4 ms·

An important part of security is threat assessment and worst case analysis. If the cost of your security policy is greater then the cost of a worst case compro

An important part of security is threat assessment and worst case analysis. If the cost of your security policy is greater then the cost of a worst case compromise then you are probably over investing in security. With that in mind, does your policy seem appropriate to a user securing their Facebook password? Or their homelab service accounts? *Cost in this case being the combination of literal currency and subjective costs like time/emotional well-being/public perception.

llamaimperative 2y ago
Is that the type of thing that people self-hosting a password management server are trying to secure? In that case, it's extra silly. Is the cost of setting this up and maintaining it at all worth securing your Facebook password?
- number6 2y ago
  We like to host stuff :) If I am faithful to myself I might be paying more than I would if I wouldn't self-host
  - legacynl 2y ago
    You shouldn't feel bad about that, because that money isn't lost, you just used that money to buy enjoyment which is valuable as well. And that is without even accounting for the amount of knowledge and experience gained by self hosting.
- troyvit 2y ago
  For me it is worth it to host a password manager for me and my family, although I just did a one-click install on Digital Ocean (using Bitwarden, not Vaultwarden ... so far). To me (and I'm pretty ignorant about this stuff), the biggest weakness of a password manager is that it's the one link in a chain that somebody needs to break to have all of my passwords. Hosting that at bitwarden.com or lastpass.com or whatever makes it an even sweeter target because those are known targets. At least self-hosting makes it more difficult for somebody else to find my password manager. Moving to Vaultwarden has its complications but it would also be fun, and maybe a cool project for the kids. And like you say, if we screw up and they lose their instagram password they won't even remember the pain once they've all grown up and the world is a dystopian nightmare of climate catastrophes, wars, etc. They'll be busy looking for the fattest grubs to eat.

llamaimperative 2y ago

Is that the type of thing that people self-hosting a password management server are trying to secure? In that case, it's extra silly. Is the cost of setting this up and maintaining it at all worth securing your Facebook password?

number6 2y ago
We like to host stuff :) If I am faithful to myself I might be paying more than I would if I wouldn't self-host
- legacynl 2y ago
  You shouldn't feel bad about that, because that money isn't lost, you just used that money to buy enjoyment which is valuable as well. And that is without even accounting for the amount of knowledge and experience gained by self hosting.
troyvit 2y ago
For me it is worth it to host a password manager for me and my family, although I just did a one-click install on Digital Ocean (using Bitwarden, not Vaultwarden ... so far). To me (and I'm pretty ignorant about this stuff), the biggest weakness of a password manager is that it's the one link in a chain that somebody needs to break to have all of my passwords. Hosting that at bitwarden.com or lastpass.com or whatever makes it an even sweeter target because those are known targets. At least self-hosting makes it more difficult for somebody else to find my password manager. Moving to Vaultwarden has its complications but it would also be fun, and maybe a cool project for the kids. And like you say, if we screw up and they lose their instagram password they won't even remember the pain once they've all grown up and the world is a dystopian nightmare of climate catastrophes, wars, etc. They'll be busy looking for the fattest grubs to eat.