Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

71–80 of 162 posts

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#71

Post by jamienicol »

FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#72

Post by mnutt »

foepys wrote: post #41
mnutt wrote: post #13

Earlier quoted context omitted.

This is the use case that something like sandstorm.io tries to solve, by locking down system calls on the backend and (slowly but surely) CSP on the frontend. I don’t think BitWarden has been ported yet, though.

Is sandstorm active again? A few years ago there was some news about the company behind it running out of money and abandoning the project if I remember correctly.

It transitioned to a community project and is active again. The original contributors are still involved, just to a lesser degree.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#73

Post by UncleMeat »

teekert wrote: post #63
sneak wrote: post #51

Earlier quoted context omitted.

https://github.com/bitwarden/desktop/issues/552

Ah yes, the trust-the-developers-blindly vs patch asap vs supply chain attack risks. I wonder if we have any data on what is best. I once had to re-do a Drupal install because it was very likely already being abused. Would have liked immediate auto-update in that case. Ah well.

It isn't universal, but browsers surely provide a good case study here. Most of them auto-update today. In the past, exploitation via bugs where patches existed but people didn't update was measurably common. Supply chain attacks against autoupdating browsers haven't really materialized.

If the goal is to prevent the most volume of exploitation, autoupdaters clearly win.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#74

Post by teekert »

sneak wrote: post #69
teekert wrote: post #63

Earlier quoted context omitted.

Ah yes, the trust-the-developers-blindly vs patch asap vs supply chain attack risks. I wonder if we have any data on what is best. I once had to re-do a Drupal install because it was very likely already being abused. Would have liked immediate auto-update in that case. Ah well.

Password managers and OSes are things that I do not want automatically updating at the whims of some remote/foreign party whom I have never met and is bound by a set of responsibilities and laws with which I am entirely unfamiliar. Network services open to the internet at large are a horse of a different color. Ultimately, though, they could just ask. Most users probably want autoupdate, and they can opt in to that i…

And yet you are using a product at the whims of some remote/foreign party whom you have never met and is bound by a set of responsibilities and laws with which you are entirely unfamiliar.

I get where you are coming from, but you clinking "update" in stead of the dev does not guarantee the safety of the update.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#75

Post by viro »

jamienicol wrote: post #71
FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.

I had to same thought so I put behind a VPN. a little less convenient. but WAY more secure

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#76

Post by yepguy »

jamienicol wrote: post #71
FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.

Just connect to it via wireguard or tailscale instead of exposing it to the entire internet.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#77

Post by AnIdiotOnTheNet »

My company used to use the unmaintained "CorporateVault", but switched to Bitwarden_rs after Flash (which CorporteVault used for copying to the clipboard) was deprecated. Bitwarden_rs was chosen because it had a relatively painless install compared to pretty much everything else I looked at, requiring only one Docker container. It's not bad.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#78

Post by nwah1 »

jarenmf wrote: post #59
holtalanm wrote: post #36

I switched to Bitwarden when LastPass changed their policy for multi-device users. I'm happy to say the transition was completely painless.

Same here. I switched from LastPass and I really like the UX more than LastPass. It is less intrusive and feels more polished and snappier.

The UX is actually kind of bad. I think it is electron-based, the menus are far from a work of art, and the folder management seems very primitive.

But that said, it is by far the best product despite this.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#79

Post by hojjat12000 »

koheripbal wrote: post #56
holtalanm wrote: post #36

I switched to Bitwarden when LastPass changed their policy for multi-device users. I'm happy to say the transition was completely painless.

Did you consider KeePass or one of the variants?

I'm using KeePass. On Linux, windows and android and Google drive to sync the database. it is a hassle. The graphics look terrible. And most of the times the keeweb plugin doesn't really work on Firefox and I have to copy paste the password. But I have been using it for a long time now and got used to it. The best thing about it is the plugin system. I would not suggest it, I think bit warden does all of this and is a lot more user friendly.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#80

Post by bri3d »

sneak wrote: post #58
ryan29 wrote: post #53

Earlier quoted context omitted.

What other options would there even be for updates? That bug report describes every updater I've ever seen.

You are misunderstanding the issue. It's not asking before the update (as most programs that prompt you to update do). By the time that dialog box is displayed, the application has already replaced itself on disk (with code chosen arbitrarily by the bitwarden developers, or anyone in possession of their credentials), and the new code will be executed automatically without user intervention the next time the app is la…

Sure, I see where you're coming from. I think your approach makes you come off as not very credible, though. Plus, it puts developers on the defensive and won't cause them to cooperate.

A simple "I'm not comfortable with code on my machine being updated remotely without my approval, because I believe an attacker could infiltrate the supply chain" explains the problem you're having more precisely and turns into a simple feature request (turn off the auto-updater - which is already possible, as documented in that thread!) rather than trying to convince an entire industry that a commonly accepted practice (installation of signed remote updates) amounts to 0day RCE by putting them on the defensive.

Post reply on HN