Hacker News Reader

Comment by zitsarethecure | Hacker News Reader

I keep wanting to switch to bitwarden from keepassxc, I created an account and installed the apps, but I just can't bring myself to actually upload all my passwords to someone else's computer. Am I just too paranoid?

View on HN

Bitwarden has a self hosted feature. I've been using that for a while now and I highly recommend it for a paranoid you.

Or use vaultwarden for a lighter-weight community-developed selfhosting option that is compatible with the BitWarden client apps.

I'm also using KeePass and I have my own NextCloud instance, and with the Android app + browser add-ons I have an as good experience as with cloud offerings, and maybe even better since I can also use it as an SSH agent to store my SSH keys.

But honestly with all the updates I'm putting off I'm probably actually more at risk, and a good password manager implementation will encrypt all passwords client-side so you're not actually uploading your passwords to anyone's computer.

It is not someone else computer. It is your password encrypted that get uploaded. Your passwords are only decrypted locally. Feel free to check their app for that :)

Unfortunately because of the way Bitwarden works you should consider your passwords compromised when Bitwarden itself gets hacked - regardless of vault encryption. Especially if you ever used the web login.

To access your account you need to type your master password, the same password that is used decrypt your vault. If a competent hacker gains access to the Bitwarden servers they could install a compromised login page that logs master passwords and with that gain access to password vaults.

Sounds far-fetched maybe, but your password security depends completely on the ability of Bitwarden to protect their servers. The encryption is just a minor hurdle once the servers are compromised.

Note that 2FA doesn’t help since it is not used for vault encryption.

If you never use the web frontend that should not be possible (unless the local app/browser extension send the full password over the wire and not the hash).

Right or wrong I like the way you think.

> Feel free to check their app for that

First-party end-to-end encryption is broken by design, especially in the presence of auto-updating.

I too was too paranoid for that. Digital ocean has a bitwarden instance that you can host yourself[1]. It's still somebody else's computer, but it's your tiny instance, your subdomain, etc. It's like $9/month maybe? But I put my kids on there too. $3/month for a pretty robust, cloud-based password manager with a tiny attack vector is worth the money to me.

[1] https://marketplace.digitalocean.com/apps/bitwarden

There was a recent thread about that, and yeowzers they're doing some questionable devsecops in that installation mechanism: https://news.ycombinator.com/item?id=31098608

Vaultwarden is a self-hosted bitwarden server. It's very light weight and can be simply run in docker.

Second this. Also has a Real nice community and a matrix channel where people will help you out

And it can run on a Raspberry Pi! The DB can be hosted in SQLite (the default) or Postgres, as opposed to Bitwarden which requires MSSQL, which is not compiled for ARM.

I am not well-versed on self hosting but interested in doing it. If I run Bitwarden on a Raspberry Pi and if the Pi breaks (let's say it completely stops working), will the passwords be unrecoverable?

You'd still have a copy of the database on any device that was running the client.

I'm hosting bitwarden in a docker container running on my synology nas. Loving it so far.

You can have the best of both worlds. If Bitwarden's datacenters got corrupted/wiped/hacked/ransomware'd you can have a Keepass DB which mirrors all your Bitwarden creds, and stored locally / synced to a few cloud servers.

The caveat being: you have to manually copy over any credentials from Bitwarden to Keepass, which is time consuming but one day maybe worth it.

> you have to manually copy over any credentials from Bitwarden to Keepass

pass-import works pretty well; create an initial empty KeePass DBX file first and keep a copy to re-use, then one can re-run pass-import to import BW to a fresh KDBX on a recurring basis with a simple script.

[1] https://github.com/roddhjav/pass-import

That's a neat tool. But I meant when you create a new credential entry, you have to manually mirror it in Keepass each time you add something in Bitwarden. Doing an import just for one entry is overkill.

It's just an encrypted blob that's uploaded, not your passwords.

There's a self-hosted alternative, but even so, I'd trust them to handle server security better since, since it's their speciality.

I'd suggest adding Yubikey as 2-factor, then anyone would need that physical key to login.

If you're considering self-hosting anything, you might consider using https://www.passwordstore.org/.

Personally, I've used it since lastpass made people pay for multi-device access. You can treat it like a git repo that's encrypted at rest. Client implementations are pretty quality in my window of experience (on linux+ff, mac osx+ff, iOS+safari).

The security problem reduces to "how do I securely store a private key that I use every day", which is a well-understood problem with a well-documented set of solutions.

As a Keepass user, The bitwarden desktop client is very feature lacking. It provides very little over just the browser interface.

There's no desktop autofill or autotype and no SSH key management.

I love Bitwarden. What I do is self-host an instance, available only on my network (so not open to the world). Whenever I’m home and I use Bitwarden on any of my devices they sync automatically. I’ve found this use pattern to be pretty good from a “devices are up to date” perspective. I get all the benefits of “cloud sync” across my devices without worrying about a service breach.

Assuming the vendors are not lying, then the setup for these services is that your master password encrypts all data before it is sent to the server, and the service cannot see your master password or any of your contents.

That said, I use KeePass on Windows and Android, sync my safes once a month/as needed, and call it a day.

I used to think the same thing but had my keepass DB on a dropbox folder, so all my computers had easy access to it. This is the same as how bitwarden works.

Reply on news.ycombinator.com