Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vaultwarden: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

71–80 of 124 posts

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#71

Post by legacynl »

number6 wrote: post #55
llamaimperative wrote: post #53

Earlier quoted context omitted.

Is that the type of thing that people self-hosting a password management server are trying to secure? In that case, it's extra silly. Is the cost of setting this up and maintaining it at all worth securing your Facebook password?

We like to host stuff :) If I am faithful to myself I might be paying more than I would if I wouldn't self-host

You shouldn't feel bad about that, because that money isn't lost, you just used that money to buy enjoyment which is valuable as well.

And that is without even accounting for the amount of knowledge and experience gained by self hosting.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#72

Post by jameshart »

MadnessASAP wrote: post #51
marcus0x62 wrote: post #49

Earlier quoted context omitted.

You’re really, really sure your hosted provider does all of that correctly, right?

Not to defend them, but it doesn't matter if a hosting provider does that. So long as you can sue them for your full damages when it goes wrong. That's the whole point of SaaS isn't it? We pay you to manage this, you manage it appropriately taking advantage of economies of scale, we sue the shit outta you if it goes wrong.

Or, you might pay an insurance company to cover you for the risk - and so long as you have the right attestations from your SaaS providers, your insurer pays out in the event of a problem (and maybe goes after the SaaS if they feel the need to).

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#73

Post by hadrien01 »

Mattwmaster58 wrote: post #33
davidee wrote: post #26

After being fed up with AgileBits' (1P's owner) shenanigans (hiding critical threads on their user forum, ignoring customer voices wilfully, being generally dismissive of criticism), I decided to give Bitwarden a try. I used it in conjunction with Vaultwarden for a year with the idea that I'd evaluate it as a family-wide replacement for 1P. In the end I went back to 1P. 1P does some things amazingly well. Here's the…

> Bitwarden is slow, slow, slow Agreed. The good news is this is changing, they have native apps already in beta: https://bitwarden.com/blog/native-mobile-apps/ I'm using the Android beta and can confirm it's much faster.

I never found the mobile apps to be slow (they're "semi-native", made in Xamarin, in the same way React Native is "semi-native"). The Android integration is not great (it misses password fields sometimes) but this is because of the platform itself, not the current app architecture.

The Electron app (for desktop) and browser extensions are indeed slower than they could be, and native mobile apps won't fix that.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#74

Post by jerf »

zaggynl wrote: post #67

How does the Bitwarden client handle loss of connection to the Bitwarden or Vaultwarden server? Last I checked the local cache is gone after so many days, leaving you without your credentials. A combination of local password manager and a file sync service of your preference seems a good option as well.

If you care enough to run a personal Vaultwarden, you should care enough to back it up too. If you don't want to back it up, you probably shouldn't run it locally and just use the service.

I'm somewhat less crazy-eyes about the importance of backing things up properly than some people on HN can get. A lot of personal content I can honestly just accept the risk of losing it. However, if there is an exception to that, your password vault is it. It is possible to get yourself into a situation where you are completely locked out of things and the more systems go to harder authentication that you can't even store in your head like TOTP and hardware tokens the easier it gets to be in a world where if you lose your vault you can't recover because you can't even log in to the email account you'd use to recover.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#75

Post by deadbunny »

MadnessASAP wrote: post #51
marcus0x62 wrote: post #49

Earlier quoted context omitted.

You’re really, really sure your hosted provider does all of that correctly, right?

Not to defend them, but it doesn't matter if a hosting provider does that. So long as you can sue them for your full damages when it goes wrong. That's the whole point of SaaS isn't it? We pay you to manage this, you manage it appropriately taking advantage of economies of scale, we sue the shit outta you if it goes wrong.

> That's the whole point of SaaS isn't it?

Pretty sure the entire point of SaaS is that sweet recurring revenue.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#76

Post by ta1243 »

MadnessASAP wrote: post #51
marcus0x62 wrote: post #49

Earlier quoted context omitted.

You’re really, really sure your hosted provider does all of that correctly, right?

Not to defend them, but it doesn't matter if a hosting provider does that. So long as you can sue them for your full damages when it goes wrong. That's the whole point of SaaS isn't it? We pay you to manage this, you manage it appropriately taking advantage of economies of scale, we sue the shit outta you if it goes wrong.

The whole point of saas is someone the CTO can blame when things go wrong.

Doesn't matter if the downtime is higher, doesn't matter if there are more succesful attacks.

If a CTO goes in-house, they carry the risk. If they outsource it to a vendor, especially one with a Gartner report, they can play golf and not risk their bonus.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#77

Post by sunaookami »

criddell wrote: post #65
cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

I wouldn't use this because six months from now this very well meaning developer may sell the company to a buyer who ends up being less scrupulous. You're one update away from losing control of your entire digital life.

You can export your tresor

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#78

Post by phoronixrly »

cloogshicer wrote: post #5

I evaluated this for a small business but came to the conclusion that self hosting this security critical software would cost more in work hours for initial setup and maintenance than just paying the cloud fees for a few years. Genuine question, in what scenario is the self hosting setup and maintenance worth it?

I love open-source projects engineered in such a way as to deter exploitation for commercial use.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#79

Post by alyandon »

jerf wrote: post #74
zaggynl wrote: post #67

How does the Bitwarden client handle loss of connection to the Bitwarden or Vaultwarden server? Last I checked the local cache is gone after so many days, leaving you without your credentials. A combination of local password manager and a file sync service of your preference seems a good option as well.

If you care enough to run a personal Vaultwarden, you should care enough to back it up too. If you don't want to back it up, you probably shouldn't run it locally and just use the service. I'm somewhat less crazy-eyes about the importance of backing things up properly than some people on HN can get. A lot of personal content I can honestly just accept the risk of losing it. However, if there is an exception to that,…

  If you care enough to run a personal Vaultwarden, you should care enough to back it up too. If you don't want to back it up, you probably shouldn't run it locally and just use the service.
Exactly right. I have a script that briefly stops my Vaultwarden container and creates a .tgz of the contents of the data volume before restarting the container. The .tgz file gets copied off-site so I always have an accessible backup should my main host disappear.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#80

Post by scblock »

cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

When you post on HN, you also do the following, right?

- Build a straw man argument

- Act like all threat models are the same (distributed vs. centralized password store, for example).

Post reply on HN