this post was submitted on 15 Nov 2023
3 points (100.0% liked)

Self-Hosted Main

502 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
[email protected]
3
What is the point of vaultwarden? Is it safer or less safe than using the bitwarden app/website? (alien.top)
submitted 10 months ago by [email protected] to c/[email protected]
40 comments fedilink hide all child comments
 

Not sure I understand why you'd want to self host a password manager. Bitwarden has never been breached AFAIK. How is it better or safer to keep if self hosted?

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 1 points 10 months ago (1 children)

Bitwarden has never been breached AFAIK.

What you mean is it hasn't been breached *yet*.

All commercial password managers have a huge, fuck off, target on their backs

Nobody is going to come after some random blokes self-hosted password manager to get access to their Sonarr (I'm trivialising to make the point) as long as if a similar effort would get them into Bitwarden.

It's the same principal as bears in the wood - nobody needs to outrun a bear, just your companion

[–] [email protected] 1 points 10 months ago (3 children)

OK, thanks for the solid answer. I suppose the core of my question was that pretty much: is it just as secure AND a less likely target than bitwarden. That makes a lot of sense to me. I would probably still worry about the strength of the code , though. Do we know if/how it's been audited?

[–] [email protected] 1 points 10 months ago (1 children)

OK, thanks for the solid answer. I suppose the core of my question was that pretty much: is it just as secure AND a less likely target than bitwarden. That makes a lot of sense to me. I would probably still worry about the strength of the code , though. Do we know if/how it's been audited?

I mean, your best having a look at the official Git but, i'd say, access/visibility is the most important.

Is it on your LAN/not open then even if it was less secure, it'd still be more secure if you know what I mean.

I host mine on a VPS but it's behind traefik with authelia (and 2FA). Plan is to get fail2ban setup over the next couple of evenings. SSH is cert only, probably going to change the port too but not sure if that's really necessary. I'm comfortable exposing on that basis.

[–] [email protected] 1 points 10 months ago (1 children)

change ssh port, put an ssh tarpit on the default

[–] [email protected] 1 points 10 months ago (1 children)

What is a tar pit do? Does it maintain logs of people trying to access or something? Sorry I'm not very knowledgeable about this.

[–] [email protected] 1 points 10 months ago

It responds glacially slowly to login attempts, which means the bot trying to automatically break into random servers it crawls to gets stuck trying to login. Thus a tarpit.

[–] [email protected] 1 points 10 months ago (2 children)

The code is as good as bitwardens, and even better, everyone can see the code to review it's vulnerabilities and fix them.

What is a major factor is you're far less likely to be of interest to a hacker. So whilst crunching numbers to crack bitwarden encryption may make some sense...it makes absolutely zero sense to spend that time to hack mine.

[–] [email protected] 1 points 10 months ago

Yeah it sounds pretty appealing. I think I'll make the switch when my bitwarden sub runs out

[–] [email protected] 1 points 10 months ago

Have there been audits if vaultearden code? Or comparison with bitwarden code? Otherwise I am curious on what do you base that code is as good as bitwarden?

[–] [email protected] 1 points 10 months ago

Also the vault is en/de crypted on device so the code never sees your passwords