Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

novamostra.com

Post reply on HN
Print view View original

71–80 of 93 posts

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#71

Post by zikduruqe »

nordsieck wrote: post #41
bm3719 wrote: post #9

This is an interesting tech stack, but seems heavy-handed for managing such a small amount of raw data (the l/p list itself). My solution for the past 14 years has been a simple GPG-encrypted org-mode (text) file. I can get to a password multiple ways from any device. The main way I check one is to open the file in Emacs which prompts for the master password via pinentry. You could also use a keyfile. Usually I just…

> My solution for the past 14 years has been a simple GPG-encrypted org-mode (text) file. Have you ever taken a look at pass?

Pass synced to a bare git repo at home... via WireGuard of course. Same dev.

Also look at Passage which uses Age encryption.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#72

Post by sorcix »

This article is using Vaultwarden, not the Bitwarden server. It's wrongly referring to Vaultwarden as "BYOPM hosts a Bitwarden instance" and "the Docker Image of Bitwarden." It is not, it is hosting a Vaultwarden instance. This is an issue as people using Vaultwarden report bugs to the Bitwarden project, where they can't be helped.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#73

Post by orangepurple »

So many commenters here are running air gapped solutions on a dedicated device. What's your backup story? How quickly can you add a new entry?

It just seems like a HUGE hassle and risk of data loss compared to the classic KeepassXC + Syncthing burrito.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#74

Post by bee_rider »

qwerpy wrote: post #57
zmxz wrote: post #46

Earlier quoted context omitted.

What happens when there's more than you who uses the Keepass file and how do you store new passwords to the file when you create new accounts on the web (for various services)? What's the usage flow? Is there browser extension that allows you to interact with it without opening Keepass program? Maintenance you described is easy, but what about the actual usage and sharing passwords?

Good questions and I think they show some of the blind spots I have. I don't share my passwords database. Right now my wife and I do have a very limited number of shared accounts but I set up the same system for her and we simply duplicate the few shared logins we have in our two databases. This could be an issue if we need to share more. Creating new accounts is easy. Both my windows and iOS Keepass clients open the…

Oh, that's neat. What iOS app do you use? I've been using minikeepass but it has been no longer supported for a while now (I've got a copy of the .kdbx for my phone elsewhere, so when it eventually self-destructs I'll still have that at least).

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#75

Post by lotsofpulp »

bee_rider wrote: post #74
qwerpy wrote: post #57

Earlier quoted context omitted.

Good questions and I think they show some of the blind spots I have. I don't share my passwords database. Right now my wife and I do have a very limited number of shared accounts but I set up the same system for her and we simply duplicate the few shared logins we have in our two databases. This could be an issue if we need to share more. Creating new accounts is easy. Both my windows and iOS Keepass clients open the…

Oh, that's neat. What iOS app do you use? I've been using minikeepass but it has been no longer supported for a while now (I've got a copy of the .kdbx for my phone elsewhere, so when it eventually self-destructs I'll still have that at least).

I use Strongbox, with Keepass databases stored in iCloud. One for me, one for wife, and one for both of us for mutual accounts. Periodically they are backed up to a USB drive to store with important documents. And Time Machine backs them up regularly to NAS.

We also use macOS/iOS keychain for convenience, but the TOTP and other notes about the account are stored in Keepass database.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#76

Post by patmorgan23 »

sorcix wrote: post #72

This article is using Vaultwarden, not the Bitwarden server. It's wrongly referring to Vaultwarden as "BYOPM hosts a Bitwarden instance" and "the Docker Image of Bitwarden." It is not, it is hosting a Vaultwarden instance. This is an issue as people using Vaultwarden report bugs to the Bitwarden project, where they can't be helped.

Yep, it's a bitwarden compatible vault but is not bitwarden

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#77

Post by bityard »

zmxz wrote: post #46
qwerpy wrote: post #42

I've seen so many interesting password manager solutions over the years, but I have yet to move away from a Keepass file hosted on cloud storage. I can read and write to it using apps from every device I use: windows and linux PCs, iOS and Android devices. The file is versioned so accidentally clobbering it isn't a concern. There is zero maintenance, and if my home server goes down my passwords are unaffected. If I'm…

What happens when there's more than you who uses the Keepass file and how do you store new passwords to the file when you create new accounts on the web (for various services)? What's the usage flow? Is there browser extension that allows you to interact with it without opening Keepass program? Maintenance you described is easy, but what about the actual usage and sharing passwords?

I have a personal Nextcloud instance set up on a VPN. We have a "shared" keepass file that is shared between the two of us, and individual one for each of us, which is not shared via Nextcloud but still syncs to Nextcloud to have available on our computers/phones.

This has worked great for us for a number of years.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#78

Post by patmorgan23 »

grepLeigh wrote: post #58

Great write-up, thanks for sharing this! One thing I would add: a self-signed certificate is not adequate for password transmission. In some ways, it's even worse than transmitting over clear-text http because it provides an illusion of security. Any actor on your network can man-in-the-middle, provide their own certificate, and you'd be none the wiser. I'd suggest provisioning LetsEncrypt leaf-node certificate on a…

Only if you blindly accept the cert. You can still check the thumbprint for what cert is being used.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#79

Post by GekkePrutser »

giobox wrote: post #67
GekkePrutser wrote: post #61

Earlier quoted context omitted.

IMO Letsencrypt is way too difficult to bother with for such scenarios: devices that are not open to the internet. The hassle of forwarding the ports for their verification and having to do it so regularly (3 months) is a real pita. I used to just pay for yearly certs for this reason but prices have gone up so now I'm back to using self signed. I'd love to set up my own PKI but the tool chain is so complex and many O…

Lets encrypt is staggeringly easy for devices that are not "open" to the internet - it supports or has plugins to manage ACME DNS challenge records fully automatically even for private IPs in your home network, and this is just one way to do it. Using letsencrypt to get valid SSL certs easily, automatically and for free for private IPs behind a NAT is something I love using it for! You never need to expose a webserve…

But still those ACME records need to be updated every time on my outside DNS server right? Or is it just a static record? That I can do, a dynamic one is very hard with my DNS provider (meaning I still need to do everything manually every 3 months which is not an option).

I also don't really like leaking internal network info in my external DNS provider which is why I run my own internal DNSes. And I use a domain for my internal network which does not really exist in the real world, I don't know if letsencrypt can handle this.

I have indeed not tried it recently, the last time I tried it it was about 1 year since they launched. Trying to script all the firewall rules to open the ports for a second was a real PITA.

I'll have a look at this, thanks for the heads-up.

Re: Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

#80

Post by GekkePrutser »

snapplebobapple wrote: post #62
GekkePrutser wrote: post #61

Earlier quoted context omitted.

IMO Letsencrypt is way too difficult to bother with for such scenarios: devices that are not open to the internet. The hassle of forwarding the ports for their verification and having to do it so regularly (3 months) is a real pita. I used to just pay for yearly certs for this reason but prices have gone up so now I'm back to using self signed. I'd love to set up my own PKI but the tool chain is so complex and many O…

you could use the dns authentication, just set the ip to the local one this box for the domain you own/will be always use then all you have to be able to do is hit external dns and letsencrypt to update the cert.

Ah but I use a personal TLD which does not really exist in the real internet. Can I still use letsencrypt with that?
Post reply on HN