What is the point of vaultwarden? Is it safer or less safe than using the bitwarden app/website? reddit / selfhosted ---------------------------------------------------------------------- Trashrascall · 2023-11-15 10:59 Not sure I understand why you'd want to self host a password manager. Bitwarden has never been breached AFAIK. How is it better or safer to keep if self hosted? ---------------------------------------------------------------------- Im1Random · 2023-11-15 11:08 It's not particulary better, but it's just fun hosting everythin you need on your own server. And you get all BW Premium features for free with Vaultwarden. ---------------------------------------------------------------------- Trashrascall · 2023-11-15 11:12 Ahhh I see that I like. Trying to figure out what to use an old pu 3b for but I just bought a year of bitwarden lol ---------------------------------------------------------------------- wryterra · 2023-11-15 11:14 Personally I stick with Bitwarden because one thing I want to stay around if I nuke (accidentally, or deliberately) my homelab is my password manager! ---------------------------------------------------------------------- r0zzy5 · 2023-11-15 11:15 That's what backups are for ---------------------------------------------------------------------- lucassou · 2023-11-15 11:18 As I understand, you have copies of your vault on your local devices so even if you nuke your vaultwarden or don't have internet access, you still have access to your password. And obviously you always need backups. ---------------------------------------------------------------------- g2g079 · 2023-11-15 11:24 If you're intentionally nuking your server, the backups probably need to go too. ---------------------------------------------------------------------- charmstrong70 · 2023-11-15 11:26 >Bitwarden has never been breached AFAIK. What you mean is it hasn't been breached \*yet\*. All commercial password managers have a huge, fuck off, target on their backs Nobody is going to come after some random blokes self-hosted password manager to get access to their Sonarr (I'm trivialising to make the point) as long if a similar effort would get them into Bitwarden. It's the same principal as bears in the wood - nobody needs to outrun a bear, just your companion ---------------------------------------------------------------------- hdddanbrown · 2023-11-15 11:27 Are you asking /r/selthosted what the point of selfhosting is? ---------------------------------------------------------------------- Trashrascall · 2023-11-15 11:31 OK, thanks for the solid answer. I suppose the core of my question was that pretty much: is it just as secure AND a less likely target than bitwarden. That makes a lot of sense to me. I would probably still worry about the strength of the code , though. Do we know if/how it's been audited? ---------------------------------------------------------------------- [deleted] · 2023-11-15 11:38 [deleted] ---------------------------------------------------------------------- RealmOfTibbles · 2023-11-15 11:39 I think you may be forgetting that Bitwarden has a self hosted version, it’s just really not commonly used with subs audience. Mostly as until recently they didn’t have a unified deployment and most people only want one container so that plus cost means most don’t use it. ---------------------------------------------------------------------- Croatwink · 2023-11-15 11:39 A lot of people prefer to take their security in their own hands. Enough people to make and maintain forks like these. ---------------------------------------------------------------------- Trashrascall · 2023-11-15 11:42 So would using their self hosted service mean if the main server was breached your passwords.would be safe? ---------------------------------------------------------------------- usrdef · 2023-11-15 11:46 It's good if you like self-hosting stuff. However, what I tell people is this: If you know jack about security and how to lock down a machine that is running Vaultwarden, then it's useless. You should go with Bitwarden. If you're looking to install it just to play around with, I would be very cautious about what you store there, unless you can lock the system down to where it's not accessible by the outside internet and localized only to your connection. And I have redundant backups in place in case one decides to fail, which are all encrypted with GPG and a few other measures. ---------------------------------------------------------------------- Im1Random · 2023-11-15 11:49 You can just import the Backups from Self Hosted directly into a regular Bitwarden Vault. ---------------------------------------------------------------------- autogyrophilia · 2023-11-15 11:50 The vault local copy stays around. You can export and import it back. ---------------------------------------------------------------------- sevlonbhoi1 · 2023-11-15 11:50 every device you use bitwarden has a local copy of all passwords. Even if you nuke your server, you still will have access to your passwords. The server is just use to sync changes. if there is no sync needed, you don't need the server. ---------------------------------------------------------------------- Im1Random · 2023-11-15 11:51 With Vaultwarden and the official Bitwarden self hosted service the passwords cannot be decrypted by the server unless somebody has your master password. ---------------------------------------------------------------------- Trashrascall · 2023-11-15 11:52 Great answer. Thank you v much. ---------------------------------------------------------------------- Silencer306 · 2023-11-15 11:53 Alright, what minimal security do you need to lock down your vaultwarden? Wireguard, firewall, fail2ban? I’m trying to learn good security practices for my server ---------------------------------------------------------------------- Exzellius2 · 2023-11-15 12:07 That’s correct. ---------------------------------------------------------------------- charmstrong70 · 2023-11-15 12:12 >OK, thanks for the solid answer. I suppose the core of my question was that pretty much: is it just as secure AND a less likely target than bitwarden. That makes a lot of sense to me. I would probably still worry about the strength of the code , though. Do we know if/how it's been audited? I mean, your best having a look at the official Git but, i'd say, access/visibility is the most important. Is it on your LAN/not open then even if it was less secure, it'd still be more secure if you know what I mean. I host mine on a VPS but it's behind traefik with authelia (and 2FA). Plan is to get fail2ban setup over the next couple of evenings. SSH is cert only, probably going to change the port too but not sure if that's really necessary. I'm comfortable exposing on that basis. ---------------------------------------------------------------------- Zeal514 · 2023-11-15 12:35 A few reasons. 1. Privacy, you control your data. It doesn't go to someone else's server to sit. 2. Security. It's on your server. Password managers are primarily targets for hackers, i don't want to name names, cause I'm not 100% sure of the name. But, one pw manager was hacked like 3x in the past year or something. It's on your server, you are less likely to be targeted for a huge data breach, and you get to manage your data. Not someone else who fucks up. 3. You can't be banned, or have the provider suddenly change access to the server, thus losing your data. I will name names here. MyQ garage door opener by Chamberlain suddenly removed the smart home integration, since the whole system ran on their servers. Removing the functionality users paid for. But they don't own it, so they just got fucked. Your data/service on someone else's server, is actually their data/service, you are just a visitor. ---------------------------------------------------------------------- Byolock · 2023-11-15 12:38 (Most) Offsite Backups are encrypted though, so useless, if you would have stored the decryption key in Bitwarden. I actually struggled quite a bit to defend the "Secret Zero Problem" and opted for a flash drive with a fingerprint reader to store the backup decryption key. Not ideal but the best I could come up with. The local Cache helps you in most cases. Though there could be a few cases, mostly natural disasters, where you could loose all your personal devices at once. For me the data In Bitwarden is highly critical data which I could not loose under any circumstances, so this small probability of loosing all devices with cache active at once ist unacceptable. ---------------------------------------------------------------------- Emiroda · 2023-11-15 12:39 Regulatory requirements and management decisions. Oh, you thought self-hosting was only for hobbyists? 🫠 ---------------------------------------------------------------------- solarsparq · 2023-11-15 13:09 This is definitely not true. Most users will likely rely on provider encryption. Playing around with private keys for backups is essentially Enterprise.... if you lose the keys, you are done.. goodbye data. I switched to Vaultwarden about a month ago after supporting Bitwarden for at least 4 years. I don't really need their services if they have a replica of it now. Good for them. I was a former LastPass user. Like many others have said... running a password manager for millions of people on the Internet is likely about as bad as being a bank... but not as bad as the Darknet. People need to understand backup/recovery if they are switching to Vaultwarden. ---------------------------------------------------------------------- solarsparq · 2023-11-15 13:12 I laughed at this. Tell people at parties you run Arch. I need new friends. Thank you for this. ---------------------------------------------------------------------- Lukebekz · 2023-11-15 13:29 I do enjoy hosting my own stuff and although Bitwarden also has an on- premise option, vaultwarden runs in a single container instead of ELEVEN. Also you can use your reverse-proxy of choice (Caddy for me) and aren't kind of forced to use nginx if you want to host anything else on the same server and your config isn't in danger anytime you update. ---------------------------------------------------------------------- Byolock · 2023-11-15 13:45 Choosing to host you password manager locally because of security considerations and then upload data to the cloud relying on provider promises about encryption doesn't make much sense to me to be honest. But sure if people do that, they don't have that backup problem. ---------------------------------------------------------------------- macrowe777 · 2023-11-15 13:56 The code is as good as bitwardens, and even better, everyone can see the code to review it's vulnerabilities and fix them. What is a major factor is you're far less likely to be of interest to a hacker. So whilst crunching numbers to crack bitwarden encryption may make some sense...it makes absolutely zero sense to spend that time to hack mine. ---------------------------------------------------------------------- _cdk · 2023-11-15 14:01 it’s going to be a lot easier to get past the self hosted system security and then access their vault information directly than bitwardens security and then also have to deal with the encrypted version of it ---------------------------------------------------------------------- ProbablePenguin · 2023-11-15 14:03 >Bitwarden has never been breached AFAIK Password managers are a HUGE target, and while I'm sure they do everything possible to prevent a breach from actually obtaining peoples passwords, vulnerabilities do happen. ---------------------------------------------------------------------- ProbablePenguin · 2023-11-15 14:05 Selfhosted is encrypted the same as using bitwarden.com But also an attacker would first have to find out that someone is self hosting, then break into their network and gain access to the bitwarden server, unless they're one of the crazy people that has bitwarden publicly exposed. ---------------------------------------------------------------------- Defiant-Ad-5513 · 2023-11-15 14:05 Also the vault is en/de crypted on device so the code never sees your passwords ---------------------------------------------------------------------- awildboop · 2023-11-15 14:07 change ssh port, put an ssh tarpit on the default ---------------------------------------------------------------------- g2g079 · 2023-11-15 14:07 Still brings delay while the authorities are at your door. ---------------------------------------------------------------------- _cdk · 2023-11-15 14:15 yes it's encrypted the same, but if an attacker is on the server that wouldn't matter for very long. OP asked if it's safer and who i replied to said that it is due to being less of a target which sure is technically true but if an attacker is coming after my vaultwarden vs the main bitwarden it's no contest ---------------------------------------------------------------------- Vogete · 2023-11-15 14:21 I agree. I trust Bitwarden more to host it than me. I can have too many things going wrong. With that being said, I do agree with the security implications with centralized Bitwarden, but I'd rather have that risk than to screw myself over due to my own incompetence. Someone a while ago mentioned on this sub: The best thing to host yourself is a password manager, and the worst thing to host yourself is a password manager. ---------------------------------------------------------------------- ProbablePenguin · 2023-11-15 15:04 Bitwarden encryption is done client-side, so the server just has the encrypted copy of the vault. Obviously still not ideal if someone has access, since they could in theory modify the web app to send the master password to them, or something like that. ---------------------------------------------------------------------- wryterra · 2023-11-15 15:27 >I'd rather have that risk than to screw myself over due to my own incompetence Yup, that's my reasoning too :D ---------------------------------------------------------------------- juanfdo82465 · 2023-11-15 15:45 Vote for bitwarden, i know i’m the minority based on this subreddits name, but the amount of effort, technical knowledge, time, offsite backups, maintaining all of it machine and vaultwarden updated as new exploits come out, and still never knowing if you did everything right and if you didn’t locking yourself out of tens to hundreds of accounts, doesn’t seem worth it when bitwarden is free for most things. Critical stuff is better of with a company whose whole business is that thing no amount of work i put in can compare to hundreds of engineers combined whose whole job it’s not getting hack ---------------------------------------------------------------------- juanfdo82465 · 2023-11-15 15:46 Vote for bitwarden, i know i’m the minority based on this subreddits name, but the amount of effort, technical knowledge, time, offsite backups, maintaining all of it machine and vaultwarden updated as new exploits come out, and still never knowing if you did everything right and if you didn’t locking yourself out of tens to hundreds of accounts, doesn’t seem worth it when bitwarden is free for most things. Critical stuff is better of with a company whose whole business is that thing no amount of work i put in can compare to hundreds of engineers combined whose whole job it’s not getting hack ---------------------------------------------------------------------- CabbageCZ · 2023-11-15 15:53 I might be in the minority here but a password manager is one of the last things I'd want to self-host, and I self-host a lot of things. Nobody is likely to come after you _specifically_, but there's a ton of automated port/vulnerability scanners, and if you're like many people in here running many containers with code written by hobbyists that likely hasn't ever been audited for security, there's a non- negligible chance your server can be compromised. Lots of popular self-hosted apps have had security vulnerabilities, and that's just the ones we know of. That huge LastPass breach was due to one of their developers self-hosting a Plex server, and Plex is a pretty high profile project with lots of people working on it as a job. Docker isolation also isn't perfect, there are container escape exploits, side channels etc. Then there's the manner of backups, losing your password vault because your backups silently failed would be catastrophic. Although that one is more of a solvable problem if you know what you're doing. One thing I was considering was using a separate low power box like a Raspberry Pi with just vaultwarden and a tunneling solution like Tailscale. Less chance of it being compromised if you forget to patch one of your for-fun containers like Mealie, Radarr or what have you. Or just get got by a 0day. ---------------------------------------------------------------------- Key-Negotiation-9069 · 2023-11-15 16:30 While I don't entirely disagree with you I want to point out that the LastPass breach was because a developer was using an OUTDATED version of Plex. The vulnerability that was used had been patched in newer versions. LastPass was breached and is audited regularly according to their website. So your logic of auditing being better is argued with your own example. As far as auditing in general I agree with you for the most part. Lots of these smaller service have little to impress me as far as being reviewed, but something like vaultwarden has 1.5k stars on github, and many self hosted services have more (nextcloud has over 20k. Sure none of those are likely to be companies, and not all of them are actually auditing but may just like the software, but it is likely that at least a small percentage of them are capible of auditing and have looked it over, and even a small percentage of 1.5k is still a decent amount of developers who review the code. That's kind of the whole point of Open-source. The open source commuity doesn't only include hobbies. It also includes professionals who work in large tech settings and actually know what they are doing. I'd rather use an open source password manager than one that is closed source with devs that use outdated software. So for me I self host but I am very picky about what services I host, and it's based either off of how many people support it, or off my ability to audit it myself (which is not many of them as I only hold 3 computer science degrees). ---------------------------------------------------------------------- Key-Negotiation-9069 · 2023-11-15 16:38 It's incredibly easy to backup vaultwarden. I copy my vault to a second hard drive weekly. I got lucky and have a close friend that self hosts so we also encrypt and upload some of our backups to each other so that even if my whole lab went down and was unrecoverable I could still rebuild off the backups he stores. Basically we give each other about 1TB (without actual quotas, just based on honesty). So we are both able to store a large amount of backups, and if he wants more on my server he just needs to get me another hard drive, and same the other way around. I've heard of people who encrypt their backups and upload to Google, but to me this defeats the purpose of self hosting (and even if it didn't I think Google would be the last service I uploaded backups to but to each their own). If your encryption is strong enough it is a decent option for people who don't have another self hosted in their community like me. ---------------------------------------------------------------------- devcircus · 2023-11-15 16:40 For me, I just enjoy selfhosting things that I can. In addition to vault warden, I have about 30 other services. Some rarely used, but I've learned so much about creating, maintaining, updating, and hardening servers; how containers work, vms, networking, etc. If selfhosting isn't enjoyable for you or you don't have time for the upkeep, or if you're satisfied with bitwarden in the cloud, stick with it. They have a great service and it does seem to be a bit safer than some of the other services. Personally, I like the work that ProtonVPN is doing. They have a password manager that is still in the early stages but has a lot of promise. ---------------------------------------------------------------------- Key-Negotiation-9069 · 2023-11-15 16:43 This is one of the most logical comments I've seen in a bit. I self host, but I have a strong backup system that includes another self hoster so the likely hood of both of our labs going down is slim. Not everyone has that option and without it I might take the risk of a centrally hosted password manager. Self hosting is a lot of weighing the risks, and it does come with some. ---------------------------------------------------------------------- Key-Negotiation-9069 · 2023-11-15 16:45 Yes ---------------------------------------------------------------------- Key-Negotiation-9069 · 2023-11-15 16:45 I was going to ask this. ---------------------------------------------------------------------- Key-Negotiation-9069 · 2023-11-15 16:53 Where as I prefer the thousands of contributes on github. BUT you need to know what you are doing to set it up properly. Self hosting isn't for everyone, and that's an important point to make especially with something like vaultwarden. People think because it's so easy to spin up a docker container they don't need to do anything else, and gain a level of false confidence. If you don't know what you are doing it can definitely cause you more harm than good. That being said vaultwarden is quite easy to setup if you know a thing or two about security, and backups are even easier. As far as maintaining I set mine up two years ago. It auto updates and I've never had an issue. ---------------------------------------------------------------------- CabbageCZ · 2023-11-15 16:59 Yeah, I used the plex example mainly as an illustration of one vulnerable service you're hosting being a potential vector to have the rest of your server compromised. Plex itself seems to be alright if you're keeping it updated, but not every service will be. Let's take jellyfin for example. I'm a huge fan a long-time user of jellyfin. In terms of activity, it's got 26k stars on github, about 20x as much as vaultwarden, and a lot more than a smaller but still popular project like Mealie. [CVE link](https://www.cvedetails.com/vendor/22884/Jellyfin.html) - Just in 2023, JF has had 4 XSS vulnerabilities and an arbitrary filesystem traversal vulnerability. One of the XSS vunlerabilities was pretty bad, and we don't know how many more there are. There's a [separate issue](https://github.com/jellyfin/jellyfin/issues/5415) tracking security issues in Jellyfin most of which haven't been adressed yet, although none of them are as bad as the published CVEs, to my knowledge. Working on open-source is a thankless job and I have a lot of respect for the devs, but it's a sign that when self-hosting smaller projects you really can't be too careful, and metrics like 1.5k stars on github really doesn't tell you much in terms of security. If you actually have the time and energy to audit most of the services you're hosting line by line, props. I don't nearly have the time to do that , and I'd wager the vast majority of people don't. And I've seen enough long-unspotted vulnerabilities in open source projects that it just having source available and a decent amount of activity doesn't really give me a lot of confidence that it doesn't have major vulnerabilities. But maybe I'm just cynical. I still use a lot of these services - I just try to be careful and assume that there's a decent chance my homelab will be breached one day. ---------------------------------------------------------------------- OkOk-Go · 2023-11-15 17:05 The two things I refuse to self host are email and the password manager. If my server is down for whatever reason, I have no access to anything, not even my bank. Even with backups, if you lose the service even for a few hours, you are screwed until you go home and fix it. It doesn’t have to be a targeted attack, any generic DoS or Linux ransomware can mess things up. For email, it’s a hassle getting out of blocklists. And the availability has to be perfect, I don’t want to miss an important email. ---------------------------------------------------------------------- Key-Negotiation-9069 · 2023-11-15 17:34 "I just try to be careful and assume that there's a decent chance my homelab will be breached one day." I 100% agree with this logic, and have an overly complex network because of this, but am always aware of the possibility. As for the other parts I think we are walking the same line. Maybe the other side of the line, but our logic is not as far off from each other as some others in this sub. I personally don't like Jellyfin because it seems to have a fair amount of issues, but talking more generically about issues being tracked. Would it be better to use a service that is actively tracking issues and trying to fix them (but attackers can find them publicly too)? Or one where you can't see the issues (and can't prepare for the possibility because of this). I don't have an answer for that as it depends on the service and the specific issues, but there are pros and cons beyond my examples to both. That being said there are plenty of non self hosted services that have active CVEs. Bringing up Jellyfin vs Plex brings up the point of doing actual research. Before opening any service to the internet you need to do valid research (that doesn't just include asking reddit which is easier to setup) otherwise you are 100% risking your security. In the end it comes down to what makes you comfortable with your understanding of security is. Not everyone should self host as outlined in one of my other replies to a different comment in this thread. There is a strong level of false confidence that comes from the ability to spin up a couple docker containers and have your own "cloud", but security isn't embedded in all these services to the point where these are all secure. You've got a good head on your shoulders with the points you brought up and the ways you countered mine, and I appreciate that you make some actual points rather than just stomping around like a child like some redditors do. I hope your comments get viewed by some of the new hobbies self hosters who don't realize all of the points you've made. Specifically bringing up the CVEs and issues vs stars (as I said I feel a lot of stars are simply showing they like the software vs actually reviewing it). ---------------------------------------------------------------------- tech2but1 · 2023-11-15 17:38 Whilst I have pretty much everything backed up where I can the only things that I have actually got 100% tried and tested recoverable is Hyper Backup (as it encrypts my B2 backup) and within that is my Vaultwarden backup. So even if my lab was destroyed tomorrow I could get to my B2 backup and recover the Vaultwarden backup and stand it up on any machine I could get access to. I am not very good at the local backup thing but I do also have an unencrypted backup that is run less regularly that I could easily grab the Vaultwarden files from. In addition to that the vault is accessible locally if it can't communicate with the server anyway. ---------------------------------------------------------------------- SamSausages · 2023-11-15 17:39 Can be safer. Can be worse. A poorly configured self hosted vaultwarden can be a major security issue. A properly configured one is arguable safer than hosting with a 3rd party. Lastpass taught me that one. ---------------------------------------------------------------------- Key-Negotiation-9069 · 2023-11-15 17:43 The fact that you got a downvotes for this kind of proves your point too. For the record I up voted because I agree with you for the most part. ---------------------------------------------------------------------- tech2but1 · 2023-11-15 17:45 Reverse proxy is a simple first step, not going to get everything exposed to port scanning and simple vulnerabilities there. In addition to that, whilst I have real issues with using *only* a reverse proxy I figured more security couldn't hurt so I switched from just a Mikrotik router to OPNsense with CroedSec for added protection. You can also do IP filtering and other little things if you only need to access things from your home country etc. The reason for this is I use Vaultwarden as part of a family suite of services, so trying to get everyone to use VPN's from every device would be a nightmare! ---------------------------------------------------------------------- tech2but1 · 2023-11-15 17:46 The password vault is available locally/offline. ---------------------------------------------------------------------- CabbageCZ · 2023-11-15 17:49 Yeah, I think we're mostly in agreement, aside from things that ultimately come down to personal preference and tolerance for risk. Thanks for being civil about it too - always nice to have a conversation instead of an internet argument. :) ---------------------------------------------------------------------- Key-Negotiation-9069 · 2023-11-15 17:56 This is the main downside of self hosting in general as far as I'm concerned. My friends lab recently went down while he was at work and it definitely messed up his day. I use vaultwarden, but I also keep a keepass file on my phone that has my essential passwords. ---------------------------------------------------------------------- Trashrascall · 2023-11-15 18:30 Yeah it sounds pretty appealing. I think I'll make the switch when my bitwarden sub runs out ---------------------------------------------------------------------- KoppleForce · 2023-11-15 19:24 Web browsers just save yalls passwords how do y’all not know this? ---------------------------------------------------------------------- GeminiKoil · 2023-11-15 19:33 What is a tar pit do? Does it maintain logs of people trying to access or something? Sorry I'm not very knowledgeable about this. ---------------------------------------------------------------------- KN4MKB · 2023-11-15 21:00 The web version is most definitely safer. Most of the people here probably don't penetration test their servers, conduct security audits or use best practices. They don't have SEIM systems or IDS systems. They aren't using stateful firewalls. Unless you are a cyber security guru on par with a dedicated team, the web version will be much safer for you. It's an unpopular opinion, but I'll say it again: Your data in this case is probably safer in the cloud. Be butthurt if you wish, or say "well I'm not as big of a target", but that's the risk you're willing to take. ---------------------------------------------------------------------- cityhunt1979 · 2023-11-15 22:13 Yeah, /u/tech2but1 is absolutely right, and I only discovered this in test phase. I probably overlooked this in my pre-install docs read, but was glad to know when I started testing it. My setup is an internet-gapped one. I can use it whenever I am if in read only mode (of course OTP 2FA works too in read-only mode), and only need to VPN to it to perform write operations (password rotations, new objects). VPN connection on iPhone is easy AF. I perform hourly backups on my synology, and client wise I have the option to use Bitwarden on every device I have (iPhone, iPad, Linux, macOS, BSD). It really did change my life. Even my wife who works on totally another industry use it with basically near to no learning curve. We come from paying family 1password subscription and we’ll never go back. Absolutely safe and FREE (with Vaultwarden instead of the official app). Of course, we rotated all the most sensitive passwords when switching out from 1P ---------------------------------------------------------------------- cityhunt1979 · 2023-11-15 22:16 To add on DRP ops: you can easily configure a remote site backup copy with rclone (google drive e.g.) . I rsynch the encrypted blob to my parents synology too, just to avoid any kind of external vendor/service provider locking ---------------------------------------------------------------------- PaulEngineer-89 · 2023-11-16 00:07 Umm interestingly enough VMs and Docker and Podman for instance are isolated from the server. The biggest security problems are if you don’t practice good security practices throughout your network. It comes down to knowing what you are doing. Bitwarden/Vaultwarden is interesting security wise because the entire database is encrypted at the client. There are no passwords or anything except public keys and binary encrypted blobs on the server. If you lose your master password and/or recovery there is nothing Bitwarden can do to help you because they don’t have a backdoor. Vaultwarden exists because Bitwarden client protocols are open source. ---------------------------------------------------------------------- kevdogger · 2023-11-16 00:47 What backend of vaultwarden are you using? Mysql or Mysql lite or postgresql? ---------------------------------------------------------------------- kevdogger · 2023-11-16 00:48 But I do run my vaultwarden on arch...no one gives a shit ---------------------------------------------------------------------- kevdogger · 2023-11-16 00:49 Honestly just install wireguard on client and they use that to remote access the server when away from lan network ---------------------------------------------------------------------- FoolHooligan · 2023-11-16 01:07 The name is LastPass. ---------------------------------------------------------------------- p_235615 · 2023-11-16 02:31 Thats why you always stick something more robust in front of those services - like nginx, which is doing the filtering and proxying. And unless the attacker actually know your domain and URI path, they get landed on a static welcome page... That alone will remove the majority of the attempts and attack vectors. ---------------------------------------------------------------------- jmeador42 · 2023-11-16 03:24 Different people have different risk tolerances and amount of resources to dedicate to securing this stuff. Personally, I'm going to use KeePassXC, and be responsible for 1 single file before I host an entire back end server system. ---------------------------------------------------------------------- SimiaCode · 2023-11-16 04:51 The _constant_ stream of port / url scanning that I get on my server makes me extremely hesitant to self-host something like a password manager. It also makes me angry, but what are you gonna do, hell is other humans. ---------------------------------------------------------------------- zfa · 2023-11-16 06:00 I don't self host anything where it would impact me unduly if it went down while I was on holiday and necessitate me having to brash state and fix stuff. A password manager falls in that camp so it's paid-for Bitwarden every night every day every possible way for me. ---------------------------------------------------------------------- Trashrascall · 2023-11-16 06:04 Fair point ill have to see how stable my little optiplex server would be before I decide. A lot to consider here. Seems like configuration and willingness to spend your time troubleshooting is a big factor here. ---------------------------------------------------------------------- zfa · 2023-11-16 06:06 10 bucks a year is more than worth it to me if it means I don't need to put down my beer at the beach and spend an afternoon on a computer instead, lol. All other considerations can take a back seat IMO. ---------------------------------------------------------------------- Trashrascall · 2023-11-16 06:13 Haha a man after my own heart. Strongest argument yet. ---------------------------------------------------------------------- FunnyPocketBook · 2023-11-16 07:54 I literally just had the exact opposite question! I've been wondering why you'd want to pay for a password manager service when you could self host it. The only reason I could think of is guaranteed high uptime, but to me (and at least in my personal use case) that seems a bit pointless, since you can have a copy of your password manager on each device, which is being synced through your server ---------------------------------------------------------------------- Trashrascall · 2023-11-16 08:11 So my big question about that is: if your server is down and the encryption key is stored locally, does the security of your mobile lessen the overall security of the password manager. I can't imagine your android has as robust security as your network. Is this am unfounded worry? ---------------------------------------------------------------------- hdddanbrown · 2023-11-16 09:49 I did not forget. OP is asking about the point of selfhosting either Vaultwarden or Bitwarden, versus using the Bitwarden website (not selfhosted). ---------------------------------------------------------------------- AnyNameFreeGiveIt · 2023-11-16 13:01 Vaultwarden is a single container that uses like 20mb of memory, official bitwarden comes with multiple containers and 2-3GB memory last time I used it. Also vaultwarden comes with all premium features especially 2fa without having to pay for it. ---------------------------------------------------------------------- Engineer_on_skis · 2023-11-16 15:39 I largely agree with you and Key Negotiator. That's why my password manager is KeyPass, synced between devices by Syncthing. If I need to sync things remotely I'll use Wireguard, specifically the LinuxSever.io docker image. I have two ports open on my network, one for a full tunnel wireguard and one for a split tunnel VPN, access to the home stuff without the added latency (however small) and the data usage going against my home internet (twice). In order for my passwords to get compromised, Wireguard, and keePass would both need to be compromised. Since wireguard is included in the Linux kernel, I feel comfortable that there are enough competent eyes on it. Does that guaranty is secure? No, nothing does, but that is way better than any auditing I can do. Safe with the LinuxSever docker image; they are way more on top of things than I am. I feel reasonably safe with the measures in place securing my passwords. Would I survive a targeted attack? No. But look at the LastPass breach; it only takes 1 weak link and an entire company can become compromised. (And ideally everything is encrypted with a zero knowledge architecture, so customer data is still secure. But how can a consumer verify this?) And because I'm not a part of a huge collection of concentrated passwords my data isn't a big target, and I'm a regular person professionally and personally, so there's little reason for me being targeted. ---------------------------------------------------------------------- DubDubz · 2023-11-16 19:20 There have been vulnerabilities in the past that allow you to escape a VM and gain admin creds to a host. Same with docker to the host OS. Not that I think they're particularly concerning for a self hoster, but it's definitely an attack vector. ---------------------------------------------------------------------- DubDubz · 2023-11-16 19:22 It responds glacially slowly to login attempts, which means the bot trying to automatically break into random servers it crawls to gets stuck trying to login. Thus a tarpit. ---------------------------------------------------------------------- GeminiKoil · 2023-11-16 19:24 Right on thank you ---------------------------------------------------------------------- PaulEngineer-89 · 2023-11-17 02:14 Agreed but so far those are highly theoretical, especially the video device driver ones. Don’t forget that attacks on say Xen 15 years ago probably don’t apply today. VMs and Docker have been around quite a while and used extensively in commercial settings. That’s akin to malware attacks on Linux in general. Sure it exists but nothing on the scale of Windows and pre-OSX MacOS. It also depends on the environment So if I run npm and only open incoming ports for that one application then using reverse proxy for everything you’d have to penetrate through npm to a vulnerability in the container to break out into the container itself, then use some exploit to bypass container security then breaking host security. Can it be done? We’ll never sag never. ---------------------------------------------------------------------- DubDubz · 2023-11-17 02:49 Definitely. When I was sysadmining for a medium sized company the vast majority of malware was user induced anyway. Even most big hacks we hear about are just phishing of some variety. Like you said, internal network is likely the largest attack vector (assuming adequate external security). The scenario where a GitHub account for a container you run getting hijacked and pushing malware that uses network to jump feels more likely than a host jump. ---------------------------------------------------------------------- PaulEngineer-89 · 2023-11-17 04:33 And if you don’t reuse user names or passwords, use a password less/SSO system, and implement firewalls within your LAN it’s looking pretty good. I just assume worst case someone malicious has root access on one (V)M and making that useless on any other account. ---------------------------------------------------------------------- cryptobots · 2023-11-18 12:28 Have there been audits if vaultearden code? Or comparison with bitwarden code? Otherwise I am curious on what do you base that code is as good as bitwarden?