166
Why self host a password manager?
(programming.dev)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 08 Oct 2024
166 points (96.6% liked)
Selfhosted
40677 readers
488 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
I don't, specifically because I don't trust myself to host that. I know what people will say here, but I trust 1pass way more than I could do it myself.
1pass uses your password plus a secret key to generate your full "password", meaning you need both to access your vault. The password you memorize, the key you keep safe somewhere (inside the vault is even good, since you probably have it open on another device should you need it). They publish their docs, and show how they encrypt your vaults. To them, your vaults are truly just random bytes they store in blob storage. They don't store your key, they don't store your password, they will not help you out if you lock yourself out. That's the level of security I want for a password vault. If they ever get breached, which hey, it can happen, the most someone will get is a random blob of data, which then I'd go and probably generate a new password and reencrypt everything again anyway.
Vs me hosting myself, I'm sure the code is good - but I don't trust myself to host that data. There's too many points of failure. I could set up encryption wrong, I could expose a bad port, if someone gained access to my network I don't trust that they wouldn't find some way to access my vaults. It's just too likely I have a bad config somewhere that would open everything up. Plus then it's on me to upgrade immediately if there's a zero day, something I'm more likely to miss.
I know, on the selfhosted community this is heresy, but this is the one thing I don't self host, I leave it to true security researchers.
Nah, I'm with you, except I use BitWarden.
There are somethings either worth paying someone else to host, or where you trust a 3rd party more than you're own setup. I realize other users may feel different, but ultimately it's a judgement call
BW has been a pretty great opensource company, and it's worth my $10/yr for premium.
Wow, Bitwarden has made leaps and bounds on catching up to 1password on dev tools and enterprise features the last few years. I'm going to need to re-evaluate/consider moving over.
Another great point, if I lose my Linux isos, sucks but I'll redownload. If I lose my family videos, sucks but I'll log into my backups and resync. If I lose my credentials I'm fucked. Plain fucked. I can't decrypt my backups, can't log into services, it's done.
Thats why ones password DB should also be saved encrypted one one or two external drives.
Not everyone has a safety deposit box, or the ability to access a proper and secure off-site storage.
And if you're just keeping those in your house, then fire, flood, and other incidents can destroy all copies at once.
As a side note, if you work somewhere that uses 1password, you can usually get your personal subscription comped as an individual. Only need to pay for it if you leave your company or they drop 1password.
I dont know that I'll stay on 1password forever, but on the scale of things I'm most concerned about self-hosting vs using a reasonably private SaaS, 1password is nowhere near the top of my list to ditch. Otherwise, its a solid recommendation for non-self hosters who want to make some progress.
Same with Keeper as far as I know (which is what we use at work).
I prefer security software to be open-source though, which is why I love Bitwarden. Even if you don't self-host it, there's still value in it being open-source.