Not sure I understand why you’d want to self host a password manager. Bitwarden has never been breached AFAIK. How is it better or safer to keep if self hosted?
Regulatory requirements and management decisions.
Oh, you thought self-hosting was only for hobbyists? 🫠
Bitwarden has never been breached AFAIK
Password managers are a HUGE target, and while I’m sure they do everything possible to prevent a breach from actually obtaining peoples passwords, vulnerabilities do happen.
That’s why I think self hosted Bitwarden or KeePass with a file are the way to go.
Can be safer. Can be worse.
A poorly configured self hosted vaultwarden can be a major security issue.
A properly configured one is arguable safer than hosting with a 3rd party. Lastpass taught me that one.
If you configure it to where it’s not exposed to the web, and only accessed through a VPN, like Tailscale. It can be quite robust.
It’s good if you like self-hosting stuff.
However, what I tell people is this:
If you know jack about security and how to lock down a machine that is running Vaultwarden, then it’s useless. You should go with Bitwarden.
If you’re looking to install it just to play around with, I would be very cautious about what you store there, unless you can lock the system down to where it’s not accessible by the outside internet and localized only to your network.
And I have redundant backups in place in case one decides to fail, which are all encrypted with GPG and a few other measures.
If you have it installed and not accessible to anyone else but you, it’s a fun project. I like using VW and BW.
The other bonus would be no one is going to look to target you specifically unless you’re turned into a target.
Whereas if BW were to be breached, it wouldn’t have anything to do with you.
However, BW utilizes encryption, so even if they did somehow manage to get in, they can’t read your passwords.
Alright, what minimal security do you need to lock down your vaultwarden? Wireguard, firewall, fail2ban? I’m trying to learn good security practices for my server
Honestly just install wireguard on client and they use that to remote access the server when away from lan network
Are you asking /r/selthosted what the point of selfhosting is?
I think you may be forgetting that Bitwarden has a self hosted version, it’s just really not commonly used with subs audience. Mostly as until recently they didn’t have a unified deployment and most people only want one container so that plus cost means most don’t use it.
I did not forget.
OP is asking about the point of selfhosting either Vaultwarden or Bitwarden, versus using the Bitwarden website (not selfhosted).
Vaultwarden is a single container that uses like 20mb of memory, official bitwarden comes with multiple containers and 2-3GB memory last time I used it.
Also vaultwarden comes with all premium features especially 2fa without having to pay for it.
You should not be forced to pay for essential security features…
Lastpass had “never been breached”… Until they were.
Different people have different risk tolerances and amount of resources to dedicate to securing this stuff.
Personally, I’m going to use KeePassXC, and be responsible for 1 single file before I host an entire back end server system.
A few reasons.
-
Privacy, you control your data. It doesn’t go to someone else’s server to sit.
-
Security. It’s on your server. Password managers are primarily targets for hackers, i don’t want to name names, cause I’m not 100% sure of the name. But, one pw manager was hacked like 3x in the past year or something. It’s on your server, you are less likely to be targeted for a huge data breach, and you get to manage your data. Not someone else who fucks up.
-
You can’t be banned, or have the provider suddenly change access to the server, thus losing your data. I will name names here. MyQ garage door opener by Chamberlain suddenly removed the smart home integration, since the whole system ran on their servers. Removing the functionality users paid for. But they don’t own it, so they just got fucked. Your data/service on someone else’s server, is actually their data/service, you are just a visitor.
But I do run my vaultwarden on arch…no one gives a shit
The name is LastPass.
I laughed at this. Tell people at parties you run Arch. I need new friends. Thank you for this.
-
The web version is most definitely safer. Most of the people here probably don’t penetration test their servers, conduct security audits or use best practices. Unless you are a cyber security guru on par with a dedicated team, the web version will be much safer for you.
I do enjoy hosting my own stuff and although Bitwarden also has an on-premise option, vaultwarden runs in a single container instead of ELEVEN.
Also you can use your reverse-proxy of choice (Caddy for me) and aren’t kind of forced to use nginx if you want to host anything else on the same server and your config isn’t in danger anytime you update.
For me, I just enjoy selfhosting things that I can. In addition to vault warden, I have about 30 other services. Some rarely used, but I’ve learned so much about creating, maintaining, updating, and hardening servers; how containers work, vms, networking, etc.
If selfhosting isn’t enjoyable for you or you don’t have time for the upkeep, or if you’re satisfied with bitwarden in the cloud, stick with it. They have a great service and it does seem to be a bit safer than some of the other services. Personally, I like the work that ProtonVPN is doing. They have a password manager that is still in the early stages but has a lot of promise.
I don’t self host anything where it would impact me unduly if it went down while I was on holiday to the point where I’d have to break state and fix stuff.
A password manager falls in that camp so it’s paid-for Bitwarden every night every day every possible way for me.
Sure Vaultwarden suits others - generally those who either want control of their data, smaller target on their back than a public instance user, watching their pennies etc.
I literally just had the exact opposite question! I’ve been wondering why you’d want to pay for a password manager service when you could self host it. The only reason I could think of is guaranteed high uptime, but to me (and at least in my personal use case) that seems a bit pointless, since you can have a copy of your password manager on each device, which is being synced through your server
A lot of people prefer to take their security in their own hands. Enough people to make and maintain forks like these.