Hacker News Reader

Comment by scrollop | Hacker News Reader

You should try hosting it yourself in docker. Absurdly easy to do if you get an llm to do it and it works very, very well.

Hope they don't alter self hosting it.

View on HN

It is absurdly easy to fire off the docker container you mean.

Because you need to back up, verify backups, monitor availability, manage updates, manage MFA, and a zillion things.

Don't get me wrong, I work in hardcore, high tech IT for 30 years and I selfhost two dozen or so of services. It is far, very far from "absurdly easy" when you start .

Sure you can run a container on your pc, and hope for the best

Exactly.

I’ve seen this idea so many times on HN. “Just stand up a docker container and self-host”. Or even worse: “why does anyone need GitHub - just host Bitbucket yourself”

Ok, then what?

This seems crazy to me. I have a home server and host lots of my own stuff. But a password manager is tier-0, it cannot fail me.

I need to access my accounts while I'm overseas - in fact I'm prompted for passwords far more often when I cross borders. I need my passwords at urgent moments like when I need to make a large bank transfer. I need passwords unexpectedly at all times when sessions expire or I need a new session for a device I've never logged in with.

If my home server went down for any reason at these critical moments it could be extremely bad. There are some kinds of outages I can't recover from without physically attending my server. And if I'm not very very careful there are some kinds of failures I cannot recover from at all - I have a working backup solution but so did every company that lost customer data before.

And this doesn't even touch on the security risk of hosting a database of credentials on a publicly available endpoint.

I need a trust hosted solution.

You can get rid of the element of hope by using KeepassXC and syncthing. Bonus is you can use this FOSS stack completely offline.

And not be able to use it on your phone or share it with people you work with.

Vaultwarden is the way. Easy to host docker. Solid. And if bitwarden blocks the clients there will be a fork.

It's leading to it anyway.

I really hope the community gets together and creates a better browser extension. Vaultwarden + that would be perfect.

Syncthing works on Android just fine, though I'm not familiar with iOS. There also several keepass compatible clients, some support sync via cloud storage. Don't need to host anything. But I admit, for corporate shared secrets storage it is not a right tool.

I self-host Vaultwarden and it's great, but I'm not so sure that we can rely on trustworthy forks of the phone app and browser extensions.

KeepassDX works great on my phone. I use LocalSend to move around keyfiles fully offline as well.

You can use it on your phone what are you talking about?

That's what I'm saying, a lot of people are coping with a product they admit will need a fork.

Not only is it incurring the cost of project fragmentation, but also incurring an always online cost with overly-complicated docker solutions, when a fully offline and airgapped solution already exists.

Furthermore, staying with the same ecosystem invokes the sunken cost fallacy. But the migration from Bitwarden couldn't be simpler (just export Bitwarden json file). It's almost a form of battered woman syndrome people are inflicting on themselves when quite simply they can hop onto an already proven ecosystem that doesn't bait and switch.

I was on keepass before bitwarden. Bitwarden just solves more things for me. I am sure the keepass ecosystem improved a lot over the years but fundamentally i find vaultwarden docker to be far easier. Especially for my work and family members that i convinced to use bitwarden. If they were also in charge of the sync it wouldn't be possible.

Afaik vaultwarden and bitwarden clients are as proven as keepass.

Proven to bait and switch as it turns out much unlike keepass.

If you're going to the trouble of self-hosting, I'd suggest just running vaultwarden.

https://github.com/dani-garcia/vaultwarden

It's entirely compatible with the clients. It also removes a lot of "rug-pull" potential, and gives you the ability to access all the nice features (ex - multi-org, multi-user, shared vaults, totp, etc...)

Honestly - part of the reason I like Bitwarden is that if they ever go full "enshittification", it's going to be relatively easy and straight-forward to just move entirely off their projects and onto open-source forks.

Cant tell if this is satire. But I'm not self hosting my passwords unless I fully understand exactly what's happening. Trusting that to an LLM without really understanding what's happening seems very risky to me.

Reply on news.ycombinator.com