9 ms·
Bitwarden login down due to Azure outage
- tamimio 3y agoYesterday I bought their premium, guess I broke it!! But as other mentioned, I do have a plan B and C and even D.
- hijinks 3y agojust run your own and use vaultwarden so your passwords aren't on someone else's server
- 542458 3y agoUnless you own a datacenter I don’t think that’s a full solution to the “passwords on someone else’s server” problem.
- unforeseen9991 3y agoConsidering I just lost power to my house containing my homelab due to a storm, absolutely lol
- ndsipa_pomu 3y agoWell, I run my own vaultwarden instance (it's great), but I host it on a free Oracle (ewww) cloud instance. At least if that goes down, I can just run it from my last backup and host it in my house until I find something more resilient.
- sotix 3y agoWhen I looked into running it locally on my own server, I couldn’t get it to work because it required https. I connect to my local server with WireGuard without exposing it otherwise to the internet, so I don’t have a need for https. There’s probably a way to set up https, but I gave up after a few hours trying various workarounds while the rest of my local services continue to work via http and WireGuard.
- Isthatablackgsd 3y agoI tried to self host for some services in Docker and they requires https as well. I gave up trying to set up my own after few days of trying set up https, it is way out of my league and I don't have experience with it. I remember Caddy provides automatic https right out of the box. Maybe try looking into Caddy?
- coder543 3y agoPlain Wireguard would require more work to replicate this feature, but I remembered hearing that Tailscale offers a beta feature to provision certificates, which I still need to try out sometime. https://tailscale.com/kb/1153/enabling-https/ https://tailscale.com/kb/1153/enabling-https/
- DavideNL 3y agoWell, any server will at some point crash / need a (partial) restore / need an urgent update / have a power outage / etc, including the one your run yourself - which you also need to manage yourself, which can sometimes be an issue when you're busy. - It's great they offer it of course, as for many people it _is_ a good fit.
- Wowfunhappy 3y agoI have more faith in Bitwarden's ability to secure their servers than I do in my ability to secure my own server. Bitwarden has people who work on this full time, and I do not. I do self-host things, but nothing so security-sensitive.
- xoa 3y ago>I have more faith in Bitwarden's ability to secure their servers than I do in my ability to secure my own server. Bitwarden has people who work on this full time, and I do not. First: E2EE. You're thinking in terms of a web gui, not a E2EE client-server where the server itself is untrusted. If done properly (and I've seen no indication Bitwarden's isn't) that would mean that server compromise is irrelevant anyway beyond uptime. But second in general: Bitwarden has people attacking it full time, and necessarily must be on the public internet with untrusted clients. And I do not. One's own server doesn't need to be on the public internet at all, you can have 100% of access exclusively through a Wireguard or other secure VPN. You have completely control of every single client, because they're all yours. Server blocked from internet entirely, update it out of band, or at least restrict what it can talk to to exclusively upstream update servers. This massively reduces attack surface. If only trusted clients can access something, then compromising it means going through a trusted client. But if the trusted client is compromised in this scenario you're hosed regardless. The server is irrelevant. There's lots of good reasons of course not to run your own thing, but the security aspect gets overdone with false equivalences. It's the equivalent of people pointing at what the likes of Amazon or Google or whomever have to do for database work. But while they have far more resources, they also have far more demands and requirements. Stuff that is very challenging at hyperscale can be done far more simply but still effectively at small/medium scale. It's not wrong to think about the tradeoffs, but worth being cautious of apples to watermelons comparisons.
- suddenclarity 3y agoThis is what stopping me from migrating to Bitwarden. Do I trust their servers and hope they are not as bad as Lastpass? Or do I need to host everything myself and accidently leak it? I've had plenty of Wordpress sites through the years that were exploited before they introduced auto update. I've also heard that the autofill is quite bad. I wish password protection was a lot simpler.
- HumblyTossed 3y agoI trust Bitwarden more than my own abilities, but I have been thinking to do this just as a backup and have it offline unless I need it.
- _lvbh 3y agoI do that & make sure it’s only accessible by connecting via my WireGuard VPN. Works amazingly and I would bet probably more secure than just a master password.
- Barrin92 3y ago>so your passwords aren't on someone else's server being able to transmit information across open or even adversarial channels is the literal reason encryption exists This is security theater, if your security method is keeping your data local you can use notepad, you don't need to go through the hassle of setting up a password manager
- iot_devs 3y ago[flagged]
- chayesfss 3y ago[dead]
- bombcar 3y ago> If you are using Tor, try changing your exit node. Bitwarden doesn't run an onion service? Anyone who acknowledges Tor and wants to support users there and doesn't have an onion is missing out.
- jiofj 3y agoYeah... tried to edit a password before and took me a few attempts. It was odd because bitwarden always works very well for me.
- squeegee_scream 3y agoI’m not a bitwarden user, does this mean users can’t access their secrets on their own machine if they are logged out? Because that’s not how 1Password works. I suspect that isn’t the case but it sounds like it to me
- harryquach 3y agoI use Bitwarden and am able to access and create secrets
- squeegee_scream 3y agoBut are you able to log out of the desktop client or mobile client, then log in and see your things?
- coder543 3y agoIf the title here says “Bitwarden login down”, I think it is extremely reasonable to assume the answer is “no”. Because that’s what it means for the login to be down.
- msh 3y agoBitwarden works offline. You can just not sign in on a new device.
- aquova 3y agoI just tried it myself on a machine completely logged out, and the login page is simply spinning.
- squeegee_scream 3y agoThat is deeply concerning, no?
- coder543 3y agoNo. A temporary outage affecting logging in does not sound “deeply” concerning at all, especially if people who are logged in are still able to use the app normally. I don’t use Bitwarden, but this outage does not affect my opinion of Bitwarden’s hosted service. I’m not aware of any SaaS that achieves 100% uptime. If you want to control your own destiny, I hear that you can self-host bitwarden, but the uptime will almost certainly be lower than a well-managed hosted service.
- bobse 3y agoI have a paper notepad where I keep my secrets. No fucker can hack me.
- paulryanrogers 3y agoAssuming all passwords are long, random, and unique. Preferably paired with MFA where possible.
- dartos 3y agoJust never take it outside or the camera satellites will snap a pic
- CoastalCoder 3y agoOh, please. Everyone know the satellites are arranged into a constellation to form a massive C.T. scanner. So leaving the house is irrelevant.
- jjoonathan 3y agoSo you're saying my passwords need a tinfoil hat too? :o
- kioleanu 3y agoMy wife used to have one of those. The amount of times she called me to read a password from the notebook because she forgot it at home is… well… quite staggering
- lxgr 3y agoThinking about this scenario, but combined with AI voice impersonation, makes me very uncomfortable.
- mdaniel 3y agorelevant: https://news.ycombinator.com/item?id=37500895 https://news.ycombinator.com/item?id=37500895 The "hang up and call back" defense also would work with your "wife clone attack" too
- moffkalast 3y agoThis sends some schadenfreude into my veins for those people that constantly advocate for using a password manager in the most annoying way possible. Congrats, you now have a single point of failure for all your accounts.
- nicoburns 3y agoBitwarden stores a (encrypted) local copy of your vault on your device. So as long as you were signed in somewhere using any of the desktop app, mobile app or browser extension then you should still be able to access your passwords during this outage. It's just the sync that isn't working (and if you need to sign in on a new device).
- Astronaut3315 3y agoIt still works fine as long as you don’t log out. Nothing is broken on my end.
- dotnet00 3y agoNot at all a single point of failure, as others have mentioned, this is only for logging into new devices, devices which are already setup will have a local copy of the database. Plus you can export the database to have a backup that can be restored elsewhere. I keep a database backup (encrypted of course) on a flash drive with my yubikey for instance. Have never had a point where I haven't been able to access my passwords.
- moffkalast 3y agoThat's not what I was referring to, but the single master password that decrypts everything. Though this would be bad as well.
- dotnet00 3y agoYou can have 2FA on it (eg with a Yubikey in my case), and also most people have their email address as single point of failure in that sense, as most password resets simply rely on sending a link to the registered email.
- jwnin 3y agoappears to be a localized outage as there's no mention on https://azure.status.microsoft https://azure.status.microsoft . Though, that's more of a PR status than actual status.
- sysadm1n 3y agoI 'mirror' my Bitwarden login entries in a KeepassXC database, so I have an offline carbon copy incase Bitwarden's servers are wiped or not accessible, or for whatever reason, I can't access my Bitwarden vault. I would suggest everyone do the same. The only pain point is remembering to make a carbon copy of each entry you add to Bitwarden, in the KeepassXC database. I also make copies of my KeepassXC database in several cloud storage services incase of a house eating event which destroys my hard-drives (unlikely but still a possibility). I really don't like the idea of being locked out of my digital life. Terence Eden has a good article about this potential scenario; https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-of-my-digital-life/ https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-of-my... For those wondering why I use Bitwarden as-well as KeepassXC: 1.) Redundancy. Can't get at my KeepassXC?, then I try Bitwarden. Can't get at my Bitwarden? Then I try KeepassXC. Can't get access to both? Then I'm screwed (but this is unlikely). 2.) Browser extension. I like to be able to login easily to sites using their extension. 3.) LOCKSS (Lots of copies keeps stuff safe). Having a cloud-based mirror of my login entries stored in Bitwarden is marginally better than solely relying on KeepassXC. 4.) Logging into KeepassXC is sometimes more complicated than logging into Bitwarden. I have a long seven word passphrase for KeepassXC, and use a keyfile which I have to 'hunt down' in the filesystem each time I go to access KeepassXC (I have disabled the ability to store the last used database & keyfile for security reasons). With Bitwarden I just open the app and if it's unlocked, I get quick access to everything.
- dotnet00 3y agoWhy not just periodically backup your bitwarden vault to external storage?
- lxgr 3y agoFrom GP: > incase of a house eating event which destroys my hard-drives I worry about this as well. Yes, a friend's house is an option, but not everybody has friends or family in the same city, and if they're further away, updating copies is a pain.
- 3y ago
- nonfamous 3y agoThere’s no mention of Azure on the Bitwarden status page.
- aaomidi 3y agoYeah no idea where OP got Azure from?
- linuxdaemon 3y agoBitwarden's help pages state storage is in Azure cloud: https://bitwarden.com/help/data-storage/#on-bitwarden-servers https://bitwarden.com/help/data-storage/#on-bitwarden-server... So if there is an observation of an issue, it's reasonable to connect those dots, plus their statement on that page "All uptime, scalability, security updates, and guarantees are backed by Microsoft and their cloud infrastructure" pretty much says any issues are MS/Azure problems.
- ravivyas 3y agoWhat is a good safe way to take a backup of your vault?
- kekebo 3y agoSafety is in your hands but the bitwarden client allows you to export your vault https://bitwarden.com/help/export-your-data/ https://bitwarden.com/help/export-your-data/
- kekebo 3y ago(which also allows for encrypted exports https://bitwarden.com/help/encrypted-export/ https://bitwarden.com/help/encrypted-export/ )
- dudeinjapan 3y ago1Password or you’re doing it wrong.
- tongueinkek 3y ago[dead]
- hiAndrewQuinn 3y agoHa. Back when I was considering learning C# to compliment my Azure skills and get a safe, sustainable job in enterprise I remember finding Bitwarden as one of the only major C# projects on GitHub I could find. I had a strong hunch after that who they were hosted by.
- awinter-py 3y agoself hosted vaultwarden (formerly bitwarden_rs) is not down fwiw must be in a different AZ
- devwastaken 3y agoI did not realize bit warden uses azure. I will now be changing password managers. Never trust MS to do anything.
- jacooper 3y agoBitwarden is E2EE, it doesn't matter where its hosted.