Selfhost Vaultwarden or switch to Bitwarden Family? reddit / selfhosted ---------------------------------------------------------------------- CobblerYm · 2023-11-30 17:38 I currently self host Vaultwarden for about a year now and never really looked into Bitwarden proper. I recently came across a post that mentioned how stupid cheap Bitwarden is, $10/yr per premium acct or $40/yr for a family of 6. Normally I would just keep selfhosting, but seeing as this is password security and all the Bitwarden front ends I use are really well done, I'm tempted to just pay the $40/yr for it and drop the selfhosted install altogether. I'm just trying to think of some Pro's and Con's of selfhosting vs. paying for this service. Curious on the experiences and opinions of people here? ---------------------------------------------------------------------- wsamh · 2023-11-30 17:47 I selfhost vaultwarden and it's been great. Haven't had an issue. ---------------------------------------------------------------------- Significant-Neat7754 · 2023-11-30 17:47 To be honest, passwords are too critical for me to leave to self hosting. I prefer Bitwarden, it's not even that expensive to be honest. ---------------------------------------------------------------------- Fratm · 2023-11-30 17:49 I prefer self-hosted, I don't like other people holding onto my data, especially passwords. ---------------------------------------------------------------------- wsamh · 2023-11-30 17:52 To be fair their pricing is really reasonable. ---------------------------------------------------------------------- bmaeser · 2023-11-30 18:00 the product is great, the price is very cheap. i gladly pay that for an awesome product and dont have to take care of securing and backing up a selfhosted solution thats incredibly important. (i do self host a lot of other stuff though) i like however i can fallback to selfhosting, if company policy ot pricing changes in a way i dislike ---------------------------------------------------------------------- Simplixt · 2023-11-30 18:04 Bitwarden Family all the way ... a divorce because you fucked up your Selfhosting with your wife's passwords would be much more expensive ;) ---------------------------------------------------------------------- tillybowman · 2023-11-30 18:15 hm. what do you think is more secure: your server that nobody knows about and might not even be connected to WAN or bitwarden/1pw/etc servers that have the best people but also a freaking big attack surface. ---------------------------------------------------------------------- starbuck93 · 2023-11-30 18:16 I've got all the above... I use bitwarden family to share common passwords, bitwarden premium for myself and also self hosted vaultwarden for my work passwords ---------------------------------------------------------------------- bigboicarlo · 2023-11-30 18:21 IMHO people give waaaaay too much credibility to external hosted services. The only difference between Bitwarden and Vaultwarden is literally that you don’t have any control about Bitwarden servers 🤣 there is nothing magical happening there. It’s only someone else’s machine and having a company name attached to it gives you the illusion that it’s something special. If you take care about your infrastructure, actually take the time and READ documentation, don’t act reckless, have proper (off-site) backups, then you are good in 99.999% cases! ---------------------------------------------------------------------- bigboicarlo · 2023-11-30 18:23 Exactly! My favorite analogy is: “would you prefer having your sensitive information stored at a (presumably secure) bank where people try to break in daily, or rather have it under your bed where 99.99% of the world don’t give a shit about” ---------------------------------------------------------------------- CobblerYm · 2023-11-30 18:27 Yeah that's my thoughts. Plus they completely support self hosting, and I support that 100% ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-30 18:27 That depends - how good are your backups? ---------------------------------------------------------------------- CobblerYm · 2023-11-30 18:31 Excellent, backup ability or integrity isn't a concern of mine at all. ---------------------------------------------------------------------- Expensive_Finger_973 · 2023-11-30 18:35 Generally, if it is something that is just for me, or mostly transparent to others in my household I will self-host it. If it is something where my wife or kids could end up in a situation where they need to Google how to do something in the app should I do be around to ask I will pay for the service and take regular offline backups of the data kept there. ---------------------------------------------------------------------- SpongederpSquarefap · 2023-11-30 18:42 In that case, self host Vaultwarden Many people aren't capable of running a system with that level of importance ---------------------------------------------------------------------- DrunkOnKnight · 2023-11-30 18:54 Have you looked into keepassXC ? I use that and just use sync thing to keep the database synced between my devices. ---------------------------------------------------------------------- Simplixt · 2023-11-30 18:54 Famous last words ;) But yes, if you are trusting: \- your backup strategy (also access to backups if your house burns down or ramsonware encrypted ) and tested it \- the isolation of your vaultwarden installation to the outer world \- the availability even in emergencies, e.g. you are on vacation (maybe second copy of the installation on a VPS?) \- that the vaultwarden community is securing their deployment process good enough (e.g. prevent maleware injection in docker container by hacked GitHub accounts, etc.) You have nothing to worry about. Still you could also Selfhost via the official Vaultwarden Unified container and support the porject with subscriptions at the same time (you need it for the official build) https://bitwarden.com/help/install-and-deploy-unified-beta/ ---------------------------------------------------------------------- SonicIX · 2023-11-30 18:55 Sounds like you didn't have proper backups then. ---------------------------------------------------------------------- Simplixt · 2023-11-30 18:57 Bitwarden has official security audits, vaultwarden is a community project as Rust rewrite of the API. There are somme differences ;) ---------------------------------------------------------------------- nietmasjien · 2023-11-30 18:57 The main reason I pay for Bitwarden is that I want Emergency Access to always work when needed. Sure, it is included in the self-hosted Vaultwarden but then your infrastructure (+email service) needs to remain available for at least the specified 'Wait time'. Also, your Emergency Contacts need to know how to access your self-hosted instance and are not completely able to follow online instructions. Other than that I would like to support Bitwarden financially with its reasonable price. ---------------------------------------------------------------------- lakimens · 2023-11-30 19:00 Bitwarden is so cheap that using VaultWarden feels like piracy (I don't use it). I'd rather pay a company I want to support. ---------------------------------------------------------------------- Simplixt · 2023-11-30 19:02 I have proper backups (3:2:1 rule). Even 2 external encrypted cloud backups with different methods (BorgBackup and Kopia) in case my apartment burns down. Still, for passwords I want simplicity and just one single file to sync to restore in 2 minutes with my smartphone even in a emergency case. That's why I'm using KeePass. But of course, not an alternative for a Family that needs password sharing. ---------------------------------------------------------------------- dschaper · 2023-11-30 19:10 You can do both, ya know? ---------------------------------------------------------------------- dotinho · 2023-11-30 19:10 I agree, for all my mates from work, also share credentials is very simple. ---------------------------------------------------------------------- Warm_Feature_7302 · 2023-11-30 19:13 I maybe weird but I just pay for the 10 a year but selfhost vaultwarden. I figure paying the 10 a year is my way to contribute for the software. ---------------------------------------------------------------------- davidyoungcos · 2023-11-30 19:14 Vaultwarden is included with [https://federated.computer](https://federated.computer). And lots more. ---------------------------------------------------------------------- horus-heresy · 2023-11-30 19:24 Docker -> nginx proxy manager with auto ssl-> external url on my domain. Works beautifully since Bitwarden allows self hosted url in app. Very good company support if you can. Helped me drop last pass this year ---------------------------------------------------------------------- Cynyr36 · 2023-11-30 19:29 Agreed, 5 minutes of down time at the wrong time could be catastrophic. And for me, that 5 minutes could be because my isp changed my ip address, and the ddns hasn't updated yet. ---------------------------------------------------------------------- BeastleeUK · 2023-11-30 19:29 We have Bitwarden Enterprise at work, one of the perks is that every user gets a free Family licence whilst they have a work account. I've combined it with a personal premium $10 / year for OTP support (already had this). ---------------------------------------------------------------------- SpacezCowboy · 2023-11-30 19:41 Gonna go with a bank on that one. ---------------------------------------------------------------------- Morpheusoo · 2023-11-30 19:42 I was self hosting Vaultwarden for a year, I enjoyed the Bitwarden product so much, I decided to support BitWarden directly and end up paying the $10 a year for a premium account. ---------------------------------------------------------------------- sebasdt · 2023-11-30 19:55 A very big BUT Make frequent backups! like every 12 hours via the 3-2-1 method. I've been hosting VW for 4 years now without any issues. Although backups were a bit of a struggle for me in the beginning, just was a noob at this XD. ---------------------------------------------------------------------- purepersistence · 2023-11-30 20:08 I do the best of both worlds. Pay for the family membership and self host too. ---------------------------------------------------------------------- g0-0se · 2023-11-30 20:16 I self host vaultwarden but am thinking of switching to Bitwarden because if my server went down I AM FUCKED. ---------------------------------------------------------------------- techypunk · 2023-11-30 20:30 I've used bitwarden since 2018 after switching from LastPass. They are the only ones to not have a hack. To me it's not worth the hosting, it's cheap or free. ---------------------------------------------------------------------- ceciltech · 2023-11-30 20:34 The Bitwarden client caches locally, my locally hosted vaultwarden was down for a couple of days and I still had access to all py passwords. ---------------------------------------------------------------------- hand___banana · 2023-11-30 20:35 I selfhost almost everything, but I happily pay for bitwarden family. It's perfectly reasonable pricing and I don't have to stress about risks of hosting it. ---------------------------------------------------------------------- caffeinated_tech · 2023-11-30 20:36 Don't forget you can self host bitwarden itself with resorting to vaultwarden. Works great. ---------------------------------------------------------------------- Cynyr36 · 2023-11-30 20:43 I thought without access to the server you'd have read only access. Sign into the bank and get the "your password is expired" screen at the same time vaultwarden is down is going to result in a level 10 support ticket. Something worth $40/yr to not deal with. ---------------------------------------------------------------------- utahbmxer · 2023-11-30 20:59 I have been running Vaultwarden for a few years now, no concerns about backing up or being breached, etc. However, as time goes on I think more and more about the self-hosted things that my wife is using (and likely our kids soon), and keeping thinking more and more about what they would do if the proverbial bus comes along. That has been my concern with Vaultwarden lately. Tempted to switch to Bitwarden paid plan for us for that reason alone. ---------------------------------------------------------------------- panjadotme · 2023-11-30 21:04 > hm. what do you think is more secure: > your server that nobody knows about and might not even be connected to WAN > or > bitwarden/1pw/etc servers that have the best people but also a freaking big attack surface. Definitely Bitwarden/1Pw and its not even close ---------------------------------------------------------------------- linuswong · 2023-11-30 21:06 You mention Bitwarden Family. Will you be sharing with your family as well? I already had my wife using my self-hosted Vaultwarden. As I was teaching my kids how to use Bitwarden a couple of months ago, one of them asked me what would happen if I died. I have 100% confidence that while I'm alive and of sound mind, I can securely manage Vaultwarden. But if I'm having my family use a password manager, it needs to outlast me. This is the same with all my photos as well. I have no problem paying for Bitwarden, and I still self-host Vaultwarden for my work stuff. But I got the Bitwarden Family plan so they won't have to worry about potentially losing access to all their accounts on the account of my death. ---------------------------------------------------------------------- Fungled · 2023-11-30 21:21 With that price, one could self host _and_ pay the subscription to support the product. I was doing this for a while myself ---------------------------------------------------------------------- codefossa · 2023-11-30 21:22 This isn't really an issue with Bitwarden clients as each client stores a copy of the data, similar to git. If the server goes away, the client can still export the data and import it into another account, which could be Bitwarden. If your phone and PC both have Bitwarden for example, both of them have a separate copy stored and you can export the data from either device. Depending on when the last sync took place, they may be missing some records on any given device, but they could pull from the device that has that information, or they would have at most a couple accounts to recover. That being said, if you're not comfortable with the responsibility of hosting sensitive data for other users, then it's probably best to go with a company that knows what they're doing and has proper plans in place. ---------------------------------------------------------------------- z3ndo · 2023-11-30 21:32 Each device you use a Bitwarden client on has a snapshot of your vault which can be exported to JSON or CSV even if your server is down. Everyone keeps acting like they're completely boned if your self- hosted Vaultwarden server goes down but that's a bit of an overstatement. If I was away from home and it exploded and somehow all of my backups got destroyed then I'd \*still\* have my personal Bitwarden vault in my pocket and could export it to JSON and re-import it into a new Vaultwarden if I needed. Obviously you still need backups and obviously a password manager is a critical service, but self hosting it isn't as risky as people are making it out to be. ---------------------------------------------------------------------- duckofdeath87 · 2023-11-30 21:48 I self host vault warden with caddy in front of it for SSL. Real easy and works great. Semi related, my self hosting friends have borg servers to back up critical secrets to each other's servers I self-host because I don't trust services. As good as it is, bit warden is no exception ---------------------------------------------------------------------- secopsx · 2023-11-30 21:55 I can't be bothered to self host something as critical as a password manager...I'd rather pay $60/year for a family plan for 5 and not deal with the hassle of it all. What I would be interested in - selfhosting a backup of my database, but since I use 1password and passkeys religiously, no way to export those yet to back them up. ---------------------------------------------------------------------- tillybowman · 2023-11-30 21:56 i doubt it. and not even because i doubt enterprise security but because of the attackers intention. if they get into an enterprise vault (and they did - hello lastpass) they will know what they have on hand. wallets, online bank accounts got drained. my server will only likely fall into mass scaled randsomeware attacks and they will only beg for bitcoin rather than look through my files and then try to decrypt my vault, or setup something sophisticated like a keylogger or whatever. ---------------------------------------------------------------------- redditlotl · 2023-11-30 21:58 Can you elaborate on what exactly the 3-2-1 method is? I'm looking for a backup plan for my VW instance before I'm offering family and friends to use it. ---------------------------------------------------------------------- gregorianFeldspar · 2023-11-30 22:08 The only thing I dislike about Vaultwarden is that their app does not support client certificates on Android. ---------------------------------------------------------------------- deadlock_ie · 2023-11-30 22:11 3 copies on 2 media with 1 remote ---------------------------------------------------------------------- redditlotl · 2023-11-30 22:13 I see, thank you! ---------------------------------------------------------------------- panjadotme · 2023-11-30 22:20 > if they get into an enterprise vault (and they did - hello lastpass) they will know what they have on hand. wallets, online bank accounts got drained. While I doubt it will happen given their security audits, even if my vault was taken from 1P/BW it is still encrypted at rest with my keys so it would be useless to the attacker anyway. And if they have proper security they will know of a breach, warn the users, and I can change passwords just in case the attackers decide they want to brute force my vault for 4000 years. I am by no means a security expert but I guarantee their security is WAY better than mine is at home. ---------------------------------------------------------------------- Stradivari1 · 2023-11-30 22:29 Maybe self host but keep a cloud “cold storage” solution for backing up your passwords once a year or something ? ---------------------------------------------------------------------- adrik0622 · 2023-11-30 23:10 Bitwardens pricing is very good. Problem for me though is that I alone have 6 pc’s I regularly use and would need them to all be activated. Leaves little room for my family ---------------------------------------------------------------------- Candle1ight · 2023-11-30 23:11 I self-host for myself and it's been great. ..But I hate being responsible for anything critical to other people. I do this as a hobby and don't want a phone call at 2am about their password manager not working. They're a great company and it's cheap, I would just pay for it. ---------------------------------------------------------------------- Candle1ight · 2023-11-30 23:16 > - the availability even in emergencies, e.g. you are on vacation (maybe second copy of the installation on a VPS?) For what it's worth, bitwarden works completely fine offline and syncs everything back up when things come back online. It's the least of my concern when on vacation. ---------------------------------------------------------------------- Simplixt · 2023-11-30 23:21 Does the cached sync file survive app updates? ---------------------------------------------------------------------- Pluckerpluck · 2023-11-30 23:28 I guarantee Bitwarden's security is many levels higher than anything you have with self hosting. Plus if someone does break in they will also likely detect it and notify me. On my home server a hacker could live for months and I'd never know if they were smart about it. Plus all of these systems use encryption at rest using locally stored encryption keys. So in all cases the **only** attack is the same, which is hack in and modify the source code such that that a compromised website is shared to the user. This literally only works if you access the data through a website, and it's going to be noticed almost immediately if it happens to someone like Bitwarden. ---------------------------------------------------------------------- MrDephcon · 2023-11-30 23:36 I think it's 6 unique accounts and each account can sign into an unlimited amount of devices ---------------------------------------------------------------------- Candle1ight · 2023-11-30 23:42 The password for your vault? I don't believe so. The vault itself however should be fine. ---------------------------------------------------------------------- platswan · 2023-12-01 00:03 I self-hosted Vaultwarden for a few months but even with minor downtime, it was still frustrating not having live access 24/7 to my vault (I know the vault is stored locally per device) to make changes or add new items the few times I couldn't connect to my server. I also had the security basics in check but still I was worried for the "what ifs". I ultimately decided to go with 1Password for myself. At $2.99/mo and the peace of mind that my vault is safe, I have 0 complaints. I used Bitwarden (non self-hosted) in the past, and honestly my only issue is that the website and mobile apps have poor UI/UX. 1Password just looks fantastic. ---------------------------------------------------------------------- darkrom · 2023-12-01 00:08 Just curious what risks you perceive to self hosting it? I self host it that’s why I ask. I generally see it as less risk. What’s more desirable to hack a massive trove of data (last pass anyone?) or a self hosted password manager I don’t know how you’d even find, which almost certainly has very few users, mfa enabled etc? ---------------------------------------------------------------------- darkrom · 2023-12-01 00:10 So yes, definitely 100% do proper backups as with anything else important, but I find it reassuring that even if your self hosted vault warden gets tanked you will have saved local copies of your passwords on your phone tablet etc any other devices. I BELIEVE you can even export the whole thing easily and start over with all your passwords ready to import, but I’d like some confirmation on that last part. ---------------------------------------------------------------------- darkrom · 2023-12-01 00:13 Can you explain why? I want to learn why that would be if it’s the same software. Unless you’re using a terrible firewall or poor practices shouldn’t it be just about the same? What is inherently less secure about self hosting Bitwarden? If I am convinced I’d happily switch because I have no problem supporting them. I just enjoy self hosting and I figured it would be more secure since it’s the same code, but I’m a smaller unknown target that even if found why would it be worth your time? If you have an mfa bypass for user accounts or an active exploit with Bitwarden wouldn’t you use it with the much more rewarding target? ---------------------------------------------------------------------- darkrom · 2023-12-01 00:17 No you aren’t everything will still be available on your clients that you’ve already logged into. ---------------------------------------------------------------------- hand___banana · 2023-12-01 00:20 Mostly that my infrastructure is nowhere near as hardened as theirs is. So many people keep referencing who is a more desirable hack, but that's beside the point Even if someone *does* manage to get into Bitwarden it doesn't do them any good because Bitwarden uses one-way salted hashes. What if your house burns down? What if your server gets fried? Do you have a backup offsite? Is it up to date? Have you ever tried restoring from it? What if your box gets hacked and you're locked out of root? How good is your security on your home network? On your server itself? The answer to all of those questions is not as good as Bitwarden's. Lastly, I feel they've made a great quality product, and they deserve payment for it. ---------------------------------------------------------------------- darkrom · 2023-12-01 00:26 Honestly most of your responses I can say yes but that’s because it’s a hobby to me and I use it to learn at the same time. Can I claim my locked down firewall is as locked down as their top tier enterprise ones, of course not so you make some good points. I still juggle is it better to be the invisible very hardened target, or the extremely visible slightly more hardened target. I’ll definitely consider it. They are totally worth the money but it goes against my general desire to selfhost so I’m back and forth. It’s always been secure and stable and with mfa. The server itself isn’t exposed at all. I only have ports open for a reverse proxy nothing else at all etc. I take pride in the work I’ve done on the server / network so I’m sure that’s a factor too. Really tough call honestly. FWIW I have my mother use the free tier, so I see both sides. I wish there was some kind of objective comparison between the networks. Like I said I’m sure they are more hardened and have a dedicated security team etc, but I’m not sure what that would translate to in the real world in this particular case assuming the code is the same and updated at the same frequency for security patches etc. ---------------------------------------------------------------------- billiarddaddy · 2023-12-01 00:26 Selfhost passbolt ---------------------------------------------------------------------- darkrom · 2023-12-01 00:28 To add to the craziness I just saw Google drive lost users data. If you asked me is self hosting my pictures and files on a synology with offsite backups more likely to lose data than googles enterprise solutions, I’d have said for sure. I haven’t done that yet. Of course what I’m handling is much easier as a single user but the idea that the pros do it the best is just USUALLY true but not Always. ---------------------------------------------------------------------- adrik0622 · 2023-12-01 00:40 Oh I had no idea. That’s fantastic! Thanks for the fyi ---------------------------------------------------------------------- koi666 · 2023-12-01 01:04 I’ve been using Bitwarden for years and have t paid a dime. What is the advantage of the paid tier? ---------------------------------------------------------------------- hand___banana · 2023-12-01 01:04 \> I only have ports open for a reverse proxy That's a point of entry for malicious actors. Not saying don't do it, or it's not safe, but it's not perfect either. How well do you understand the nginx configs you're running for each of your apps that are exposed? You're getting pinged by bots constantly. One big difference is that Bitwarden almost surely has all sorts of advanced anomaly detection and monitoring that you don't. Is your server OS always up to date? What about the apps that you're running? Owncloud just had a pretty major vulnerability. How many aren't actively maintained or updated? Do any of your docker containers run privileged? There is a lot that you're paying Bitwarden for in addition to continued development of the software. Yea, Google Drive potentially pushed out a bug that allowed users to unknowingly delete data or Google deleted it themselves via a bug. No one is perfect. I'd be shocked if Bitwarden would do anything that they couldn't recover your passwords from. Again, it just comes down to me trusting them more than myself (and I'm a software developer by trade). ---------------------------------------------------------------------- darkrom · 2023-12-01 01:08 Very good points to consider. I’m not 100% either way but it’ll be on the brain now. One point though you basically can’t lose your vault either method, it’s still saved locally on the devices. For that all to fail at once something catastrophic must have happened to the whole region. With Bitwarden specifically I’m far more concerned about security than any data loss. Such a small amount of data is easy to handle backups for. The security points you bring up are pretty much all valid though and I really need to mull it over more. ---------------------------------------------------------------------- desmosquatch · 2023-12-01 01:41 I've been self-hosting Bitwarden for years and haven't had any issues. ---------------------------------------------------------------------- SP3NGL3R · 2023-12-01 02:13 Any normal person can run a server inside their house. What they lack is everything else that an enterprise has to monitor/catch/block an attack. A home firewall will be a joke for a skilled attacker to bypass (likely because you're also self hosting something else that has a flaw you didn't know about), especially as most LANs at home aren't firewalled at all. Get into someone's lightbulb and you've now got full run of their household. Probe poke peal away, land yourself able to impersonate their credentials into your vault, upload decrypted vault back to the mothership. A big safety net here is simply that you just won't be worth the effort. But maybe they'll see you don't have any immutable backups enabled, and will just encrypt everything for ransomware. Including your sacred vault and its local backups. An enterprise, like bitwarden literally has teams of people full time just securing/defending the data. As well as a massive interest in never becoming the next LastPass. I bet we could all publish our encrypted vaults safely and forever, publicly. Especially now that we've all gone in and upgraded our security to Argon2id with 2FA also, RIGHT!?!? ---------------------------------------------------------------------- Mount_Gamer · 2023-12-01 02:15 You don't need to open ports for the reverse proxy. You can run a dns challenge if you use cloudflare for your domain dns. (if this is your reason) I use the dns challenge with certbot (snap) which works well, but you need to update manually or write a script and put it in as a cron job. ---------------------------------------------------------------------- SEND_NUKES_PLS · 2023-12-01 02:32 I see absolutely no benefits to self hosting BW. The average selfhosting Joe will never outdo the security that BW servers have in place and you also have to rely on having no downtime on your servers. I pay $10 to never have to worry about messing around with vaultwarden setup trying to make it bullet/fail proof...I just let Bitwarden host stuff for me. ---------------------------------------------------------------------- nkilian · 2023-12-01 02:44 Ok here is my one qualm. I wish I could access it without a cert inside my network. if something ever happens, getting it up and running to get to the login is just annoying. (I'm not good with certs). Unless there is another way to get HTTPS working on linux docker. ---------------------------------------------------------------------- sleepsButtNaked · 2023-12-01 02:59 I use OnePass and after reading this thread, i will be migrating to bitwarden and self hosting vaultwarden ---------------------------------------------------------------------- dereksalem · 2023-12-01 03:06 I agree that they make a quality product and I actually support them, but I still self-host Vaultwarden. I *absolutely* trust my ability to host and secure it more than a third-party, and a password-hosting service is a complete prime target for people while mine is only exposed to a specific DNS address and not external IP. ---------------------------------------------------------------------- Renkin42 · 2023-12-01 03:40 This actually saved my butt recently. I stupidly gave my Unraid server a single cache ssd with no mirror or backups and ignored Unraid’s warnings about my stupidity, assuring myself I would upgrade it well before it became an issue. Sure enough the ssd died and took all the appdata with it. My containers were hosed but I was able to completely restore vaultwarden from the local json backup on my phone. ---------------------------------------------------------------------- bufandatl · 2023-12-01 03:48 You contribute to bitwarden but not vaultwarden. But it’s ok if you like the original more than the rust implementation of the API. ---------------------------------------------------------------------- bufandatl · 2023-12-01 03:51 I prefer self hosting my password vault. While bitwarden is audited regularly by an independent 3rd party according to their website. I still like to have my most precious values, my passwords on my own infrastructure. I feel just better this way. And my vaultwarden instance is only accessible via VPN or in my home network. ---------------------------------------------------------------------- TrkGuy79 · 2023-12-01 04:22 You are correct ---------------------------------------------------------------------- sintheticgaming · 2023-12-01 04:34 IMO Self hosted Vaultwarden or self hosted Bitwarden is the way to go. I will always choose open source self hosted applications when I have the option. I’ve been running Vaultwarden for 2 years now and no issues and it works flawlessly. The way I see it is why pay money when you can host it yourself and use the exact same features and apps to access your vaults? I also trust myself more to host my data over someone else. This doesn’t really apply to this debate but here’s an example: How many times have we seen a company change the way they do something or go out of business only to leave their user base either pissed off because of changes or screwed over because they no longer offer the service. Of course open source projects fail just like companies, but at least when it happens to open source projects there’s always a chance it forks off and becomes an alternative you can agree with/use. A good example being Owncloud vs NextCloud. You had developers and user base wanting to do things differently so what happened? It was forked and NextCloud was born to go a step further recently you may have heard of the major security vulnerability in Owncloud and that directly affects PAYING customers. My point is.. it just goes to show paying for something doesn’t necessarily make it “better”. If you have the know how and the willingness why pay/trust someone else to do it for you? ---------------------------------------------------------------------- crazy_gambit · 2023-12-01 05:59 If my house burns down along with my server, I'm thinking I have a lot more to worry about than resetting a few passwords that are also saved on the app on my phone. If you wanna support the devs that's one thing, but I feel the rest of your arguments aren't all that powerful. Like if someone somehow hacks into my server, I don't know how they'd get to Bitwarden, but I'd have far bigger problems than that. ---------------------------------------------------------------------- digitalindependent · 2023-12-01 06:18 Plot twist: Self host but pay for 1-2 accounts as a sponsorship matter Because: since the LastPass leaks I had to move away from LastPass and I have lost so many days on resetting all kinds of passwords. Not saying bitwarden is unsafe. Just saying: I don’t want to have to rely on them keeping it all safe. Plus, as a SaaS entrepreneur: having low prices without massive scale also means you have less money to attract and retain great talent. That in turn means maybe less security? ---------------------------------------------------------------------- BeastleeUK · 2023-12-01 06:55 OTP auto generation alone is worth $10 a year for me. When you fill a login you have the option to have the appropriate OTP be copied to your clipboard so you can just paste it in at the next page. You can 2FA the account with FIDO keys and also get Emergency access ability sonic something happens to me my wife can get access. ---------------------------------------------------------------------- Skwids · 2023-12-01 07:43 You can also use vaultwarden for convenience and pay for a license anyway. It's like $10 a year which is insane for the value. ---------------------------------------------------------------------- Skotticus · 2023-12-01 08:07 You can always keep self-hosting it but purchase a license or donate to them anyway. ---------------------------------------------------------------------- zunxunzun · 2023-12-01 08:55 I don't think there is any other piece of software I would rather pay for, Bitwarden is absolutely essential to me and they deserve all the support they get! ---------------------------------------------------------------------- marsokod · 2023-12-01 09:04 Same for me, you are not the only weirdo. ---------------------------------------------------------------------- Lukebekz · 2023-12-01 09:15 their selfhosting solution is nice, if you don't run anything else on the same server that might require reverse proxy. The entire application runs in eleven docker containers and brings it's own nginx instance, which can be configured to your liking, but there is no guarantee it doesn't overwrite the config after an update. ---------------------------------------------------------------------- Friendly_Panda3871 · 2023-12-01 09:42 While 3-2-1 is the way to go, if you host it just for yourself and the VW is going down for some reason every Bitwarden Client has the login data cached so you could export it from there and reimport it to your new VW instance ---------------------------------------------------------------------- simonicraft · 2023-12-01 10:20 Bitwarden is end-to-end encrypted, which means you trust the clients, not the server ---------------------------------------------------------------------- UninvestedCuriosity · 2023-12-01 10:37 I self host vault warden. Have backups, scripted exports and cloud backup of encrypted archives.. Took a bit to set it all up but the hardest part was just the rolling deletions for the cloud storage so it didn't fill up. We do the same thing at work. ---------------------------------------------------------------------- madrascafe · 2023-12-01 10:37 After the lastpass fiasco I’m not going any where near such solution ---------------------------------------------------------------------- marsokod · 2023-12-01 11:05 You still contribute to the clients and the development of new features. Vaultwarden is following the functionalities developed by Bitwarden, it is not a completely independent project. AFAIK the Vaultwarden team has a good relationship with Bitwarden. ---------------------------------------------------------------------- Altniv · 2023-12-01 11:05 Lookup LastPass’s oops. Not same company, but same can technically happen. ---------------------------------------------------------------------- bufandatl · 2023-12-01 11:22 Yeah sure. That’s why I would gladly pay something for the App itself I use because it’s from bitwarden. But still selfhost vaultwarden as I don’t want my passwords in the cloud and Bitwarden as self host is a resource intensive. At least it was when I decided to go for vaultwarden or as it was know bitwarden_rs back then. ---------------------------------------------------------------------- nitsky416 · 2023-12-01 11:25 Yeah I just pay ---------------------------------------------------------------------- Bosshappy · 2023-12-01 14:11 I self hosted for 3 years. In the end, I switched to BitWarden. Why? Because, inevitably something would bring down my server (e.g. power outage, bugs with OS, etc), just bad cell service. VaultWarden will not let you add new records or update existing records during that time. It happened 4ish times a year but when your family is dependent upon access, it’s just not worth the hassle and BitWarden is competivily priced. ---------------------------------------------------------------------- Warm_Feature_7302 · 2023-12-01 14:28 Honestly did not know they were seperate I should have not assumed. Donated to the Vaultwarden team and will continue to pay what I pay to bitwarden as well since they are the source ---------------------------------------------------------------------- ceciltech · 2023-12-01 14:42 Good point, I personally wouldn't call it level 10 but it would be annoying. ---------------------------------------------------------------------- ency · 2023-12-01 15:40 I "selfhost" a password manager called passbolt but I keep it on a VPS server just in case of a house fire or something else. But I honestly cant bring myself to trust it so use dashlane as my primary password manager. I dont trust my skills in securing a server, I dont trust my backup strategy well enough to make sure I can recover in any situation, I dont trust my hoster staying on line (hell I dont even trust my lab to stay up), I dont trust my hosters back up solution. There is just so much I dont trust. But I trust a company to at least have the money to buy the hardware or cloud services they need to stay up and pay for people smarter than me to keep things backed up and secure. whether they do that or not is not within my control no matter which vender I choose. But its a better possibility they are doing things right most of the time than me doing things right. ---------------------------------------------------------------------- ency · 2023-12-01 15:47 Not sure why you got down voted. You are absolutly correct. There is a reason IT is a team. The skills needed to do things right are wide and deep and it takes several people to do things correctly and stay up to date on the correct way. Then there is the hardware and software. Yes free and opensource solutions can be good and some times do a beter job than the big name venders but those would require a team to impliment configure and monitor. An enterprise grade IPS,IDS,SIEM solution is just mile ahead of what most normal people can host or afford in their home lab. Same thing with the network gear, servers, and storage. Yes one person can create a pretty cool solution but in the face of a determined attacker anything they can do is a minor speed bump. I'm not saying a company would do any better even with the budget and team to do things right. Just saying they have a better shot than just me mucking about in my lab every weekend. ---------------------------------------------------------------------- CobblerYm · 2023-12-01 16:06 I've seen 3-2-1-1 lately which includes 1 immutable backup. If your remote is a hot backup, its susceptible to ransomware where an immutable backup is impervious. ---------------------------------------------------------------------- Fratm · 2023-12-01 16:23 Still prefer to host it my self. Companies can suddenly go away and maybe you lose access to your data. ---------------------------------------------------------------------- SP3NGL3R · 2023-12-01 18:03 Because I hurt egos. People like to think they're smarter than a literal team of people trained for this stuff. Aw well. I don't care :). ---------------------------------------------------------------------- Internal-Initial-835 · 2023-12-01 18:04 Bitwarden has decent pricing but imho you can’t beat hosting your own especially if you’re hosting other stuff. I think about how much of a target they must have on them and if at some point, like others in the past, they will get compromised and leak your data. At least if it’s self hosted then it’s less of a target more than likely and you’re responsible for your own data. I don’t think there’s really a wrong answer. I’ve self hosted it for a long long time without issues and I can think of better ways to spend that money :) Each to their own though. ---------------------------------------------------------------------- wireframed_kb · 2023-12-01 21:06 Considering how many huge services figure among the leaks of my email and passwords (Dropbox, Adobe, LinkedIn to name a few), I’m not convinced a large better-secured target is more safe. Now granted, Bitwarden takes their security VERY seriously, but there’s that saying eventually everyone gets hacked. :) The odds of someone a) finding a private, self hosted service and b) finding an exploit and c) even bothering to try, is a LOT smaller than with a target you KNOW has a ton of high-value data. ---------------------------------------------------------------------- wireframed_kb · 2023-12-01 21:13 It’s worth noting the vulnerability in OwnCloud wasn’t the core product, but an extension called GraphAPI, as I understand. Which only has around 900 installs. It’s very serious, but also very limited in impact with so few installs. ---------------------------------------------------------------------- wireframed_kb · 2023-12-01 21:20 Seems like you’re creating MORE risk actually. You now have sensitive data in two locations instead of one, so twice the exposure. I’m not familiar with dashlane, but don’t they allow for encrypted backups? Seems like one solution you trust, along with a robust backup solution would be safer and less work. ---------------------------------------------------------------------- koi666 · 2023-12-01 22:56 Cool, thanks ---------------------------------------------------------------------- Global_Shock_1511 · 2023-12-02 01:18 Vaultwarden is easy to host. I recommend. I've been running with it for the last 2 years without a problem. Updates are easy, it's just 1 docker. Even if you have downtime, your password are still on your phone or in your browser so you don't necessarily need it to be up 100% of the time if that worries you. I recommend vaultwarden. Just do it. Try it. You can do it. Come on. Just this one time. It won't hurt. All your friends are doing, why not you. Don't be afraid, everyone does it. Come on man. ---------------------------------------------------------------------- WaLLy3K · 2023-12-02 01:37 Always support your favourite open source projects in some way, shape or form! ---------------------------------------------------------------------- ency · 2023-12-02 12:06 I'm not actually using the self hosted one. Like I said I cant bring myself to trust it or myself. I mostly set it up to kick the tires and see if I would ever feel comfortable using it. I figure in a year or so if I haven't done anything stupid or the developers haven't done anything stupid then I ""MIGHT"" give it a real go, but that time isn't now. Dashlane does allow for encrypted backups and I save regular backups in veracrypt files on and off site. So I'm good there. But I would really like to host and trust something myself. Its not that I think any other commercial password manager is safer. Its just that I trust them to at least try to be safer than me.