91–100 of 124 posts
After being fed up with AgileBits' (1P's owner) shenanigans (hiding critical threads on their user forum, ignoring customer voices wilfully, being generally dismissive of criticism), I decided to give Bitwarden a try. I used it in conjunction with Vaultwarden for a year with the idea that I'd evaluate it as a family-wide replacement for 1P. In the end I went back to 1P. 1P does some things amazingly well. Here's the…
When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…
Based on that, the rest of your comment is useless fearmongering
When you all self-host this, you also do the following, right? - Create threat models that identify weaknesses in the design of your self-hosted setup. - Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering. - Deploy an intrusion detection system to know if you've been compromised. - Perform all OS and app patching automatically, or…
For personal use, why bother with this instead of something like Strongbox syncing to a cloud drive?
So the real question for me would be why not use KeePass, which is what I used before switching to Bitwarden. I switched because at the time, Bitwarden had better clients, better integration with Android and Firefox. That situation has changed some since, but I haven't had any good reason to switch back.
Unfortunatelly I had to move from Bitwarden after I realised it's sometimes impossible to unlock the password store without connection to server.
I evaluated this for a small business but came to the conclusion that self hosting this security critical software would cost more in work hours for initial setup and maintenance than just paying the cloud fees for a few years. Genuine question, in what scenario is the self hosting setup and maintenance worth it?
But self-hosting scales horizontally. If you already run one service that uses postgres or MySQL, the next service often won't add much of a burden.
For a lot of people, yeah, at present it makes no sense to get started. But the ability to get inertia, to carry the effort, can grow and grow into something really fierce. And even better, there are such good references & starting places out there today. Onedr0p's home-ops is a beautiful example (one among many) of investing hard on really good tools up front, so that the incrental cost of adding and managing new things is fantastically low. Years ago we would have to diy much of this, but today onedr0p can use well known community tools like Kubernetes, Flux ci/CD, gitops, and helm to get it done, to have other smart making the tools of self-hosting better for him. He's still the self hosting, but there's a sizable % of the engineering talent of the world helping to make his self hosting better & easier. That's pretty novel, and pretty excellent imo. https://github.com/onedr0p/home-ops
I've been self-hosting this for years now, works flawlessly.
My setup was based on their Docker images, and thinking it was the safest option I had set up Watchtower to automatically update to the latest image nightly to get the latest security patches. But then I discovered that the bitwarden-rs image had not been updated for _months_ because of the rename.
So basically I was hosting my whole password database in this, and I had suddenly lost security updates without realizing.
Btw, I'm not blaming neither Vaultwarden or Bitwarden. But if you're going to self-host something this security critical, just be sure that you definitely monitor it _manually_ to make sure you're not on some unpatched vulnerable version some months down the line.
Since Vaultwarden is gaining traction here, also check out this VERY active PR (including custom build/image) for adding SSO via OpenID Connect: https://github.com/dani-garcia/vaultwarden/pull/3899