Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

My wife and I have a number of accounts we share a single credential for. There are a surprising number of services we access as parents that don't have the concept of shared ownership of content on the server side.

I'd bet there are other use cases as well. Off the top of my head, Hello Fresh also doesn't allow more than one login to manage the same subscription.

Fedex/UPS only lets one account get detailed tracking numbers for an address, so I need to share my Fedex account. To check and pay my freeway tolls I'm only allowed a single account - so it gets shared. Plenty of people share all sorts of subscriptions, be they to Netflix, the New Yorker, or more. I need to share access to my insurance, to the utility bills, to sporting event tickets, to grocery store and pet food orders. On and on and on.

For personal use: none for me. Instructions for deriving/obtaining my master password and physical key will be made available in any will or power of attorney documentation I get around to drawing up.

In DayJob there are several, though they are usually only temporary needs, such as:

1. We often get sent password-protected documents by clients, that more than one of us needs to read. It pains me how often I see an attached document on an email containing the password needed to open it… A shared password manager where someone can record the credential and mark who should be able to access it (or better have all credentials encrypted by the public keys of those who should be able to access them rather than just trusting a flag) would be less daftly insecure.

2. Distributing initial credentials for new assets or to new people, where those assets are not integrated with single-sign-on so nothing needs to be distributed anyway.

There are other ways to manage such situations of course, but a password management arrangement with a well-defined way of sharing credentials may encourage behaviour more secure than some of the ad-hoc solutions people regularly use.

At work we use hashicorp vault, ansible vault, and cyberark for different things, but I still store my stuff in keepass. For personal use, I use keepass on dropbox, and it's worked incredibly well for almost 15 years now.

There's plenty.

> I sure hope not.

Why? I'm not suggesting to have an extension that has access to your file system. Bitwarden has browser extension that communicates to Bitwarden vault via HTTP and it's easy to autofill passwords or generate new credentials.

For throwaway accounts or demo accounts or any kind of new web service/app accounts, it's easy to memorize username and autogenerate a strong, safe password which are saved to vault.

You have the access to that same vault from a different device (smartphone etc), it makes interacting with passwords and its storage extremely easy and without mistakes.

I have quite a few shared passwords in my "family" vault in Bitwarden. Utility websites (electric, gas, water, internet, etc), streaming services, banking, credit cards, mortgage, car payments, car insurance, Chewey (manage pet food auto ship), probably others.

Also, adversarial does not refer to just possibly breaking encryption, it also applies to daily continuity. I trust my ability to keep a small encrypted password database safe more than I trust some random companies to get bought or change their business model and suddenly I have to decide between a massive Flag Day or paying for something I did not have to before or having some kind of other unwelcome limitation placed on me.

I like controlling my own destiny, thank you very much.

There seem to be some other Docker features used, like healthcheck [0], and MariaDB seems to be installed, too, so it might be worth considering how much additional OS-dependent complexity would the equivalent functionality without using Docker require. At the very least, you need some kind of service manager to run your program on boot, and restart it on error. At that point, Docker may as well be used as a glorified service manager - just slap your static binary in a `FROM scratch` container, and you're done.

> I am not a fan of this kind of redundancy and opaqueness.

Me neither. But I wouldn't blame Docker itself - it's just a tool. If it wasn't for Docker, some other way of circumventing good engineering would be found :-)

[0] https://github.com/dani-garcia/vaultwarden/blob/main/docker/...

That said, I am skeptical of running it on a PiZero. I could see running it on a Pi3 or Pi4 where I can leave it connected to my network and cron backups to a NAS.

The BitWarden documentation itself shows 12 containers running. https://bitwarden.com/help/install-on-premise-linux/

Is there a way to do it without backing up all the os packages?

With docker I can stop the service, then snapshot its data volume, then restart it. And restoring is very easy.

I have no idea how to get that workflow at an os level without a vm manager.

The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden. If you want to install native binaries, you're going to have to git fetch/checkout/pull the latest release tag and run `cargo build --features sqlite --release` yourself. Doable in a cronjob, but it'll probably take a compile to build a system like vaultwarden on a low-power ARM core.

I also don't really like leaking internal network info in my external DNS provider which is why I run my own internal DNSes. And I use a domain for my internal network which does not really exist in the real world, I don't know if letsencrypt can handle this.

I have indeed not tried it recently, the last time I tried it it was about 1 year since they launched. Trying to script all the firewall rules to open the ports for a second was a real PITA.

I'll have a look at this, thanks for the heads-up.

There's still no good solution if you're using a domain that's not valid on the net. LE's lookup has to be able to reach the DNS server for the domain. I think it's something the industry as a whole has failed at - ensuring even LAN devices have good security without doing things like "your home network must have a publicly resolveable domain" or "run your own CA".