I still don’t get why people want to have cloud-based password managers. Keepass works in all major platforms, it’s just one file, which it is super easy to sync and/or merge. It can integrate with your browser/Os if you want, but otherwise the surface attack is basically zero.
Smart move, unless you really know what you’re doing and have redundancy. When I first made the switch from Lastpass to Bitwarden I had tried to host the vault myself instead of using the cloud version, which worked fine right up until the moment I had a server outage and lost access to all my passwords.
I’ve managed to keep my KeePass database for almost 20 years going back as far as when I was a dumb teenager. Back then it was as simple as having a couple extra copies on usb drives and Google Drive, but now I keep proper backups.
My take is, I’d rather control it myself, I am responsible enough to take care of my data, and I actually wouldn’t trust someone else to do it. That’s a huge reason I selfhost in the first place, a lack of trust in others’ services. Also, online services are a bigger target because of the number of customers, and maybe even the importance of some of their customers, whereas I’m not a target at all. No one is going to go after me specifically.
I think that’s what’s kept me at KeePass rather than moving to something like Bitwarden. Since it’s file-level encryption, anything that can serve files can also serve my KeePass database. When I upgrade servers or change to different services, restoring my database is as simple as throwing the file into that new service and going on with my life.
Oh man, that’s actually really good advice! I recently switched to Vaultwarden, but you’re right: If my server goes down, I can’t even restart it, because the password for my account is in there! Damn! Close call!
Well with bitwarden/vaultwarden you can have a copy of your entire vault on your phone or computer or both… so even if your server was totally dead, you’d have access to your passwords. Solid backups is a must, I follow the 3-2-1 rule on super critical systems (like vaultwarden) and test that you can actually recover. Something as simple as spinning up a VPS, testing a restore, testing access, see if that could work in a pinch until you get your server back online, then tear it down. Linode is very cheap for this kind of testing, it’d only cost you a few pennies to run a “dr” test of your critical systems. Of course you still want to secure it, I’d recommend wireguard or tailscale instead of opening access to your DR node to the internet, but as a temporary test it’s probably fine if your running patched up to date versions of docker, vaultwarden, and I’d always recommend putting a reverse proxy in front like nginx.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
Password manager like Bitwarden. I’d rather they take care of it for me. The consequences would be too great if I messed it up.
Bwoa, you can easily take json backups. It is pretty safe imo.
I still don’t get why people want to have cloud-based password managers. Keepass works in all major platforms, it’s just one file, which it is super easy to sync and/or merge. It can integrate with your browser/Os if you want, but otherwise the surface attack is basically zero.
Smart move, unless you really know what you’re doing and have redundancy. When I first made the switch from Lastpass to Bitwarden I had tried to host the vault myself instead of using the cloud version, which worked fine right up until the moment I had a server outage and lost access to all my passwords.
Eh, the clients all cache your vault. It shouldn’t be a huge issue for it to be down even for a few days.
But I do upload encrypted backups of the server every 6 hours to cloud storage
Same.
Plus, my instance is proxies through Clouflare and only IPs from my country are allowed.
I’ve managed to keep my KeePass database for almost 20 years going back as far as when I was a dumb teenager. Back then it was as simple as having a couple extra copies on usb drives and Google Drive, but now I keep proper backups.
My take is, I’d rather control it myself, I am responsible enough to take care of my data, and I actually wouldn’t trust someone else to do it. That’s a huge reason I selfhost in the first place, a lack of trust in others’ services. Also, online services are a bigger target because of the number of customers, and maybe even the importance of some of their customers, whereas I’m not a target at all. No one is going to go after me specifically.
I think that’s what’s kept me at KeePass rather than moving to something like Bitwarden. Since it’s file-level encryption, anything that can serve files can also serve my KeePass database. When I upgrade servers or change to different services, restoring my database is as simple as throwing the file into that new service and going on with my life.
Yeah, my recommendation is basically this:
Do you need to share passwords?
No - use KeePass
Yes - use Bitwarden
Oh man, that’s actually really good advice! I recently switched to Vaultwarden, but you’re right: If my server goes down, I can’t even restart it, because the password for my account is in there! Damn! Close call!
Usually the password are also stored locally.
I can definitely access all my passwords offline with bitwarden
Well with bitwarden/vaultwarden you can have a copy of your entire vault on your phone or computer or both… so even if your server was totally dead, you’d have access to your passwords. Solid backups is a must, I follow the 3-2-1 rule on super critical systems (like vaultwarden) and test that you can actually recover. Something as simple as spinning up a VPS, testing a restore, testing access, see if that could work in a pinch until you get your server back online, then tear it down. Linode is very cheap for this kind of testing, it’d only cost you a few pennies to run a “dr” test of your critical systems. Of course you still want to secure it, I’d recommend wireguard or tailscale instead of opening access to your DR node to the internet, but as a temporary test it’s probably fine if your running patched up to date versions of docker, vaultwarden, and I’d always recommend putting a reverse proxy in front like nginx.