I was thinking about self hosting but I was worried it would be less secure. I don’t really know a lot about setting that kind of thing up (I do have programming experience but don’t have a lot of server hosting experience outside of doing it for games like Minecraft) and I feel like I’d mess it up and it would be a lot easier to get into than a hardened server. Especially cause the odds I get a virus or something is probably higher then the odds someone breaks into bitwarden’s server. Idk if I’m wrong about this, would love to be corrected if I am, was just my initial thoughts when I switched over from a different password manager to bitwarden.
If you don’t trust yourself 110%, don’t host it yourself. Too risky. I self-host everything, but I leave email and passwords to someone else because it’s just too important.
I think the bigger thing to worry about is, what would happen if your server fails or is destroyed? Would you have a backup of all your passwords? And if yes, are those backups updated regularly and stored in a safe place that also won’t get destroyed if the server gets destroyed (like, say, a house fire)?
Then, yes, you got the cybersecurity angle too
It’s a lot to think about for something as important and fundamental to everything you do on the internet as passwords (and accounts)
The most secure practice for any high-value accounts (email etc) is to use WebAuthn with a hardware key like a Yubikey.
TOTP is still vulnerable to phishing (a fake login page can ask for both a password and a TOTP code) so business/corporate environments are moving away from them.
The paid features aren’t free if you self-host either. You still need a premium account to use premium features with a self-hosted Bitwarden, unless you modify the code and remove the licensing checks. Licenses are pretty cheap though.
The major features are free if you use Vaultwarden, which is an alternative server implementation.
Recently started using Bitwarden and it works really well. You can even ditch authenticator because it has OTP built in too.
I selfhost it though because I trust nobody with this type of sensitive data, encrypted or not.
I was thinking about self hosting but I was worried it would be less secure. I don’t really know a lot about setting that kind of thing up (I do have programming experience but don’t have a lot of server hosting experience outside of doing it for games like Minecraft) and I feel like I’d mess it up and it would be a lot easier to get into than a hardened server. Especially cause the odds I get a virus or something is probably higher then the odds someone breaks into bitwarden’s server. Idk if I’m wrong about this, would love to be corrected if I am, was just my initial thoughts when I switched over from a different password manager to bitwarden.
If you don’t trust yourself 110%, don’t host it yourself. Too risky. I self-host everything, but I leave email and passwords to someone else because it’s just too important.
I think the bigger thing to worry about is, what would happen if your server fails or is destroyed? Would you have a backup of all your passwords? And if yes, are those backups updated regularly and stored in a safe place that also won’t get destroyed if the server gets destroyed (like, say, a house fire)?
Then, yes, you got the cybersecurity angle too
It’s a lot to think about for something as important and fundamental to everything you do on the internet as passwords (and accounts)
backups aren’t that big of a deal with bitwarden as every client keeps a copy of the database that can be restored.
It’s pretty easy to setup using docker, you do need to know that ofcourse and how to setup dns and stuff.
I have it firewalled so my vault is not accessible from the internet, only from home or vpn to home.
so no more authy? BITWARDEN HAS THAT BUILT IN??? thats AWESOME
So does keepass
Yep, and Vaultwarden too!
Though the most secure practice is to store them separately.
Alr
The most secure practice for any high-value accounts (email etc) is to use WebAuthn with a hardware key like a Yubikey.
TOTP is still vulnerable to phishing (a fake login page can ask for both a password and a TOTP code) so business/corporate environments are moving away from them.
Sure, hardware keys are superior!
I’m only talking about best practtices when using TOTPs in particular.
It is a paid feature though if you don’t selfhost
The paid features aren’t free if you self-host either. You still need a premium account to use premium features with a self-hosted Bitwarden, unless you modify the code and remove the licensing checks. Licenses are pretty cheap though.
The major features are free if you use Vaultwarden, which is an alternative server implementation.
Oh
But it’s cheap! $10 a YEAR when I last checked.
alr
Yep, for only $10 per year. But just make sure to keep backups of your vault and/or make an emergency kit.
Alr