16 ms·

Bitwarden_rs: Unofficial Bitwarden compatible server written in Rust

232 points by xearl 6y ago

steviedotboston 6y ago
Something about running your own password manager server seems very risky to me.
- sneak 6y ago
  The desktop[1] and mobile clients have a local database, so if the server is offline, you still have all of your data, you just can't sync. [1]: Note that the Bitwarden desktop client has a major remote code execution vulnerability that the developer has closed WONTFIX, so I don't recommend running the stock one without patching that out (as well as the spyware they embed in it).
  - teekert 6y ago
    Any more information on your claims? This is the first time I hear of this...
    - sneak 6y ago
      https://github.com/bitwarden/desktop/issues/552 https://github.com/bitwarden/desktop/issues/552
      - teekert 6y ago
        Ah yes, the trust-the-developers-blindly vs patch asap vs supply chain attack risks. I wonder if we have any data on what is best. I once had to re-do a Drupal install because it was very likely already being abused. Would have liked immediate auto-update in that case. Ah well.
        sneak 6y ago
        Password managers and OSes are things that I do not want automatically updating at the whims of some remote/foreign party whom I have never met and is bound by a set of responsibilities and laws with which I am entirely unfamiliar. Network services open to the internet at large are a horse of a different color. Ultimately, though, they could just ask. Most users probably want autoupdate, and they can opt in to that if they so desire. It's really a matter of consent, and forcing decisions down users' throats. Most people probably don't understand or believe that they are granting these applications' vendors permanent remote access to their computer. Honestly, I wish it were only a matter of trusting the developers. Unfortunately, it's a matter of trusting the developers, anyone from anywhere in the world who can compromise their keys/credentials, and anyone in meatspace who can coerce them to misuse those keys/credentials (such as military, police, et c). That, it turns out, is a rather large set of people, especially when you factor in the number of state level actors from every country big enough to have an intel agency sufficiently competent to own some small software house full of c# weenies running windows (the bitwarden devs).
        teekert 6y ago
        And yet you are using a product at the whims of some remote/foreign party whom you have never met and is bound by a set of responsibilities and laws with which you are entirely unfamiliar. I get where you are coming from, but you clinking "update" in stead of the dev does not guarantee the safety of the update.
        sneak 6y ago
        This is a false dichotomy. Nobody is claiming that mindlessly clicking "update" guarantees safety. I run a private fork of the bitwarden client, anyway. Their stock one partially trusts the iteration count of the PBKDF provided by the server, and can be tricked into sending a low-iteration hash of the master password.
        UncleMeat 6y ago
        It isn't universal, but browsers surely provide a good case study here. Most of them auto-update today. In the past, exploitation via bugs where patches existed but people didn't update was measurably common. Supply chain attacks against autoupdating browsers haven't really materialized. If the goal is to prevent the most volume of exploitation, autoupdaters clearly win.
  - bri3d 6y ago
    Not linking to the "major RCE vulnerability" is sensationalist posting at its finest. I can assume you are referring to... the automatic updater? https://github.com/bitwarden/desktop/issues/552 https://github.com/bitwarden/desktop/issues/552
    - ryan29 6y ago
      What other options would there even be for updates? That bug report describes every updater I've ever seen.
      - sneak 6y ago
        You are misunderstanding the issue. It's not asking before the update (as most programs that prompt you to update do). By the time that dialog box is displayed, the application has already replaced itself on disk (with code chosen arbitrarily by the bitwarden developers, or anyone in possession of their credentials), and the new code will be executed automatically without user intervention the next time the app is launched, which happens automatically if the computer is rebooted (like if there is a momentary power failure, or you hit "okay" on an OS update, or your battery dies and later you plug it back in to power). This grants the developers (as well as anyone who can compromise their credentials) unlimited remote access to your entire password vault the next time you unlock it.
        bri3d 6y ago
        Sure, I see where you're coming from. I think your approach makes you come off as not very credible, though. Plus, it puts developers on the defensive and won't cause them to cooperate. A simple "I'm not comfortable with code on my machine being updated remotely without my approval, because I believe an attacker could infiltrate the supply chain" explains the problem you're having more precisely and turns into a simple feature request (turn off the auto-updater - which is already possible, as documented in that thread!) rather than trying to convince an entire industry that a commonly accepted practice (installation of signed remote updates) amounts to 0day RCE by putting them on the defensive.
        6y ago
malsanton 6y ago
I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?
- killingtime74 6y ago
  Especially since bitwarden itself is already open source. This is a great learning project probably but not great for use
  - joaopms 6y ago
    The greatest thing about this implementation is its simplicity. I actually deployed this server for my personal use because everything lives in one Docker image and not a lot of them like the official implementation. I do understand that the official implementation helps with scalability and more, I just don't need it.
  - Nullabillity 6y ago
    The official Bitwarden server depends on MSSQL.
- BiteCode_dev 6y ago
  Same with basically any part of your infra. What prevents Postgres mainteners to just still all your DB ? Nginx mainteners to redirect your web traffic ? Ultimately, it boils down to a balance between trust in the author, the community or your own checking process.
- novium 6y ago
  If I'm not mistaken it should be mostly fine as long as you trust the desktop/phone versions of Bitwarden not to send off the (unhashed) key to the server Edit: Noting that there have been discussions about the default number of iterations. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52
fraktl 6y ago
I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach out to maintainers to see whether the feature could be implemented and paid for their effort but.. let's just say the answer was "No.". Long story short - we use official Bitwarden and are paying for it and couldn't be happier. Bitwarden_RS looks like a cool toy, but I can't see any reason why anyone would run it. It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road.
- rbut 6y ago
  I run bitwarden_rs for exactly the reason you stated, for personal passwords. It took a few seconds to add to my portainer (docker) server and now I host my vault and keep it safe within my LAN.
- fullstop 6y ago
  I ran bitwarden_rs for a bit on a digital ocean node, but ultimately decided to buy a premium membership because it was less than $5/mo and I think that they will do a better job securing the system and keeping things up to date than I would in my spare time.
- Macha 6y ago
  > It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road. It's a trust issue. I don't trust my passwords on someone else's server. I don't trust free services to remain free forever. I don't trust paid services to not increase the fees 4x over a few years. The alternative to bitwardenrs or bitwarden/server is not bitwarden.com for me given the areas I'm concerned with, it's going back to KeePass + Syncthing. I think the reticence to provide the group features in bitwarden_rs may come from being unwilling to too blatantly step on the toes of Bitwarden LLC by producing a $0 drop in alternative to their paid service. bitwarden_rs is open source and bitwarden/server is _mostly_ open source (Some SSO related features are not), so it seems worthwhile to get along and not need to fork the ecosystem.
Black101 6y ago
a simple rsync client that could extract passwords from the data would be nice
- Spivak 6y ago
  Bitwarden has a CLI tool which is pretty good.
  - Black101 6y ago
    what I mean is that why do you need bitwarden at all?
    - masklinn 6y ago
      Ensure that the data is stored securely, integrate with the various password-manager hooks of OS and browsers, generate passwords, …
    - f154hfds 6y ago
      This is going to sound sketchy because any software project involving cryptography is automatically sketchy unless it has hit some nebulous and ill-defined 'accepted' status, but I've been working on a CLI tool to manage my passwords for a while that I'm honestly not ready to share, but the architecture so far is very simple: Each 'service block' is an encrypted file consisting of service name, service password (autogenerated), kv-store, some metadata for regenerating new passwords. The key to each service block is the hash of a primary password. The name of the 'service block' file is the hash of the service name. All of the service blocks are stored together in a folder that can be rsynced wherever. My worry is obviously in the crypto. While I'm not doing anything too fancy I worry about timing attacks because an attacker will have the full encrypted block so the system is vulnerable to that sort of thing.
    - michaelt 6y ago
      There are many other options for password management that are very similar. Writing them down in a notebook next to your computer. A homebrew system like e-mailing GPG-encrypted files to yourself. Your browser's built in password saving and sync features. A password-protected Excel spreadsheet on your dropbox. Compared to a notebook, I can access my passwords from my phone if the need arises, and they're encrypted and backed up should I lose my phone. Compared to a homebrew system, someone else has done the work and made a cross-platform system with nice browser extensions, sensible defaults, and so on. Compared to my browser's sync features, there's peace of mind because it's not a free feature from a corporation famous for nonexistent customer service and sketchy tracking practices. Compared to dropbox, the price is trivial (as they only have to store a few kilobytes of data) and it's focused on security.
polote 6y ago
There is really something broken in the dev word. Why are people wasting their time rebuilding things that already exists ? If that was a side project to learn Rust, to learn the API of bitwarden, or to add new features I would understand, but that doesn't seem to be the case. I'm really curious why? "perfect for self-hosted deployment where running the official resource-heavy service might not be ideal" is that really the reason ?
- colejohnson66 6y ago
  Because sometimes people do things just because they can. Not every programming project needs to make sense.
  - eeZah7Ux 6y ago
    Unfortunately fragmenting the opensource ecosystem with too many implementations harms it.
    - coldtea 6y ago
      People don't always give a fuck about the "opensource ecosystem", they just want to program something they find fun...
      - eeZah7Ux 6y ago
        Unfortunately a lot of people don't give fucks about others. Publishing a weekend fun project on github and taking contributors away from from other projects is not always nice. If it's just a "fun project" put a clear warning that it's not meant to be trusted, used, contributed to. Github, by design, defaults to showing issue trackers & so on, giving the impression that a project is "real". Then you go looking for something to use and find 100 half alive projects instead of 2 good ones.
        anaganisk 6y ago
        Whatever happened to opinions of people, likes and interests. So what if its fragmented? Isn't forking a crucial thing in open-source anyone can build and support whatever the fuck the want. There are thousands of other tech forums why do we need hacker news to fragment tech community.
holtalanm 6y ago
I switched to Bitwarden when LastPass changed their policy for multi-device users. I'm happy to say the transition was completely painless.
- CraigJPerry 6y ago
  Even their CSV import worked flawlessly and my CSV export from Lastpass looked like a train wreck to parse but everything is present and correct in bitwarden.
- koheripbal 6y ago
  Did you consider KeePass or one of the variants?
  - FlyingSnake 6y ago
    I use KeePass on one of my projects and I find Bitwarden much better than KeePass. We're moving to Bitwarden soon to keep it seamless across teams.
  - hojjat12000 6y ago
    I'm using KeePass. On Linux, windows and android and Google drive to sync the database. it is a hassle. The graphics look terrible. And most of the times the keeweb plugin doesn't really work on Firefox and I have to copy paste the password. But I have been using it for a long time now and got used to it. The best thing about it is the plugin system. I would not suggest it, I think bit warden does all of this and is a lot more user friendly.
  - cocoa19 6y ago
    I do use KeePass for work, since we're not authorized to put passwords on the cloud, but device synchronization and browser auto fill is a pain. For personal, Bitwarden is much better. Browser plugins just work, android auto fill just works, passwords synchronized across devices, support for auto filling payment information. 2FA support.
    - 6y ago
Shish2k 6y ago
I switched to using this because keepass didn’t have a good way of syncing its database with iOS devices, and the official bitwarden server has too many moving parts (including MS-SQL with no support for open source databases??) - aside from missing ssh-agent support, I’m loving all of it :)
- chipsa 6y ago
  SQL isn't as portable as people would like. Especially when you're trying to stay high performance as you're dealing with millions of customers. Once you start building for a specific SQL server, it hard to switch to another variant.
teekert 6y ago
I set it up in a couple of minutes using Docker-compose with Traefik. I love that Bitwarden has clients and plugins everywhere (FF and iOS being most relevant to me) and I can self-host. The sweetspot for me. I have had too many conflicts with my KeepassXC database on Nextcloud in the past, time for a solution with integrated sync. Btw the "custom server" setting is a bit hidden, it is behind the cogwheel in the upper left in most cases.
FlyingSnake 6y ago
Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.
- jamienicol 6y ago
  Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.
  - viro 6y ago
    I had to same thought so I put behind a VPN. a little less convenient. but WAY more secure
  - yepguy 6y ago
    Just connect to it via wireguard or tailscale instead of exposing it to the entire internet.
    - alias_neo 6y ago
      Bingo. If you're going to host services as home such as your password manager, set up a WireGuard VPN, you can use a Pi and it'll be perfectly sufficient, leave only the VPN open on the internet, VPN in from your phone, laptop, whatever for anything you need access to, and you don't need to rely on Nextcloud or Bitwarden having vulnerabilities discovered in them. I was using Nextcloud previously for password sync because my password manager needs WebDAV, it was too much to maintain so I wrote a small server in Golang using the WebDAV library and it sits behind NGINX which handles the auth. I run Minio (S3 compatible) for syncing our family photos from our phones and Folder Sync app on Android. They both run on a VM and write out to a ZFS pool. I have a Pi 3B+ running Raspbian mounted read-only as a WireGuard VPN for remote access, and we use the official WireGuard app. VPN is always on because we have fast, symmetric fibre, and we don't need to worry about trusting public networks.
ErneX 6y ago
I use it and it's great. Best way to self host it imo.
AnIdiotOnTheNet 6y ago
My company used to use the unmaintained "CorporateVault", but switched to Bitwarden_rs after Flash (which CorporteVault used for copying to the clipboard) was deprecated. Bitwarden_rs was chosen because it had a relatively painless install compared to pretty much everything else I looked at, requiring only one Docker container. It's not bad.
- rubatuga 6y ago
  You don’t even need docker if you build from source
  - AnIdiotOnTheNet 6y ago
    Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.
    - denysvitali 6y ago
      It really depends. Go and Rust softwares are generally easy to build from source
      - dbt00 6y ago
        Yes but coming from a go or rust neophyte to trusting that you've installed correctly from source is probably a higher bar than knowing that you've run a container correctly.
      - AnIdiotOnTheNet 6y ago
        I was trying out a bunch of different similar products, I was not going to set up a build environment just to test software. I immediately disqualified anything that required I build it from source. Of the ones that didn't, very few had working install documentation and I wasn't going to fix it for them just to try out their product. I did open issues on their trackers about it for them, not that they cared since nothing has been done. Bitwarden_rs was the one that had working install documentation that didn't require a build environment. It met our requirements in testing, so I deployed it to production.
deleted 6y ago
[deleted]
imwillofficial 6y ago
Even if using this, remember to get a bitwarden license. It’s $10 for a whole year and keeps their dev afloat.
- dastx 6y ago
  Please please please do this. I have plenty of issues with their prioritisation but at the end of the day, Bitwarden is extremely cheap, and is a great product. There is little to no reason to not pay that $10 a year.
- mjthompson 6y ago
  I use 1Password and still pay for a Bitwarden licence to support development of a viable open source alternative.
  - imwillofficial 6y ago
    This is awesome, low barrier to entry, high quality product.
    - deleted 6y ago
      [deleted]
- gyvastis 6y ago
  Just subscribed to Bitwarden. Was long overdue! Need to give back.
wufocaculura 6y ago
anyone moved from Keepass(XC) to bitwarden? I do see advantage of being cloud based as a way to avoid database conflicts (in my case 3 windows machines + mobile), but I wonder what can surprise me here. Is bitwarden's browser integration similar to KeepassXC (Keepass helper + KeepasXC-browser)?

232 points by xearl 6y ago

steviedotboston 6y ago

Something about running your own password manager server seems very risky to me.

sneak 6y ago
The desktop[1] and mobile clients have a local database, so if the server is offline, you still have all of your data, you just can't sync. [1]: Note that the Bitwarden desktop client has a major remote code execution vulnerability that the developer has closed WONTFIX, so I don't recommend running the stock one without patching that out (as well as the spyware they embed in it).
- teekert 6y ago
  Any more information on your claims? This is the first time I hear of this...
  - sneak 6y ago
    https://github.com/bitwarden/desktop/issues/552 https://github.com/bitwarden/desktop/issues/552
    - teekert 6y ago
      Ah yes, the trust-the-developers-blindly vs patch asap vs supply chain attack risks. I wonder if we have any data on what is best. I once had to re-do a Drupal install because it was very likely already being abused. Would have liked immediate auto-update in that case. Ah well.
      - sneak 6y ago
        Password managers and OSes are things that I do not want automatically updating at the whims of some remote/foreign party whom I have never met and is bound by a set of responsibilities and laws with which I am entirely unfamiliar. Network services open to the internet at large are a horse of a different color. Ultimately, though, they could just ask. Most users probably want autoupdate, and they can opt in to that if they so desire. It's really a matter of consent, and forcing decisions down users' throats. Most people probably don't understand or believe that they are granting these applications' vendors permanent remote access to their computer. Honestly, I wish it were only a matter of trusting the developers. Unfortunately, it's a matter of trusting the developers, anyone from anywhere in the world who can compromise their keys/credentials, and anyone in meatspace who can coerce them to misuse those keys/credentials (such as military, police, et c). That, it turns out, is a rather large set of people, especially when you factor in the number of state level actors from every country big enough to have an intel agency sufficiently competent to own some small software house full of c# weenies running windows (the bitwarden devs).
        teekert 6y ago
        And yet you are using a product at the whims of some remote/foreign party whom you have never met and is bound by a set of responsibilities and laws with which you are entirely unfamiliar. I get where you are coming from, but you clinking "update" in stead of the dev does not guarantee the safety of the update.
        sneak 6y ago
        This is a false dichotomy. Nobody is claiming that mindlessly clicking "update" guarantees safety. I run a private fork of the bitwarden client, anyway. Their stock one partially trusts the iteration count of the PBKDF provided by the server, and can be tricked into sending a low-iteration hash of the master password.
      - UncleMeat 6y ago
        It isn't universal, but browsers surely provide a good case study here. Most of them auto-update today. In the past, exploitation via bugs where patches existed but people didn't update was measurably common. Supply chain attacks against autoupdating browsers haven't really materialized. If the goal is to prevent the most volume of exploitation, autoupdaters clearly win.
- bri3d 6y ago
  Not linking to the "major RCE vulnerability" is sensationalist posting at its finest. I can assume you are referring to... the automatic updater? https://github.com/bitwarden/desktop/issues/552 https://github.com/bitwarden/desktop/issues/552
  - ryan29 6y ago
    What other options would there even be for updates? That bug report describes every updater I've ever seen.
    - sneak 6y ago
      You are misunderstanding the issue. It's not asking before the update (as most programs that prompt you to update do). By the time that dialog box is displayed, the application has already replaced itself on disk (with code chosen arbitrarily by the bitwarden developers, or anyone in possession of their credentials), and the new code will be executed automatically without user intervention the next time the app is launched, which happens automatically if the computer is rebooted (like if there is a momentary power failure, or you hit "okay" on an OS update, or your battery dies and later you plug it back in to power). This grants the developers (as well as anyone who can compromise their credentials) unlimited remote access to your entire password vault the next time you unlock it.
      - bri3d 6y ago
        Sure, I see where you're coming from. I think your approach makes you come off as not very credible, though. Plus, it puts developers on the defensive and won't cause them to cooperate. A simple "I'm not comfortable with code on my machine being updated remotely without my approval, because I believe an attacker could infiltrate the supply chain" explains the problem you're having more precisely and turns into a simple feature request (turn off the auto-updater - which is already possible, as documented in that thread!) rather than trying to convince an entire industry that a commonly accepted practice (installation of signed remote updates) amounts to 0day RCE by putting them on the defensive.
      - 6y ago

malsanton 6y ago

I love this project, but something has always bothered me about it. For something as critical as your entire set of passwords, aren’t you essentially trusting this person you’ve never met to not just take all of them when you use the server? For example, one day a malicious maintainer could flip a switch that simply updates the docker image to send thousands of peoples’ entire vault somewhere and then disappear, no?

killingtime74 6y ago
Especially since bitwarden itself is already open source. This is a great learning project probably but not great for use
- joaopms 6y ago
  The greatest thing about this implementation is its simplicity. I actually deployed this server for my personal use because everything lives in one Docker image and not a lot of them like the official implementation. I do understand that the official implementation helps with scalability and more, I just don't need it.
- Nullabillity 6y ago
  The official Bitwarden server depends on MSSQL.
BiteCode_dev 6y ago
Same with basically any part of your infra. What prevents Postgres mainteners to just still all your DB ? Nginx mainteners to redirect your web traffic ? Ultimately, it boils down to a balance between trust in the author, the community or your own checking process.
novium 6y ago
If I'm not mistaken it should be mostly fine as long as you trust the desktop/phone versions of Bitwarden not to send off the (unhashed) key to the server Edit: Noting that there have been discussions about the default number of iterations. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52

fraktl 6y ago

I love Bitwarden. It's a great piece of software and it's reasonably priced. We use it at my place of work (I pushed to install and use Bitwarden on the company level). I also tried the Bitwarden_RS, it does the same work however it's not suited for company use as it lacks the feature to create groups. There's an open issue that provides a workaround, however that workaround proved to be unusable. I tried to reach out to maintainers to see whether the feature could be implemented and paid for their effort but.. let's just say the answer was "No.". Long story short - we use official Bitwarden and are paying for it and couldn't be happier. Bitwarden_RS looks like a cool toy, but I can't see any reason why anyone would run it. It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road.

rbut 6y ago
I run bitwarden_rs for exactly the reason you stated, for personal passwords. It took a few seconds to add to my portainer (docker) server and now I host my vault and keep it safe within my LAN.
fullstop 6y ago
I ran bitwarden_rs for a bit on a digital ocean node, but ultimately decided to buy a premium membership because it was less than $5/mo and I think that they will do a better job securing the system and keeping things up to date than I would in my spare time.
Macha 6y ago
> It's good for personal passwords, but Bitwarden itself offers free service so there's no need to venture down the self-hosted road. It's a trust issue. I don't trust my passwords on someone else's server. I don't trust free services to remain free forever. I don't trust paid services to not increase the fees 4x over a few years. The alternative to bitwardenrs or bitwarden/server is not bitwarden.com for me given the areas I'm concerned with, it's going back to KeePass + Syncthing. I think the reticence to provide the group features in bitwarden_rs may come from being unwilling to too blatantly step on the toes of Bitwarden LLC by producing a $0 drop in alternative to their paid service. bitwarden_rs is open source and bitwarden/server is _mostly_ open source (Some SSO related features are not), so it seems worthwhile to get along and not need to fork the ecosystem.

Black101 6y ago

a simple rsync client that could extract passwords from the data would be nice

Spivak 6y ago
Bitwarden has a CLI tool which is pretty good.
- Black101 6y ago
  what I mean is that why do you need bitwarden at all?
  - masklinn 6y ago
    Ensure that the data is stored securely, integrate with the various password-manager hooks of OS and browsers, generate passwords, …
  - f154hfds 6y ago
    This is going to sound sketchy because any software project involving cryptography is automatically sketchy unless it has hit some nebulous and ill-defined 'accepted' status, but I've been working on a CLI tool to manage my passwords for a while that I'm honestly not ready to share, but the architecture so far is very simple: Each 'service block' is an encrypted file consisting of service name, service password (autogenerated), kv-store, some metadata for regenerating new passwords. The key to each service block is the hash of a primary password. The name of the 'service block' file is the hash of the service name. All of the service blocks are stored together in a folder that can be rsynced wherever. My worry is obviously in the crypto. While I'm not doing anything too fancy I worry about timing attacks because an attacker will have the full encrypted block so the system is vulnerable to that sort of thing.
  - michaelt 6y ago
    There are many other options for password management that are very similar. Writing them down in a notebook next to your computer. A homebrew system like e-mailing GPG-encrypted files to yourself. Your browser's built in password saving and sync features. A password-protected Excel spreadsheet on your dropbox. Compared to a notebook, I can access my passwords from my phone if the need arises, and they're encrypted and backed up should I lose my phone. Compared to a homebrew system, someone else has done the work and made a cross-platform system with nice browser extensions, sensible defaults, and so on. Compared to my browser's sync features, there's peace of mind because it's not a free feature from a corporation famous for nonexistent customer service and sketchy tracking practices. Compared to dropbox, the price is trivial (as they only have to store a few kilobytes of data) and it's focused on security.

polote 6y ago

There is really something broken in the dev word. Why are people wasting their time rebuilding things that already exists ? If that was a side project to learn Rust, to learn the API of bitwarden, or to add new features I would understand, but that doesn't seem to be the case. I'm really curious why? "perfect for self-hosted deployment where running the official resource-heavy service might not be ideal" is that really the reason ?

colejohnson66 6y ago
Because sometimes people do things just because they can. Not every programming project needs to make sense.
- eeZah7Ux 6y ago
  Unfortunately fragmenting the opensource ecosystem with too many implementations harms it.
  - coldtea 6y ago
    People don't always give a fuck about the "opensource ecosystem", they just want to program something they find fun...
    - eeZah7Ux 6y ago
      Unfortunately a lot of people don't give fucks about others. Publishing a weekend fun project on github and taking contributors away from from other projects is not always nice. If it's just a "fun project" put a clear warning that it's not meant to be trusted, used, contributed to. Github, by design, defaults to showing issue trackers & so on, giving the impression that a project is "real". Then you go looking for something to use and find 100 half alive projects instead of 2 good ones.
      - anaganisk 6y ago
        Whatever happened to opinions of people, likes and interests. So what if its fragmented? Isn't forking a crucial thing in open-source anyone can build and support whatever the fuck the want. There are thousands of other tech forums why do we need hacker news to fragment tech community.

holtalanm 6y ago

I switched to Bitwarden when LastPass changed their policy for multi-device users. I'm happy to say the transition was completely painless.

CraigJPerry 6y ago
Even their CSV import worked flawlessly and my CSV export from Lastpass looked like a train wreck to parse but everything is present and correct in bitwarden.
koheripbal 6y ago
Did you consider KeePass or one of the variants?
- FlyingSnake 6y ago
  I use KeePass on one of my projects and I find Bitwarden much better than KeePass. We're moving to Bitwarden soon to keep it seamless across teams.
- hojjat12000 6y ago
  I'm using KeePass. On Linux, windows and android and Google drive to sync the database. it is a hassle. The graphics look terrible. And most of the times the keeweb plugin doesn't really work on Firefox and I have to copy paste the password. But I have been using it for a long time now and got used to it. The best thing about it is the plugin system. I would not suggest it, I think bit warden does all of this and is a lot more user friendly.
- cocoa19 6y ago
  I do use KeePass for work, since we're not authorized to put passwords on the cloud, but device synchronization and browser auto fill is a pain. For personal, Bitwarden is much better. Browser plugins just work, android auto fill just works, passwords synchronized across devices, support for auto filling payment information. 2FA support.
  - 6y ago

Shish2k 6y ago

I switched to using this because keepass didn’t have a good way of syncing its database with iOS devices, and the official bitwarden server has too many moving parts (including MS-SQL with no support for open source databases??) - aside from missing ssh-agent support, I’m loving all of it :)

chipsa 6y ago
SQL isn't as portable as people would like. Especially when you're trying to stay high performance as you're dealing with millions of customers. Once you start building for a specific SQL server, it hard to switch to another variant.

teekert 6y ago

I set it up in a couple of minutes using Docker-compose with Traefik. I love that Bitwarden has clients and plugins everywhere (FF and iOS being most relevant to me) and I can self-host. The sweetspot for me. I have had too many conflicts with my KeepassXC database on Nextcloud in the past, time for a solution with integrated sync. Btw the "custom server" setting is a bit hidden, it is behind the cogwheel in the upper left in most cases.

FlyingSnake 6y ago

Another satisfied user of `bitwarden_rs` here, and I can vouch for it. I migrated from LastPass and couldn't be more happier. The setup is pretty simple and I even managed to migrate it to a new server without any hassles. All the apps work flawlessly. The peace of mind in having all your sensitive data under your control is totally worth it.

jamienicol 6y ago
Personally, having my sensitive data under my own control (but internet facing) terrifies me. I know enough to know that there are risks, and yet wouldn't have a clue about how to make it secure.
- viro 6y ago
  I had to same thought so I put behind a VPN. a little less convenient. but WAY more secure
- yepguy 6y ago
  Just connect to it via wireguard or tailscale instead of exposing it to the entire internet.
  - alias_neo 6y ago
    Bingo. If you're going to host services as home such as your password manager, set up a WireGuard VPN, you can use a Pi and it'll be perfectly sufficient, leave only the VPN open on the internet, VPN in from your phone, laptop, whatever for anything you need access to, and you don't need to rely on Nextcloud or Bitwarden having vulnerabilities discovered in them. I was using Nextcloud previously for password sync because my password manager needs WebDAV, it was too much to maintain so I wrote a small server in Golang using the WebDAV library and it sits behind NGINX which handles the auth. I run Minio (S3 compatible) for syncing our family photos from our phones and Folder Sync app on Android. They both run on a VM and write out to a ZFS pool. I have a Pi 3B+ running Raspbian mounted read-only as a WireGuard VPN for remote access, and we use the official WireGuard app. VPN is always on because we have fast, symmetric fibre, and we don't need to worry about trusting public networks.

ErneX 6y ago

I use it and it's great. Best way to self host it imo.

AnIdiotOnTheNet 6y ago

My company used to use the unmaintained "CorporateVault", but switched to Bitwarden_rs after Flash (which CorporteVault used for copying to the clipboard) was deprecated. Bitwarden_rs was chosen because it had a relatively painless install compared to pretty much everything else I looked at, requiring only one Docker container. It's not bad.

rubatuga 6y ago
You don’t even need docker if you build from source
- AnIdiotOnTheNet 6y ago
  Maybe you didn't get the whole "I picked it because it was easy to install" part. Building software from source is pretty much the exact opposite of that.
  - denysvitali 6y ago
    It really depends. Go and Rust softwares are generally easy to build from source
    - dbt00 6y ago
      Yes but coming from a go or rust neophyte to trusting that you've installed correctly from source is probably a higher bar than knowing that you've run a container correctly.
    - AnIdiotOnTheNet 6y ago
      I was trying out a bunch of different similar products, I was not going to set up a build environment just to test software. I immediately disqualified anything that required I build it from source. Of the ones that didn't, very few had working install documentation and I wasn't going to fix it for them just to try out their product. I did open issues on their trackers about it for them, not that they cared since nothing has been done. Bitwarden_rs was the one that had working install documentation that didn't require a build environment. It met our requirements in testing, so I deployed it to production.

deleted 6y ago

[deleted]

imwillofficial 6y ago

Even if using this, remember to get a bitwarden license. It’s $10 for a whole year and keeps their dev afloat.

dastx 6y ago
Please please please do this. I have plenty of issues with their prioritisation but at the end of the day, Bitwarden is extremely cheap, and is a great product. There is little to no reason to not pay that $10 a year.
mjthompson 6y ago
I use 1Password and still pay for a Bitwarden licence to support development of a viable open source alternative.
- imwillofficial 6y ago
  This is awesome, low barrier to entry, high quality product.
  - deleted 6y ago
    [deleted]
gyvastis 6y ago
Just subscribed to Bitwarden. Was long overdue! Need to give back.

wufocaculura 6y ago

anyone moved from Keepass(XC) to bitwarden? I do see advantage of being cloud based as a way to avoid database conflicts (in my case 3 windows machines + mobile), but I wonder what can surprise me here. Is bitwarden's browser integration similar to KeepassXC (Keepass helper + KeepasXC-browser)?