3 ms·

not to be rude, but vaultwarden setup is fairly straightforward for an advanced user: 1. Point your domain's DNS to server 2. Run a reverse proxy with LetsEnc

by Liquix 2y ago

not to be rude, but vaultwarden setup is fairly straightforward for an advanced user: 1. Point your domain's DNS to server 2. Run a reverse proxy with LetsEncrypt integration (Caddy, NGINX Proxy Manager, Traefik, etc) 3. Run the Docker command https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden

godelski 2y ago
I don't disagree with you, but a lot of people don't understand any of those steps. 3 is the step most people will understand, I think you can understand that LetsEncrypt can be confusing the first time, and well... DNS... that's notorious for people being confused on. What people consider "advanced user" varies quite a bit and there's a lot of subdomains in computing. (Though maybe the term is also degrading...)
- 542354234235 2y ago
  It strikes me that if you aren’t advanced enough for this then you probably aren’t advanced enough to safely manage your password manager locally. If you don’t have a good understanding of things like DNS, do you understand the vulnerabilities you need to mitigate for in a self-hosted situation? I don’t self-host, even though I could get it working and I self-host plenty of other things, because I’m not a security expert and I think it is more likely I would put my password manager at greater risk than Bitwarden.
jbm 2y ago
> "Point your domain's DNS to server" A lot of advanced users don't have servers, and they don't want to expose their desktop or an appliance to the internet. Moreover, are you going to trust your precious password information on a leased server run by Linode or whoever? On topic, I use Bitwarden, but their changes to the iOS application are very annoying. I've been logged out repeatedly (at least once per week) and it keeps requiring me to input my password, without any way to reduce the overhead. It's so frustrating that I've been considering switching to the native iOS password app; if it was available on Linux, I would bid farewell to Bitwarden.
- godelski 2y ago
  I had issues with this (new iPhone user and ... well... I'm having fun...) A problem I had was my encryption settings. Definitely I am a bit overkill[0], but this might be worth checking. I use Argon2 and tried to find the max settings I could use on my iPhone16. Make sure the KDF memory is lower than 256MB. Keep iterations low (<=10) and parallelism not too high (4 seems about right). So do something like 128MB, 8 iterations, 4 parallel and you'll be good. If this reddit post is anywhere near accurate, should cost in the tens of millions of dollars to crack your master passphrase[1]. But users there also are saying they can get higher settings so YMMV. (BTW, these settings should be changed from the bitwarden website) [0] Philosophy has always been: make it as secure as possible without being meaningfully impactful. Which is always above the standard security levels. [1] https://www.reddit.com/r/Bitwarden/comments/1167rwm/pbkdf2_vs_argon2_finally_some_hard_numbers/ https://www.reddit.com/r/Bitwarden/comments/1167rwm/pbkdf2_v...
93n 2y ago
Plus backups, which you want to ensure are solid for data like this.
- godelski 2y ago
  This is my issue with hardware keys too. It's been unclear to me how I have a backup and what's the best way to ensure that that backup is constantly in sync. Plus, is a website going to support it? So many websites are shifting to OAuth, and making it the __only__ form of authentication. I really don't like this AND they usually only support a very limited set of authorities which is almost exclusively "Google and Apple", so I can't even run my own. The fuck is the "O" mean in "OAuth" then?! (╯°□°）╯︵ ┻━┻ I'm trying to __reduce__ my (meta-)data exposure, not increase it! Like good god, I don't know if it is a conspiracy or stupidity that's causing all this centralization and I'm not sure there's a meaningful difference. (unintentional or implicit conspiring rather than explicit) This is Hacker News, surely there's people here that are fighting/pushing back. It's unclear to non-security experts like me how to actually do this besides not use a service (far easier said than done. These choices are often forced upon people)
ctkhn 2y ago
you don't even need to have your DNS turned on or run a reverse proxy - how often are passwords updating? my instance is local network only and the phone, desktop, and chromium extensions sync when I'm at home.

by Liquix 2y ago

godelski 2y ago

I don't disagree with you, but a lot of people don't understand any of those steps. 3 is the step most people will understand, I think you can understand that LetsEncrypt can be confusing the first time, and well... DNS... that's notorious for people being confused on. What people consider "advanced user" varies quite a bit and there's a lot of subdomains in computing. (Though maybe the term is also degrading...)

542354234235 2y ago
It strikes me that if you aren’t advanced enough for this then you probably aren’t advanced enough to safely manage your password manager locally. If you don’t have a good understanding of things like DNS, do you understand the vulnerabilities you need to mitigate for in a self-hosted situation? I don’t self-host, even though I could get it working and I self-host plenty of other things, because I’m not a security expert and I think it is more likely I would put my password manager at greater risk than Bitwarden.

jbm 2y ago

> "Point your domain's DNS to server" A lot of advanced users don't have servers, and they don't want to expose their desktop or an appliance to the internet. Moreover, are you going to trust your precious password information on a leased server run by Linode or whoever? On topic, I use Bitwarden, but their changes to the iOS application are very annoying. I've been logged out repeatedly (at least once per week) and it keeps requiring me to input my password, without any way to reduce the overhead. It's so frustrating that I've been considering switching to the native iOS password app; if it was available on Linux, I would bid farewell to Bitwarden.

godelski 2y ago
I had issues with this (new iPhone user and ... well... I'm having fun...) A problem I had was my encryption settings. Definitely I am a bit overkill[0], but this might be worth checking. I use Argon2 and tried to find the max settings I could use on my iPhone16. Make sure the KDF memory is lower than 256MB. Keep iterations low (<=10) and parallelism not too high (4 seems about right). So do something like 128MB, 8 iterations, 4 parallel and you'll be good. If this reddit post is anywhere near accurate, should cost in the tens of millions of dollars to crack your master passphrase[1]. But users there also are saying they can get higher settings so YMMV. (BTW, these settings should be changed from the bitwarden website) [0] Philosophy has always been: make it as secure as possible without being meaningfully impactful. Which is always above the standard security levels. [1] https://www.reddit.com/r/Bitwarden/comments/1167rwm/pbkdf2_vs_argon2_finally_some_hard_numbers/ https://www.reddit.com/r/Bitwarden/comments/1167rwm/pbkdf2_v...

93n 2y ago

Plus backups, which you want to ensure are solid for data like this.

godelski 2y ago
This is my issue with hardware keys too. It's been unclear to me how I have a backup and what's the best way to ensure that that backup is constantly in sync. Plus, is a website going to support it? So many websites are shifting to OAuth, and making it the __only__ form of authentication. I really don't like this AND they usually only support a very limited set of authorities which is almost exclusively "Google and Apple", so I can't even run my own. The fuck is the "O" mean in "OAuth" then?! (╯°□°）╯︵ ┻━┻ I'm trying to __reduce__ my (meta-)data exposure, not increase it! Like good god, I don't know if it is a conspiracy or stupidity that's causing all this centralization and I'm not sure there's a meaningful difference. (unintentional or implicit conspiring rather than explicit) This is Hacker News, surely there's people here that are fighting/pushing back. It's unclear to non-security experts like me how to actually do this besides not use a service (far easier said than done. These choices are often forced upon people)

ctkhn 2y ago

you don't even need to have your DNS turned on or run a reverse proxy - how often are passwords updating? my instance is local network only and the phone, desktop, and chromium extensions sync when I'm at home.