytech »

stavros wrote: post #41
flatline-84 wrote: post #39

My main issue with Vaultwarden is that there doesn't appear to be any way to migrate a Bitwarden self-hosted instance to it. I run a Bitwarden server for myself and something like 5-10 family & friends so manually migrating everyone's data is tough. I'd really love to try Vaultwarden as Bitwarden is pretty heavy on the little server it runs on

Isn't it just exporting/importing the data for each account?

Bitwarden's Vault export will not include attachments.

I think there's a third party tool that will dump everything.

Post reply on HN