I’m going to move away from lastpass because the user experience is pretty fucking shit. I was going to look at 1pass as I use it a lot at work and so know it. However I have heard a lot of praise for BitWarden and VaultWarden on here and so probably going to try them out first.
My questions are to those of you who self-host, firstly: why?
And how do you mitigate the risk of your internet going down at home and blocking your access while away?
BitWarden’s paid tier is only $10 a year which I’m happy to pay to support a decent service, but im curious about the benefits of the above. I already run syncthing on a pi so adding a password manager wouldn’t need any additional hardware.
I don’t, specifically because I don’t trust myself to host that. I know what people will say here, but I trust 1pass way more than I could do it myself.
1pass uses your password plus a secret key to generate your full “password”, meaning you need both to access your vault. The password you memorize, the key you keep safe somewhere (inside the vault is even good, since you probably have it open on another device should you need it). They publish their docs, and show how they encrypt your vaults. To them, your vaults are truly just random bytes they store in blob storage. They don’t store your key, they don’t store your password, they will not help you out if you lock yourself out. That’s the level of security I want for a password vault. If they ever get breached, which hey, it can happen, the most someone will get is a random blob of data, which then I’d go and probably generate a new password and reencrypt everything again anyway.
Vs me hosting myself, I’m sure the code is good - but I don’t trust myself to host that data. There’s too many points of failure. I could set up encryption wrong, I could expose a bad port, if someone gained access to my network I don’t trust that they wouldn’t find some way to access my vaults. It’s just too likely I have a bad config somewhere that would open everything up. Plus then it’s on me to upgrade immediately if there’s a zero day, something I’m more likely to miss.
I know, on the selfhosted community this is heresy, but this is the one thing I don’t self host, I leave it to true security researchers.
Nah, I’m with you, except I use BitWarden.
There are somethings either worth paying someone else to host, or where you trust a 3rd party more than you’re own setup. I realize other users may feel different, but ultimately it’s a judgement call
BW has been a pretty great opensource company, and it’s worth my $10/yr for premium.
Wow, Bitwarden has made leaps and bounds on catching up to 1password on dev tools and enterprise features the last few years. I’m going to need to re-evaluate/consider moving over.
Yeah exactly. Passwords and OTPs are NOT the kind of thing you want to lose…
And while you obviously never want your data stolen, even LastPass they didn’t get any actual passwords. Much like 1Pass, Bitwarden or Proton Pass, none of which have had any breaches of any kind that I am aware of. Too many low-hanging fruit.
Another great point, if I lose my Linux isos, sucks but I’ll redownload. If I lose my family videos, sucks but I’ll log into my backups and resync. If I lose my credentials I’m fucked. Plain fucked. I can’t decrypt my backups, can’t log into services, it’s done.
Thats why ones password DB should also be saved encrypted one one or two external drives.
As a side note, if you work somewhere that uses 1password, you can usually get your personal subscription comped as an individual. Only need to pay for it if you leave your company or they drop 1password.
I dont know that I’ll stay on 1password forever, but on the scale of things I’m most concerned about self-hosting vs using a reasonably private SaaS, 1password is nowhere near the top of my list to ditch. Otherwise, its a solid recommendation for non-self hosters who want to make some progress.
Same with Keeper as far as I know (which is what we use at work).
I prefer security software to be open-source though, which is why I love Bitwarden. Even if you don’t self-host it, there’s still value in it being open-source.