Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

81–90 of 162 posts

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#81

Post by viro »

sneak wrote: post #58
ryan29 wrote: post #53

Earlier quoted context omitted.

What other options would there even be for updates? That bug report describes every updater I've ever seen.

You are misunderstanding the issue. It's not asking before the update (as most programs that prompt you to update do). By the time that dialog box is displayed, the application has already replaced itself on disk (with code chosen arbitrarily by the bitwarden developers, or anyone in possession of their credentials), and the new code will be executed automatically without user intervention the next time the app is la…

This is NOT a RCE. Would you like me to list all of the software that does this exact thing? Chrome, Brave, Discord are some of the biggest. Nearly all electron based apps that autoupdate.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#82

Post by fencepost »

vbezhenar wrote: post #19
throwaway8581 wrote: post #18

Earlier quoted context omitted.

Because of the way bitwarden works, I think as long as the client is secure, compromise of the server is not a major concern except for data loss. Your vault is encrypted client-side. The real threat is that someone takes control of the bitwarden browser extension and pushes a malicious update.

> The real threat is that someone takes control of the bitwarden browser extension and pushes a malicious update. That's why I don't use any KeePass extensions. I just don't trust browser enough to be able to get any of my passwords. I'm thinking about writing my own extension which will communicate with KeePass in a way that suits me (basically: when I'm pressing button in browser, it'll popup KeePass window with se…

I think there's a relevant xkcd about this, though technically it's about standards.

I'd absolutely use KeePass for a long term storage password vault (with appropriately obscure reminders so I could recall the password), but the ecosystem of many unofficial free implementations for integration into browsers, phones (IIRC), etc. makes me twitch.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#83

Post by rubatuga »

AnIdiotOnTheNet wrote: post #77

My company used to use the unmaintained "CorporateVault", but switched to Bitwarden_rs after Flash (which CorporteVault used for copying to the clipboard) was deprecated. Bitwarden_rs was chosen because it had a relatively painless install compared to pretty much everything else I looked at, requiring only one Docker container. It's not bad.

You don’t even need docker if you build from source

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#84

Post by pavon »

jamienicol wrote: post #71
FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.

My self-hosted bitwarden server is only accessible from the LAN. Since the full password database is cached locally on each client, you can use it to lookup existing passwords just fine without a connection to the server. Bitwarden does require a connection to the server to add passwords, as it isn't a distributed architecture, so this setup does prevent you from adding new passwords while you are out and about, but I don't have the need to do that often, and in the rare occasions when I do, I write them on scrap paper in my wallet till I get home.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#85

Post by AnIdiotOnTheNet »

rubatuga wrote: post #83
AnIdiotOnTheNet wrote: post #77

My company used to use the unmaintained "CorporateVault", but switched to Bitwarden_rs after Flash (which CorporteVault used for copying to the clipboard) was deprecated. Bitwarden_rs was chosen because it had a relatively painless install compared to pretty much everything else I looked at, requiring only one Docker container. It's not bad.

You don’t even need docker if you build from source

Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#86

Post by Nextgrid »

jamienicol wrote: post #71
FlyingSnake wrote: post #64

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.

My concern about this is less about making it secure but keeping it secure. Zero-day vulnerabilities are a thing and you can never be 100% safe against those, so the next best thing is to have good monitoring in place so you get alerted when something nefarious is going on. This unfortunately requires 24/7 monitoring that's better left off to a dedicated team.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#87

Post by indigo945 »

pavon wrote: post #84
jamienicol wrote: post #71

Earlier quoted context omitted.

Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.

My self-hosted bitwarden server is only accessible from the LAN. Since the full password database is cached locally on each client, you can use it to lookup existing passwords just fine without a connection to the server. Bitwarden does require a connection to the server to add passwords, as it isn't a distributed architecture, so this setup does prevent you from adding new passwords while you are out and about, but…

For home use, and to a limited extent - when all your users are proficient - for corporate use, I really enjoy pass (https://www.passwordstore.org/). It has a decentralized architecture where passwords are synchronized via git, making it excel at situations where you need to generate or store secrets on the go. Unfortunately, the Windows client is not stellar, and the (unofficial?) Android app doesn't seem to have an option to encrypt secrets using more than one key, limiting its use for most teams.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#88

Post by denysvitali »

AnIdiotOnTheNet wrote: post #85
rubatuga wrote: post #83

Earlier quoted context omitted.

You don’t even need docker if you build from source

Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.

It really depends. Go and Rust softwares are generally easy to build from source

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#89

Post by smoldesu »

AnIdiotOnTheNet wrote: post #85
rubatuga wrote: post #83

Earlier quoted context omitted.

You don’t even need docker if you build from source

Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.

Rust is designed to be built from source, and the development toolchain is light enough to keep on a VPS if that's your bag. If you have Cargo installed, compiling and installing from source is easier than using NPM.

Re: Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

#90

Post by kayson »

malsanton wrote: post #2

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

I had the same concern. There's also the matter of supporting upstream development, which the maintainer does address in his readme. I ended up paying for a premium subscription of vanilla Bitwarden, which I self host. Sure it's overkill on resources and number of containers, but it's still insignificant. It seems slightly more safe to trust a company that depends on the software for revenue, if I'm going to use it without auditing the source. I've also e-mailed their support quite a few times, and they're great. It just doesn't feel right to me to do that while using a free custom backend to avoid the cost...
Post reply on HN