4 ms·

They also give you the option to self-host, so you don't have to trust their hosting service if you don't want to. Own your data!

Someone1234 7y ago
Can you trust your own hosting though? Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. It is easy to misconfigure Linux to be insecure, most distro's ship with too much software, and auto-update is often inadequate to maintain a secure environment. There's far too many compromised Linux servers out in the world that people set up "to do one thing" turned on auto-update and then forgot about for years. Botters and spammers love them. This has little to do with Bitwarden itself and everything to do with how much knowledge and time is required to correctly run any internet accessible server. People are inherently lazy and it is very easy to get apathetic when it just continues to work, until something bad happens.
- toofy 7y ago
  > Can you trust your own hosting though? Some people, organizations, or groups can, absolutely. While this is definitely a valuable question to ask, self-hosting is still valuable for many. Also, as we have seen repeatedly, assuming a random company will devote resources towards security can be a very silly assumption.
- kllrnohj 7y ago
  > Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. Yes it is. It's a docker image, you're not setting up anything about the host that's exposed to the internet. Toss on watchtower to auto-update it and why would you ever need to touch it again? The system hosting docker isn't getting updates, no, but it's not publicly reachable, so that's low risk. The system that is publicly reachable is entirely contained & auto-updated, so that's covered. What else is there to worry about?
  - Someone1234 7y ago
    You just repeated back the exact problem scenario I set out above but abstracted it into a Docker container, adding an additional point of failure, and then called it a solved problem. Sorry, but nope. The Docker container itself is a fully functional machine. It also holds your most prized data (password database/password host). Turning on auto-updates and watchtower then leaving it unmaintained indefinitely was exactly the problem I was posting about above. Scary that people think Docker is a security solution. It isn't. The Docker container is a full machine. The Docker host is a full machine. You've now doubled your points of failure and are zero percent more secure.
    - kllrnohj 7y ago
      > Turning on auto-updates and watchtower then leaving it unmaintained indefinitely was exactly the problem I was posting about above. What? It's not unmaintained at all. It's continuously maintained by the updates to the container. That's the whole point. Just because the user that did the deployment isn't the one doing the maintenance doesn't mean it's unmaintained. The end-user isn't the one building the docker container, maybe that's where you're getting confused. Bitwarden themselves are maintaining it. That's how they are shipping the software for self-hosted deployments. Professionally maintained and self-hosted. That's why docker enters the picture, not for some imagined security reason as you incorrectly claim.

Someone1234 7y ago

Can you trust your own hosting though? Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. It is easy to misconfigure Linux to be insecure, most distro's ship with too much software, and auto-update is often inadequate to maintain a secure environment. There's far too many compromised Linux servers out in the world that people set up "to do one thing" turned on auto-update and then forgot about for years. Botters and spammers love them. This has little to do with Bitwarden itself and everything to do with how much knowledge and time is required to correctly run any internet accessible server. People are inherently lazy and it is very easy to get apathetic when it just continues to work, until something bad happens.

toofy 7y ago
> Can you trust your own hosting though? Some people, organizations, or groups can, absolutely. While this is definitely a valuable question to ask, self-hosting is still valuable for many. Also, as we have seen repeatedly, assuming a random company will devote resources towards security can be a very silly assumption.
kllrnohj 7y ago
> Maintaining a single node just for a Bitwarden service isn't a "set and forget" endeavour. Yes it is. It's a docker image, you're not setting up anything about the host that's exposed to the internet. Toss on watchtower to auto-update it and why would you ever need to touch it again? The system hosting docker isn't getting updates, no, but it's not publicly reachable, so that's low risk. The system that is publicly reachable is entirely contained & auto-updated, so that's covered. What else is there to worry about?
- Someone1234 7y ago
  You just repeated back the exact problem scenario I set out above but abstracted it into a Docker container, adding an additional point of failure, and then called it a solved problem. Sorry, but nope. The Docker container itself is a fully functional machine. It also holds your most prized data (password database/password host). Turning on auto-updates and watchtower then leaving it unmaintained indefinitely was exactly the problem I was posting about above. Scary that people think Docker is a security solution. It isn't. The Docker container is a full machine. The Docker host is a full machine. You've now doubled your points of failure and are zero percent more secure.
  - kllrnohj 7y ago
    > Turning on auto-updates and watchtower then leaving it unmaintained indefinitely was exactly the problem I was posting about above. What? It's not unmaintained at all. It's continuously maintained by the updates to the container. That's the whole point. Just because the user that did the deployment isn't the one doing the maintenance doesn't mean it's unmaintained. The end-user isn't the one building the docker container, maybe that's where you're getting confused. Bitwarden themselves are maintaining it. That's how they are shipping the software for self-hosted deployments. Professionally maintained and self-hosted. That's why docker enters the picture, not for some imagined security reason as you incorrectly claim.