4 ms·

I keep wanting to switch to bitwarden from keepassxc, I created an account and installed the apps, but I just can't bring myself to actually upload all my passw

I keep wanting to switch to bitwarden from keepassxc, I created an account and installed the apps, but I just can't bring myself to actually upload all my passwords to someone else's computer. Am I just too paranoid?

di4na 4y ago
It is not someone else computer. It is your password encrypted that get uploaded. Your passwords are only decrypted locally. Feel free to check their app for that :)
- wmkn 4y ago
  Unfortunately because of the way Bitwarden works you should consider your passwords compromised when Bitwarden itself gets hacked - regardless of vault encryption. Especially if you ever used the web login. To access your account you need to type your master password, the same password that is used decrypt your vault. If a competent hacker gains access to the Bitwarden servers they could install a compromised login page that logs master passwords and with that gain access to password vaults. Sounds far-fetched maybe, but your password security depends completely on the ability of Bitwarden to protect their servers. The encryption is just a minor hurdle once the servers are compromised. Note that 2FA doesn’t help since it is not used for vault encryption.
  - darkwater 4y ago
    If you never use the web frontend that should not be possible (unless the local app/browser extension send the full password over the wire and not the hash).
  - skoskie 4y ago
    Right or wrong I like the way you think.
- chrismorgan 4y ago
  > Feel free to check their app for that First-party end-to-end encryption is broken by design, especially in the presence of auto-updating.
lighthazard 4y ago
Bitwarden has a self hosted feature. I've been using that for a while now and I highly recommend it for a paranoid you.
- NoahKAndrews 4y ago
  Or use vaultwarden for a lighter-weight community-developed selfhosting option that is compatible with the BitWarden client apps.
sysadm1n 4y ago
You can have the best of both worlds. If Bitwarden's datacenters got corrupted/wiped/hacked/ransomware'd you can have a Keepass DB which mirrors all your Bitwarden creds, and stored locally / synced to a few cloud servers. The caveat being: you have to manually copy over any credentials from Bitwarden to Keepass, which is time consuming but one day maybe worth it.
- ancientsofmumu 4y ago
  > you have to manually copy over any credentials from Bitwarden to Keepass pass-import works pretty well; create an initial empty KeePass DBX file first and keep a copy to re-use, then one can re-run pass-import to import BW to a fresh KDBX on a recurring basis with a simple script. [1] https://github.com/roddhjav/pass-import https://github.com/roddhjav/pass-import
  - sysadm1n 4y ago
    That's a neat tool. But I meant when you create a new credential entry, you have to manually mirror it in Keepass each time you add something in Bitwarden. Doing an import just for one entry is overkill.
smazga 4y ago
Vaultwarden is a self-hosted bitwarden server. It's very light weight and can be simply run in docker.
- number6 4y ago
  Second this. Also has a Real nice community and a matrix channel where people will help you out
- wise0wl 4y ago
  And it can run on a Raspberry Pi! The DB can be hosted in SQLite (the default) or Postgres, as opposed to Bitwarden which requires MSSQL, which is not compiled for ARM.
  - kwistzhaderach 4y ago
    I am not well-versed on self hosting but interested in doing it. If I run Bitwarden on a Raspberry Pi and if the Pi breaks (let's say it completely stops working), will the passwords be unrecoverable?
    - crtasm 4y ago
      You'd still have a copy of the database on any device that was running the client.
hihungryimdad 4y ago
I'm hosting bitwarden in a docker container running on my synology nas. Loving it so far.
troyvit 4y ago
I too was too paranoid for that. Digital ocean has a bitwarden instance that you can host yourself[1]. It's still somebody else's computer, but it's your tiny instance, your subdomain, etc. It's like $9/month maybe? But I put my kids on there too. $3/month for a pretty robust, cloud-based password manager with a tiny attack vector is worth the money to me. [1] https://marketplace.digitalocean.com/apps/bitwarden https://marketplace.digitalocean.com/apps/bitwarden
- mdaniel 4y ago
  There was a recent thread about that, and yeowzers they're doing some questionable devsecops in that installation mechanism: https://news.ycombinator.com/item?id=31098608 https://news.ycombinator.com/item?id=31098608
briffle 4y ago
I used to think the same thing but had my keepass DB on a dropbox folder, so all my computers had easy access to it. This is the same as how bitwarden works.
sdflhasjd 4y ago
As a Keepass user, The bitwarden desktop client is very feature lacking. It provides very little over just the browser interface. There's no desktop autofill or autotype and no SSH key management.
ajnin 4y ago
I'm also using KeePass and I have my own NextCloud instance, and with the Android app + browser add-ons I have an as good experience as with cloud offerings, and maybe even better since I can also use it as an SSH agent to store my SSH keys. But honestly with all the updates I'm putting off I'm probably actually more at risk, and a good password manager implementation will encrypt all passwords client-side so you're not actually uploading your passwords to anyone's computer.
xienze 4y ago
I love Bitwarden. What I do is self-host an instance, available only on my network (so not open to the world). Whenever I’m home and I use Bitwarden on any of my devices they sync automatically. I’ve found this use pattern to be pretty good from a “devices are up to date” perspective. I get all the benefits of “cloud sync” across my devices without worrying about a service breach.
tmikaeld 4y ago
It's just an encrypted blob that's uploaded, not your passwords. There's a self-hosted alternative, but even so, I'd trust them to handle server security better since, since it's their speciality. I'd suggest adding Yubikey as 2-factor, then anyone would need that physical key to login.
unethical_ban 4y ago
Assuming the vendors are not lying, then the setup for these services is that your master password encrypts all data before it is sent to the server, and the service cannot see your master password or any of your contents. That said, I use KeePass on Windows and Android, sync my safes once a month/as needed, and call it a day.
gen220 4y ago
If you're considering self-hosting anything, you might consider using https://www.passwordstore.org/ https://www.passwordstore.org/. Personally, I've used it since lastpass made people pay for multi-device access. You can treat it like a git repo that's encrypted at rest. Client implementations are pretty quality in my window of experience (on linux+ff, mac osx+ff, iOS+safari). The security problem reduces to "how do I securely store a private key that I use every day", which is a well-understood problem with a well-documented set of solutions.

di4na 4y ago

It is not someone else computer. It is your password encrypted that get uploaded. Your passwords are only decrypted locally. Feel free to check their app for that :)

wmkn 4y ago
Unfortunately because of the way Bitwarden works you should consider your passwords compromised when Bitwarden itself gets hacked - regardless of vault encryption. Especially if you ever used the web login. To access your account you need to type your master password, the same password that is used decrypt your vault. If a competent hacker gains access to the Bitwarden servers they could install a compromised login page that logs master passwords and with that gain access to password vaults. Sounds far-fetched maybe, but your password security depends completely on the ability of Bitwarden to protect their servers. The encryption is just a minor hurdle once the servers are compromised. Note that 2FA doesn’t help since it is not used for vault encryption.
- darkwater 4y ago
  If you never use the web frontend that should not be possible (unless the local app/browser extension send the full password over the wire and not the hash).
- skoskie 4y ago
  Right or wrong I like the way you think.
chrismorgan 4y ago
> Feel free to check their app for that First-party end-to-end encryption is broken by design, especially in the presence of auto-updating.

lighthazard 4y ago

Bitwarden has a self hosted feature. I've been using that for a while now and I highly recommend it for a paranoid you.

NoahKAndrews 4y ago
Or use vaultwarden for a lighter-weight community-developed selfhosting option that is compatible with the BitWarden client apps.

sysadm1n 4y ago

You can have the best of both worlds. If Bitwarden's datacenters got corrupted/wiped/hacked/ransomware'd you can have a Keepass DB which mirrors all your Bitwarden creds, and stored locally / synced to a few cloud servers. The caveat being: you have to manually copy over any credentials from Bitwarden to Keepass, which is time consuming but one day maybe worth it.

ancientsofmumu 4y ago
> you have to manually copy over any credentials from Bitwarden to Keepass pass-import works pretty well; create an initial empty KeePass DBX file first and keep a copy to re-use, then one can re-run pass-import to import BW to a fresh KDBX on a recurring basis with a simple script. [1] https://github.com/roddhjav/pass-import https://github.com/roddhjav/pass-import
- sysadm1n 4y ago
  That's a neat tool. But I meant when you create a new credential entry, you have to manually mirror it in Keepass each time you add something in Bitwarden. Doing an import just for one entry is overkill.

smazga 4y ago

Vaultwarden is a self-hosted bitwarden server. It's very light weight and can be simply run in docker.

number6 4y ago
Second this. Also has a Real nice community and a matrix channel where people will help you out
wise0wl 4y ago
And it can run on a Raspberry Pi! The DB can be hosted in SQLite (the default) or Postgres, as opposed to Bitwarden which requires MSSQL, which is not compiled for ARM.
- kwistzhaderach 4y ago
  I am not well-versed on self hosting but interested in doing it. If I run Bitwarden on a Raspberry Pi and if the Pi breaks (let's say it completely stops working), will the passwords be unrecoverable?
  - crtasm 4y ago
    You'd still have a copy of the database on any device that was running the client.

hihungryimdad 4y ago

I'm hosting bitwarden in a docker container running on my synology nas. Loving it so far.

troyvit 4y ago

I too was too paranoid for that. Digital ocean has a bitwarden instance that you can host yourself[1]. It's still somebody else's computer, but it's your tiny instance, your subdomain, etc. It's like $9/month maybe? But I put my kids on there too. $3/month for a pretty robust, cloud-based password manager with a tiny attack vector is worth the money to me. [1] https://marketplace.digitalocean.com/apps/bitwarden https://marketplace.digitalocean.com/apps/bitwarden

mdaniel 4y ago
There was a recent thread about that, and yeowzers they're doing some questionable devsecops in that installation mechanism: https://news.ycombinator.com/item?id=31098608 https://news.ycombinator.com/item?id=31098608

briffle 4y ago

I used to think the same thing but had my keepass DB on a dropbox folder, so all my computers had easy access to it. This is the same as how bitwarden works.

sdflhasjd 4y ago

As a Keepass user, The bitwarden desktop client is very feature lacking. It provides very little over just the browser interface. There's no desktop autofill or autotype and no SSH key management.

ajnin 4y ago

I'm also using KeePass and I have my own NextCloud instance, and with the Android app + browser add-ons I have an as good experience as with cloud offerings, and maybe even better since I can also use it as an SSH agent to store my SSH keys. But honestly with all the updates I'm putting off I'm probably actually more at risk, and a good password manager implementation will encrypt all passwords client-side so you're not actually uploading your passwords to anyone's computer.

xienze 4y ago

I love Bitwarden. What I do is self-host an instance, available only on my network (so not open to the world). Whenever I’m home and I use Bitwarden on any of my devices they sync automatically. I’ve found this use pattern to be pretty good from a “devices are up to date” perspective. I get all the benefits of “cloud sync” across my devices without worrying about a service breach.

tmikaeld 4y ago

It's just an encrypted blob that's uploaded, not your passwords. There's a self-hosted alternative, but even so, I'd trust them to handle server security better since, since it's their speciality. I'd suggest adding Yubikey as 2-factor, then anyone would need that physical key to login.

unethical_ban 4y ago

Assuming the vendors are not lying, then the setup for these services is that your master password encrypts all data before it is sent to the server, and the service cannot see your master password or any of your contents. That said, I use KeePass on Windows and Android, sync my safes once a month/as needed, and call it a day.

gen220 4y ago

If you're considering self-hosting anything, you might consider using https://www.passwordstore.org/ https://www.passwordstore.org/. Personally, I've used it since lastpass made people pay for multi-device access. You can treat it like a git repo that's encrypted at rest. Client implementations are pretty quality in my window of experience (on linux+ff, mac osx+ff, iOS+safari). The security problem reduces to "how do I securely store a private key that I use every day", which is a well-understood problem with a well-documented set of solutions.