4 ms·

Not my project but Vaultwarden is an open source (in Rust) alternative backend for Bitwarden. I believe its been around a while, and is still maintained. https

Not my project but Vaultwarden is an open source (in Rust) alternative backend for Bitwarden. I believe its been around a while, and is still maintained. https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden

pocksuppet 6mo ago
Is there an alternative frontend as well, or are you still locked in?
- belthesar 6mo ago
  There is not an alternative frontend that I'm aware of, but as the article mentions, the clients are Apache 2.0 licensed, so in the event of a rug pull, a fork and rebrand of the clients would be what is needed to restore service.
- backscratches 6mo ago
  Their android app at least is open source and on available on their own f-droid repo
- void-star 6mo ago
  https://github.com/doy/rbw https://github.com/doy/rbw Is an alternative Bitwarden cli front end. Probably has plenty of scaffolding to build a GUI frontend based on it. Edit: Just a bit of googling turned up these as well. https://github.com/AChep/keyguard-app https://github.com/AChep/keyguard-app https://github.com/sgolub/bitclient https://github.com/sgolub/bitclient
- fluidcruft 6mo ago
  Better question is how difficult would it be to have keypass use vaultwarden for sync.
duckmysick 6mo ago
Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?
- thesuitonym 6mo ago
  It's as reliable as you make it.
- hypeatei 6mo ago
  > Anything I'm overlooking here? Not technical, but the person behind that project now works for Bitwarden so there's some risk of a rugpull. Of course it's OSS but you'll need to trust a fork or maintain it yourself if said rugpull happens.
  - giancarlostoro 6mo ago
    Kind of makes a lot of sense that they wound up working there too.
  - Snow_Falls 6mo ago
    The maintainer has said that they've been given permission to maintain it in their free time. All it takes is a bad quarter and the CEO decides they don't want to be supporting a competitor and that goes away. It's possible that a community continuation could happen but I wouldn't rely on something so uncertain for something as important as credentials.
    - l72 6mo ago
      It’s a bad strategy. I am capable so I host an instance of vaultwarden for myself and spouse (only available via our vpn) But when friends and family ask for my recommendation I send them to Bitwarden and they pay for the service. If it wasn’t for vaultwarden and the clients being open source I would not be using it nor recommending it. I’d probably still be using keepass with manual sync and when friends and family ask for suggestions I’d probably shrug and say I don’t trust any of them.
danielmeskin 6mo ago
It is still maintained, but I believe the maintainer is employed by Bitwarden now, and is working on projects in addition to Vaultwarden.
WesolyKubeczek 6mo ago
Don't I have to rely on the OG frontend/GUI components, though? They are one automatic update away from bundling taking custom server address away with important security fixes, in a way that you are damned if you do and damned if you don't.
- PunchyHamster 6mo ago
  Technically yes but the frontend is so far open source so forking that is also something that could technically happen if company ever went back on it.
afavour 6mo ago
Personally, I want to avoid the responsibility for hosting it myself. I'm happy to pay for that. But a reasonable amount. Today Bitwarden's price is fine for me, but I worry about what's coming.
SilverElfin 6mo ago
How do you trust that it will be kept maintained and secure?
vovavili 6mo ago
No matter where Bitwarden ends up, passwords are one of these few things I am very hesitant to self-host. The stakes are just too high, and my knowledge of security has too many unknown unknowns to take that risk.

pocksuppet 6mo ago

Is there an alternative frontend as well, or are you still locked in?

belthesar 6mo ago
There is not an alternative frontend that I'm aware of, but as the article mentions, the clients are Apache 2.0 licensed, so in the event of a rug pull, a fork and rebrand of the clients would be what is needed to restore service.
backscratches 6mo ago
Their android app at least is open source and on available on their own f-droid repo
void-star 6mo ago
https://github.com/doy/rbw https://github.com/doy/rbw Is an alternative Bitwarden cli front end. Probably has plenty of scaffolding to build a GUI frontend based on it. Edit: Just a bit of googling turned up these as well. https://github.com/AChep/keyguard-app https://github.com/AChep/keyguard-app https://github.com/sgolub/bitclient https://github.com/sgolub/bitclient
fluidcruft 6mo ago
Better question is how difficult would it be to have keypass use vaultwarden for sync.

duckmysick 6mo ago

Question for anyone self-hosting vaultwarden: how reliable is it and how do you harden it? I'm thinking about running it in a container (Podman Quadlet with systemd) behind a VPN, with daily backups with borg. Anything I'm overlooking here?

thesuitonym 6mo ago
It's as reliable as you make it.
hypeatei 6mo ago
> Anything I'm overlooking here? Not technical, but the person behind that project now works for Bitwarden so there's some risk of a rugpull. Of course it's OSS but you'll need to trust a fork or maintain it yourself if said rugpull happens.
- giancarlostoro 6mo ago
  Kind of makes a lot of sense that they wound up working there too.
- Snow_Falls 6mo ago
  The maintainer has said that they've been given permission to maintain it in their free time. All it takes is a bad quarter and the CEO decides they don't want to be supporting a competitor and that goes away. It's possible that a community continuation could happen but I wouldn't rely on something so uncertain for something as important as credentials.
  - l72 6mo ago
    It’s a bad strategy. I am capable so I host an instance of vaultwarden for myself and spouse (only available via our vpn) But when friends and family ask for my recommendation I send them to Bitwarden and they pay for the service. If it wasn’t for vaultwarden and the clients being open source I would not be using it nor recommending it. I’d probably still be using keepass with manual sync and when friends and family ask for suggestions I’d probably shrug and say I don’t trust any of them.

danielmeskin 6mo ago

It is still maintained, but I believe the maintainer is employed by Bitwarden now, and is working on projects in addition to Vaultwarden.

WesolyKubeczek 6mo ago

Don't I have to rely on the OG frontend/GUI components, though? They are one automatic update away from bundling taking custom server address away with important security fixes, in a way that you are damned if you do and damned if you don't.

PunchyHamster 6mo ago
Technically yes but the frontend is so far open source so forking that is also something that could technically happen if company ever went back on it.

afavour 6mo ago

Personally, I want to avoid the responsibility for hosting it myself. I'm happy to pay for that. But a reasonable amount. Today Bitwarden's price is fine for me, but I worry about what's coming.

SilverElfin 6mo ago

How do you trust that it will be kept maintained and secure?

vovavili 6mo ago

No matter where Bitwarden ends up, passwords are one of these few things I am very hesitant to self-host. The stakes are just too high, and my knowledge of security has too many unknown unknowns to take that risk.