3 ms·
I would never have someone else manage my passwords for me. You have to trust the server. It could serve the user with malicious JS code or an app update at an
by aborsy 4y ago
I would never have someone else manage my passwords for me.
You have to trust the server. It could serve the user with malicious JS code or an app update at any time.
You can self host it though.
- shapefrog 4y agoHost your own bitwarden instance then.
- michaelmior 4y agoIf you self host, your server could still be compromised. I think the primary thing making that unlikely to happen with a self-hosted instance is being a very small target.
- veltas 4y agoYou might not, but the vast majority of people unfortunately already trust companies like Google with their passwords. Likely though they will be stored and kept properly, and there won't be leaks. I only said 'unfortunately' because it hands dependence over to Google. Loss of access is the main concern.
- chrismorgan 4y agoI use Vaultwarden (formerly bitwarden_rs) just for myself. I still use the Bitwarden extension in Firefox, which is a similar attack surface to what you describe, though probably a shade less vulnerable in practice. I’d like to replace it with something leaner and functionally superior (it’s pretty heavy, and has the major problem of mostly not working in Private Browsing windows, and some other timing/focus issues that I suspect stem from the same bad design), but I have too much other stuff I want to use. I don’t serve the Bitwarden web interface on my server at all, but I could.
- aborsy 4y agoWouldn’t Firefox’ or chrome’s built-in password manager (with a master password set) be a better way of bringing a few frequently-used low-impact passwords closer to the internet, than a plug-in written by some developer?
- usrusr 4y agoAn interesting perspective. From that of an attacker, the random plug-in might be a much lower hanging fruit, but also a much smaller one. Obscurity is not completely without merit.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- xani_ 4y agoMost of them do it by encrypting the passwords with your master password so techncially you only have to trust the client on that one. But yeah, browser can get hacked, malicious client code can be pushed, lastly client bugs
- jillesvangurp 4y agoDo you trust yourself to do a good job though? It's a big responsibility. I know plenty of developers that would probably mess that job up one way or another. Certainly in a corporate situation, I'd not want to take that responsibility. Because now the company suffers if I mess up. That, in a nut shell is why companies like Bitwarden exist and why many companies choose to pay them rather than people like you and me to manage their passwords.
- forty 4y agoI have bad news: it's not only true for the password manager. You have to trust the OS and every single apps you install on your computer because any of them could install a malicious update and steal all your passwords whenever you use them.
- noSyncCloud 4y agoNot to mention all the code running at Ring -50 or whatever they're down to now (at least -3 iirc).