Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vaultwarden: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

61–70 of 124 posts

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#61

Post by teekert »

darthrupert wrote: post #23

I have successfully used this for some time, but migrated away to just pass because synchronizing a pass "db" with syncthing tends to work much better.

I switched away from KeePassXC because I kept having sync issues with the DB :). Could have something to do with the way I work (always several PC on/active and my own NextCloud install with issues from time to time...). Vaultwarden never had any sync issues. I guess because changing one login will give you 2 versions of the entire database when a conflict occurs, for Vaultwarden, it's just that one credential, which hardly ever happens.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#62

Post by troyvit »

llamaimperative wrote: post #53
MadnessASAP wrote: post #50

Earlier quoted context omitted.

An important part of security is threat assessment and worst case analysis. If the cost of your security policy is greater then the cost of a worst case compromise then you are probably over investing in security. With that in mind, does your policy seem appropriate to a user securing their Facebook password? Or their homelab service accounts? *Cost in this case being the combination of literal currency and subjectiv…

Is that the type of thing that people self-hosting a password management server are trying to secure? In that case, it's extra silly. Is the cost of setting this up and maintaining it at all worth securing your Facebook password?

For me it is worth it to host a password manager for me and my family, although I just did a one-click install on Digital Ocean (using Bitwarden, not Vaultwarden ... so far).

To me (and I'm pretty ignorant about this stuff), the biggest weakness of a password manager is that it's the one link in a chain that somebody needs to break to have all of my passwords. Hosting that at bitwarden.com or lastpass.com or whatever makes it an even sweeter target because those are known targets. At least self-hosting makes it more difficult for somebody else to find my password manager.

Moving to Vaultwarden has its complications but it would also be fun, and maybe a cool project for the kids. And like you say, if we screw up and they lose their instagram password they won't even remember the pain once they've all grown up and the world is a dystopian nightmare of climate catastrophes, wars, etc. They'll be busy looking for the fattest grubs to eat.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#63

Post by stavros »

spiffytech wrote: post #60
stavros wrote: post #41

Earlier quoted context omitted.

Isn't it just exporting/importing the data for each account?

Bitwarden's Vault export will not include attachments. I think there's a third party tool that will dump everything.

Oh wow, that's inconvenient, even for backups (instead of migrations).

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#64

Post by adamtaylor_13 »

number6 wrote: post #54
cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

My setup is this: drop all traffic except 80 and 443, autoupdate, Backup the Container-Volumes to Backblaze with restic. I got hacked less often than 1Password or Okta, so I guess I am on par with the professionals, afaik (I give you that) :)

You posed it as a joke, but it's quite true: the "real deal" professionals get hacked frequently. Doing the barebone basics will protect you from 99% of the crap out there.

As another poster mentioned, if some state-based actor gets interested in me, I'm hosed no matter what.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#65

Post by criddell »

cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

I wouldn't use this because six months from now this very well meaning developer may sell the company to a buyer who ends up being less scrupulous. You're one update away from losing control of your entire digital life.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#66

Post by skinner927 »

MadnessASAP wrote: post #51
marcus0x62 wrote: post #49

Earlier quoted context omitted.

You’re really, really sure your hosted provider does all of that correctly, right?

Not to defend them, but it doesn't matter if a hosting provider does that. So long as you can sue them for your full damages when it goes wrong. That's the whole point of SaaS isn't it? We pay you to manage this, you manage it appropriately taking advantage of economies of scale, we sue the shit outta you if it goes wrong.

I’m sure you signed an arbitration agreement

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#67

Post by zaggynl »

How does the Bitwarden client handle loss of connection to the Bitwarden or Vaultwarden server?

Last I checked the local cache is gone after so many days, leaving you without your credentials.

A combination of local password manager and a file sync service of your preference seems a good option as well.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#68

Post by _heimdall »

cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

I don't currently self-host Vaultwarden, though I do have quite a few services running on my home server.

I lean on Tailscale to avoid exposing the server to the public internet. That doesn't handle the backup and restore concern, but unless I'm missing something I should be pretty well mitigated on network security issues since I avoided firewall and port configuration all together.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#69

Post by giancarlostoro »

zaggynl wrote: post #67

How does the Bitwarden client handle loss of connection to the Bitwarden or Vaultwarden server? Last I checked the local cache is gone after so many days, leaving you without your credentials. A combination of local password manager and a file sync service of your preference seems a good option as well.

Fun story, I booted up a Windows 8 tablet I had not touched for years. I looked at Firefox, and noticed my long lost LastPass, which I lost the vault for... I logged in offline, and wouldn't you know it, I was able to see all my (mostly useless by now) passwords, going back 10+ years.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#70

Post by chx »

aborsy wrote: post #52

Vaultwarden is impressive. Years of work without issue. It supports Yubikey now. Eventually, I ended up using Pass though, since I prefer terminal. Pass doesn’t have any database to break: it’s just gpg and git. With Yubikey, every password needs a touch.

I moved from Pass to Bitwarden so https://github.com/chx/ykgodot is abandoned but you still might find it useful.
Post reply on HN