Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

61–70 of 162 posts

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#61

Post by michaelt »

Black101 wrote: post #33
Spivak wrote: post #26

Earlier quoted context omitted.

Bitwarden has a CLI tool which is pretty good.

what I mean is that why do you need bitwarden at all?

There are many other options for password management that are very similar.

Writing them down in a notebook next to your computer. A homebrew system like e-mailing GPG-encrypted files to yourself. Your browser's built in password saving and sync features. A password-protected Excel spreadsheet on your dropbox.

Compared to a notebook, I can access my passwords from my phone if the need arises, and they're encrypted and backed up should I lose my phone.

Compared to a homebrew system, someone else has done the work and made a cross-platform system with nice browser extensions, sensible defaults, and so on.

Compared to my browser's sync features, there's peace of mind because it's not a free feature from a corporation famous for nonexistent customer service and sketchy tracking practices.

Compared to dropbox, the price is trivial (as they only have to store a few kilobytes of data) and it's focused on security.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#62

Post by ClumsyPilot »

jillesvangurp wrote: post #42
malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

You are in control here. It's like every other bit of software you run yourself: it's your problem to do it properly. 1) if you worry about people replacing the docker image you are using, build your own. It's not hard. Alternatively, use a specific version of the docker image by specifying the version or the hash (if you are really paranoid). Of course after you review the Dockerfile. Minimum at least glance through…

"3) if you don't trust the OSS code, audit it or at least look through it. That's the whole point of OSS."

Thats an outright fantasy, every day I rely on like 50 pieces of software written in 20 different languages and frameworks. They are updated multiple times a month. How many man hours would it take? 1000 a week?

Proffesional developers couldn't find heartbleed for years, you really think anyone would notice a hidden backdoor in software like this withing a year?

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#63

Post by teekert »

sneak wrote: post #51
teekert wrote: post #49

Earlier quoted context omitted.

Any more information on your claims? This is the first time I hear of this...

https://github.com/bitwarden/desktop/issues/552

Ah yes, the trust-the-developers-blindly vs patch asap vs supply chain attack risks. I wonder if we have any data on what is best.

I once had to re-do a Drupal install because it was very likely already being abused. Would have liked immediate auto-update in that case. Ah well.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#64

Post by FlyingSnake »

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly.

The peace of mind in having all your sensitive data under your control is totally worth it.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#65

Post by FlyingSnake »

koheripbal wrote: post #56
holtalanm wrote: post #36

I switched to Bitwarden when LastPass changed their policy for multi-device users. I'm happy to say the transition was completely painless.

Did you consider KeePass or one of the variants?

I use KeePass on one of my projects and I find Bitwarden much better than KeePass. We're moving to Bitwarden soon to keep it seamless across teams.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#66

Post by ClumsyPilot »

Philip-J-Fry wrote: post #38
eeZah7Ux wrote: post #31

Earlier quoted context omitted.

Unfortunately fragmenting the opensource ecosystem with too many implementations harms it.

No it doesn't. People are free to pick the best implementation to suit their needs.

When all implementations are half-assed and none of them do it properly. However they have plenty of flamewars and ideological arguments #LinixDesktop

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#68

Post by chrismorgan »

fraktl wrote: post #11

I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach ou…

I run bitwarden_rs for my own passwords because I want to run my own stuff for anything like passwords. (Previously I used KeePassX, and my biggest issue with it was that it was mostly tied to one device, depending on whatever file-based sync you might set up, and I never did—barring backups—so it was only ever on my main laptop, not on any secondary laptop or phone unless I jumped through some hoops to use one of the backups.)

I don’t run the official Bitwarden server because its system requirements are much too high for my liking.

Meanwhile, bitwarden_rs uses ~24MB disk space, ~24MB RAM, and Oh yeah, one other practical reason I couldn’t/wouldn’t go with bitwarden.com’s free plan: I’ve got a few TOTP things in my vault, gotta pay for that.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#69

Post by sneak »

teekert wrote: post #63
sneak wrote: post #51

Earlier quoted context omitted.

https://github.com/bitwarden/desktop/issues/552

Ah yes, the trust-the-developers-blindly vs patch asap vs supply chain attack risks. I wonder if we have any data on what is best. I once had to re-do a Drupal install because it was very likely already being abused. Would have liked immediate auto-update in that case. Ah well.

Password managers and OSes are things that I do not want automatically updating at the whims of some remote/foreign party whom I have never met and is bound by a set of responsibilities and laws with which I am entirely unfamiliar. Network services open to the internet at large are a horse of a different color.

Ultimately, though, they could just ask. Most users probably want autoupdate, and they can opt in to that if they so desire. It's really a matter of consent, and forcing decisions down users' throats.

Most people probably don't understand or believe that they are granting these applications' vendors permanent remote access to their computer.

Honestly, I wish it were only a matter of trusting the developers. Unfortunately, it's a matter of trusting the developers, anyone from anywhere in the world who can compromise their keys/credentials, and anyone in meatspace who can coerce them to misuse those keys/credentials (such as military, police, et c). That, it turns out, is a rather large set of people, especially when you factor in the number of state level actors from every country big enough to have an intel agency sufficiently competent to own some small software house full of c# weenies running windows (the bitwarden devs).

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#70

Post by paulryanrogers »

malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

You could restrict its network access to only your LAN. Though in that case you could only sync within your LAN.
Post reply on HN