4 ms·
> I am nobody not worth attacking. You’re probably not worth individually attacking, but a brief look at the failed ssh login logs of any insignificant server
by 542458 4y ago
> I am nobody not worth attacking.
You’re probably not worth individually attacking, but a brief look at the failed ssh login logs of any insignificant server shows that you probably are worth automated attacks… so I suppose the question is “Are you more vulnerable due to a) the risk of getting pwnt by an automated attack (due to a misconfiguration or being even a little slow to install a critical patch) or b) due to the risk of bitwarden getting pwnt by a sophisticated targeted actor?”
Further complicating this math is the E2EE nature of it, so it’s not just enough to pwn a server, you’d need to also compromise the client application.
Actually, now that I think about it, if you can compromise the client you don’t even need to compromise the server. I’m not really sure under what scenarios running your own server would protect you in in that case.
- dvzk 4y ago> Further complicating this math is the E2EE nature of it, so it’s not just enough to pwn a server, you’d need to also compromise the client application. The webvault is both a server and a client, and you can't not use it. As soon as you sign into it once (which you must, with the official apps) you have allowed unsigned ephemeral javascript code to run against your decrypted vault.
- hackerman123469 4y agoI can contest to this, I am by no mean important and none of my servers that I own have any importance, BUT I have thousands of people trying to remote into the servers every day and also thousands of requests into some of my webservers with things like /admin /phpmyadmin or whatever, you name it. So yeah even if you aren't a big target then you are still a target for automated attacks as they just pick whatever IPs they can find and try to breach.