Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vaultwarden: Unofficial Bitwarden compatible server written in Rust

github.com

Post reply on HN
Print view View original

81–90 of 124 posts

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#81

Post by tracker1 »

tjoff wrote: post #58
cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

The bigger risk is likely your client, which might even be inside your browser, gets hacked / compromised. And that is the same regardless if you self-host.

+1 on this... With Bitwarden clients in particular, it's also the only place your data is running decrypted.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#82

Post by arghwhat »

rlpb wrote: post #56
MadnessASAP wrote: post #51

Earlier quoted context omitted.

Not to defend them, but it doesn't matter if a hosting provider does that. So long as you can sue them for your full damages when it goes wrong. That's the whole point of SaaS isn't it? We pay you to manage this, you manage it appropriately taking advantage of economies of scale, we sue the shit outta you if it goes wrong.

> So long as you can sue them for your full damages when it goes wrong. Generally, you cannot.

And to add to that: suing someone for damages does not undo any damage.

Your identity is still stolen, your private photos leaked, your company destroyed, etc.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#83

Post by tracker1 »

stavros wrote: post #3
tryfinally wrote: post #2

I've been self-hosting this for years now, works flawlessly.

Same, although in the end I figured I'll give BitWarden my money, as it's more than cheap enough.

Similar here... I also trust them to maintain their service slightly better than I trust myself to do so. I like supporting the project in general as well.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#84

Post by iknowstuff »

cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

For personal use, why bother with this instead of something like Strongbox syncing to a cloud drive?

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#85

Post by mox1 »

iknowstuff wrote: post #84
cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

For personal use, why bother with this instead of something like Strongbox syncing to a cloud drive?

Aye, this has worked very well for me. Keepass file stored on google drive. Can open on PC, iOS, Android, etc.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#86

Post by mdaniel »

davidee wrote: post #26

After being fed up with AgileBits' (1P's owner) shenanigans (hiding critical threads on their user forum, ignoring customer voices wilfully, being generally dismissive of criticism), I decided to give Bitwarden a try. I used it in conjunction with Vaultwarden for a year with the idea that I'd evaluate it as a family-wide replacement for 1P. In the end I went back to 1P. 1P does some things amazingly well. Here's the…

I am also firmly a "tags versus folders" person, since an AWS credential is both "aws" and "qa"

Also, I get a lot of mileage out of the Fastmail "masked email" integration with 1P

I also still run KeePassXC just for its GPG agent support, which 1P hasn't (and I suspect won't) supported. I think 1P is all-in on using SSH keys to sign commits, which yes, is one GPG use case, but come on

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#87

Post by tw04 »

davidee wrote: post #26

After being fed up with AgileBits' (1P's owner) shenanigans (hiding critical threads on their user forum, ignoring customer voices wilfully, being generally dismissive of criticism), I decided to give Bitwarden a try. I used it in conjunction with Vaultwarden for a year with the idea that I'd evaluate it as a family-wide replacement for 1P. In the end I went back to 1P. 1P does some things amazingly well. Here's the…

And yet they can’t do folders or nested tags, which makes it unusable for me. All those other features are useless when it can’t handle basic organization.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#88

Post by trallnag »

mox1 wrote: post #85
iknowstuff wrote: post #84

Earlier quoted context omitted.

For personal use, why bother with this instead of something like Strongbox syncing to a cloud drive?

Aye, this has worked very well for me. Keepass file stored on google drive. Can open on PC, iOS, Android, etc.

Do you backup your Google Drive?

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#89

Post by Barrin92 »

marcus0x62 wrote: post #49
cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

You’re really, really sure your hosted provider does all of that correctly, right?

The vault is client side encrypted so it doesn't actually matter. My host provider could be the robot devil living in North Korea and it wouldn't matter, that's literally the defined purpose of encryption, secure communication across adversarial channels.

I don't really understand why people bother with this security theater, all the self hosting is completely redundant.

Re: Vaultwarden: Unofficial Bitwarden compatible server written in Rust

#90

Post by [deleted] »

cyrnel wrote: post #40

When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…

[deleted]
Post reply on HN