• adr1an@programming.dev
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 month ago

    Not to flame on anyone, and without reading the details on the specific CVE. But, to share as an advice: this reason is why I prefer keepass + syncthing for my needs. Security for a full blown web app is not trivial and has a bigger “attack surface” than a kdbx file moving p2p through my devices via syncthing.

    • sugar_in_your_tea@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      0
      ·
      1 month ago

      If that works for you, great. But a self-hosted service offers a lot of convenience for a relatively small amount of added risk. Some things I like about Bitwarden/Vaultwarden:

      • can share logins easily w/ my wife, while each having our own passwords
      • nice UX for my phone and desktop (prompts for most apps that require passwords)
      • web vault so I can access my logins if I don’t have my phone with me (e.g. lost phone while traveling)

      And since it’s self-hosted, I’m far less likely to be targeted than the official Bitwarden instance since an attacker would need to know my domain, as well as being able to exploit the vulnerability through my multiple layers (requests go through HAProxy, my VPN, and Caddy before getting to Vaultwarden). I can make it even more secure by putting it inside my VPN (I have mine routed outside my VPN for the web vault access).

    • MangoPenguin@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      0
      ·
      1 month ago

      Security for a full blown web app is not trivial and has a bigger “attack surface” than a kdbx file moving p2p through my devices via syncthing.

      Absolutely.

      My Vaultwarden instance is only accessible via LAN or VPN though, I don’t think I’d want to expose it to the internet.