5 ms·

Irrelevant. 1password passwords are encrypted with a key only you have. I HIGHLY doubt that you can keep your homeserver more secure than 1password can its serv

Irrelevant. 1password passwords are encrypted with a key only you have. I HIGHLY doubt that you can keep your homeserver more secure than 1password can its servers.

usrbinbash 3y ago
> 1password passwords are encrypted with a key only you have. So is my password store. > I HIGHLY doubt that you can keep your homeserver more secure than 1password can its servers. I also highly doubt that my trousers pockets are harder than the 1.5cm thick hardened-steel-doors of the storage lockers at the local train station, or that my pyhsical constitution is superior to those of the trained security guards they have there. And yet, guess where the keys to my apartment are kept. Hint: Not at the train station.
SCHiM 3y ago
Security is not an absolute measure. It's a cost/benefit tradeoff. 1Password may have customers that make it economical for an adversary to spend $$$$ to breach it despite "better" security, whereas your "less" secure home setup may not be worth the effort.
- 8organicbits 3y ago
  I wouldn't worry about a targeted attack if I was "nobody" and I was self hosting. Likely bitwarden? I'd worry about an attacker scanning and exploiting every instance they can find. Scanning is cheap and provides value in aggregate. I'd recommend only exposing bitwarden on an intranet, or controlling access with a strict firewall, but the setup guide makes no such suggestion. https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/
  - usrbinbash 3y ago
    I thank you for your advice and no, it's not bitwarden. I have losely described my setup elsewhere in this thread.
offices 3y ago
Irrelevant. The risk of a targeted attack is much lower than the risk of being part of an online attack. I doubt there's anyone on this site who hasn't been part of one of the latter but for someone to decide that I have something worth stealing they must first know that I exist.
- vinckr 3y ago
  Irrelevant. Just because you are paranoid does not mean nobody is trying to get your keys.
vladvasiliu 3y ago
> 1password passwords are encrypted with a key only you have. Are they? How does the vault password recovery work, then?
- edualm 3y ago
  That feature only exists on family/team accounts, and in that case the account that is allowed to perform recoveries has an escrow of the vault passwords of other team members. 1Password themselves don't hold these keys.
  - vladvasiliu 3y ago
    But it's possible to authorize a new account to perform recoveries of vaults created before. So there must be a way of distributing the escrow. My point is not so much to throw 1Password under the bus (I'm a happy user), but I'd be curious to see a description of how this works.
    - smileybarry 3y ago
      The user who currently holds escrow can distribute those recovery keys to other accounts in that family/team/enterprise. This is why 1Password SaaS forces you to have at least one account admin (aka the user with recovery keys). If you somehow have 0 account admins, creating a recovery key -- without full decryption access to a vault, aka, user still knows their password & account key -- is impossible.
ilyt 3y ago
Ain't nobody giving shit about your pictures kept on home server. Security measures need to be relevant to chance of attack, they do not exist in the void. And so mediocre protection of irrelevant target can be far more effective than good protection of juicy target

Irrelevant. 1password passwords are encrypted with a key only you have. I HIGHLY doubt that you can keep your homeserver more secure than 1password can its servers.

usrbinbash 3y ago

> 1password passwords are encrypted with a key only you have. So is my password store. > I HIGHLY doubt that you can keep your homeserver more secure than 1password can its servers. I also highly doubt that my trousers pockets are harder than the 1.5cm thick hardened-steel-doors of the storage lockers at the local train station, or that my pyhsical constitution is superior to those of the trained security guards they have there. And yet, guess where the keys to my apartment are kept. Hint: Not at the train station.

SCHiM 3y ago

Security is not an absolute measure. It's a cost/benefit tradeoff. 1Password may have customers that make it economical for an adversary to spend $$$$ to breach it despite "better" security, whereas your "less" secure home setup may not be worth the effort.

8organicbits 3y ago
I wouldn't worry about a targeted attack if I was "nobody" and I was self hosting. Likely bitwarden? I'd worry about an attacker scanning and exploiting every instance they can find. Scanning is cheap and provides value in aggregate. I'd recommend only exposing bitwarden on an intranet, or controlling access with a strict firewall, but the setup guide makes no such suggestion. https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/
- usrbinbash 3y ago
  I thank you for your advice and no, it's not bitwarden. I have losely described my setup elsewhere in this thread.

offices 3y ago

Irrelevant. The risk of a targeted attack is much lower than the risk of being part of an online attack. I doubt there's anyone on this site who hasn't been part of one of the latter but for someone to decide that I have something worth stealing they must first know that I exist.

vinckr 3y ago
Irrelevant. Just because you are paranoid does not mean nobody is trying to get your keys.

vladvasiliu 3y ago

> 1password passwords are encrypted with a key only you have. Are they? How does the vault password recovery work, then?

edualm 3y ago
That feature only exists on family/team accounts, and in that case the account that is allowed to perform recoveries has an escrow of the vault passwords of other team members. 1Password themselves don't hold these keys.
- vladvasiliu 3y ago
  But it's possible to authorize a new account to perform recoveries of vaults created before. So there must be a way of distributing the escrow. My point is not so much to throw 1Password under the bus (I'm a happy user), but I'd be curious to see a description of how this works.
  - smileybarry 3y ago
    The user who currently holds escrow can distribute those recovery keys to other accounts in that family/team/enterprise. This is why 1Password SaaS forces you to have at least one account admin (aka the user with recovery keys). If you somehow have 0 account admins, creating a recovery key -- without full decryption access to a vault, aka, user still knows their password & account key -- is impossible.

ilyt 3y ago

Ain't nobody giving shit about your pictures kept on home server. Security measures need to be relevant to chance of attack, they do not exist in the void. And so mediocre protection of irrelevant target can be far more effective than good protection of juicy target