3 ms·

For years I've discouraged use of clouds for storing passwords. But because Bitwarden is FOSS software, encrypts data on the client, has good cross-platform sup

For years I've discouraged use of clouds for storing passwords. But because Bitwarden is FOSS software, encrypts data on the client, has good cross-platform support, and can operate if the company goes out of business they have won me over for the storage of secrets I'm not reserving for the sneakernet.

bad_user 8y ago
Last time I checked Bitwarden was not encrypting data on the client. Did that change? Also, OSS does not mean secure. Without audits from security experts, I can’t trust it. Bitwarden is objectivity less secure than 1Password or Keepass actually, at the very least because it doesn’t have a desktop application.
- number6 8y ago
  Bitwarden has a desktop client. If you are hosting it on your private server does it change your outlook on its security?
  - bad_user 8y ago
    No, it’s worse.
    - zouhair 8y ago
      Very thorough argument.
      - bad_user 8y ago
        Matches the question, but should be obvious why. I do not have the inclination or resources to secure and keep my server up to date, unless we are talking about a periodic "apt upgrade" that I could configure to run automatically, but no more than that. And at the very least I know how to reasonably secure a Linux server, at least initially. If running your own server gives you peace of mind in terms of security, then read more about how security works and the threat model you'll face. Just to give an obvious example ... running your own Wordpress is one of the worst thing you can do on your own server, putting your whole server at risk, not just your website.
        LyndsySimon 8y ago
        > running your own Wordpress is one of the worst thing you can do on your own server, putting your whole server at risk, not just your website. My personal experience says this is 100% true. Even when I've managed to stay on top of WP updates my server is invariably targeted more often by automated attacks more often than others that are hosting static sites and other frameworks. I strongly suspect that attackers maintain lists of server addresses that host WordPress sites and use that to make assumptions about their running services. If they know that it's a "self-hosted" webserver, even if they can't break WordPress there's a very good chance that some other unmatched vulnerability exists.
        chme 8y ago
        > If running your own server gives you peace of mind in terms of security, then read more about how security works and the threat model you'll face. I don't know about this argument. On the one hand you can configure something as secure as you like/can, on the other hand you have to trust other people to do their best. If you don't trust them with your passwords, you would also not trust them to do their best. If you host yourself a paranoid me would host their instance accessible only inside a stable VPN xor by tunneling a port via SSH.
- cjh_ 8y ago
  > Since all of your data is fully encrypted before it ever leaves your device, only you have access to it. Not even the team at Bitwarden can read your data, even if we wanted to. Your data is sealed with end-to-end AES-256 bit encryption, salted hashing, and PBKDF2 SHA-256. From the linked page (https://bitwarden.com/ https://bitwarden.com/)
- edf13 8y ago
  Your right in the aspect that OSS does not mean secure... don't agree with the down-votes here. OSS can often mean less secure. Unless you have the capabilities to fully audit the software you shouldn't fully trust OSS... unless it has an external audit.

bad_user 8y ago

Last time I checked Bitwarden was not encrypting data on the client. Did that change? Also, OSS does not mean secure. Without audits from security experts, I can’t trust it. Bitwarden is objectivity less secure than 1Password or Keepass actually, at the very least because it doesn’t have a desktop application.

number6 8y ago
Bitwarden has a desktop client. If you are hosting it on your private server does it change your outlook on its security?
- bad_user 8y ago
  No, it’s worse.
  - zouhair 8y ago
    Very thorough argument.
    - bad_user 8y ago
      Matches the question, but should be obvious why. I do not have the inclination or resources to secure and keep my server up to date, unless we are talking about a periodic "apt upgrade" that I could configure to run automatically, but no more than that. And at the very least I know how to reasonably secure a Linux server, at least initially. If running your own server gives you peace of mind in terms of security, then read more about how security works and the threat model you'll face. Just to give an obvious example ... running your own Wordpress is one of the worst thing you can do on your own server, putting your whole server at risk, not just your website.
      - LyndsySimon 8y ago
        > running your own Wordpress is one of the worst thing you can do on your own server, putting your whole server at risk, not just your website. My personal experience says this is 100% true. Even when I've managed to stay on top of WP updates my server is invariably targeted more often by automated attacks more often than others that are hosting static sites and other frameworks. I strongly suspect that attackers maintain lists of server addresses that host WordPress sites and use that to make assumptions about their running services. If they know that it's a "self-hosted" webserver, even if they can't break WordPress there's a very good chance that some other unmatched vulnerability exists.
      - chme 8y ago
        > If running your own server gives you peace of mind in terms of security, then read more about how security works and the threat model you'll face. I don't know about this argument. On the one hand you can configure something as secure as you like/can, on the other hand you have to trust other people to do their best. If you don't trust them with your passwords, you would also not trust them to do their best. If you host yourself a paranoid me would host their instance accessible only inside a stable VPN xor by tunneling a port via SSH.
cjh_ 8y ago
> Since all of your data is fully encrypted before it ever leaves your device, only you have access to it. Not even the team at Bitwarden can read your data, even if we wanted to. Your data is sealed with end-to-end AES-256 bit encryption, salted hashing, and PBKDF2 SHA-256. From the linked page (https://bitwarden.com/ https://bitwarden.com/)
edf13 8y ago
Your right in the aspect that OSS does not mean secure... don't agree with the down-votes here. OSS can often mean less secure. Unless you have the capabilities to fully audit the software you shouldn't fully trust OSS... unless it has an external audit.