Hacker News Reader

Comment by doodlesdev | Hacker News Reader

Proton Pass cannot be self-hosted.

I am using Keepass XC + Keepass DX synchronized with Syncthing. There's really nothing to self-host, other than throwing Syncthing on a NAS so you can make sure you have at least one machine online at all times. But even that isn't critical, since both Keepass XC and Keepass DX have a "Merge" option if anything falls out of sync.

ive used keepassxc forever, switched to proton pass after the release, because i was managing my db in git and it was always a pain to keep in sync, but switched back a couple of weeks ago with exactly the same setup, syncthing and KeepassDx also works suprisingly well.

mostly i was missing power user features and especially ux for the browser plugin, namely you can't operate it fully with the keyboard, with keepassxc you can

As as self-hoster, I recommend vault warden. Supports 2fa, written in rust, works pretty well, is easy to backup, and you can use bitwarden's phone client.

I'm curious why other self hosters think it's a bad idea.

Presumably, it's a memory hog. What is your RAM usage?

For me, vaultwarden's RSS is ~45 MB, with ~13MB of that being shared. I have it running as a secondary thing on a 512 MB machine and don't notice it's there. Is there a reason you presume it's a memory hog?

I'm surprised, actually. I expected at least an order of magnitude more. In my humble opinion, this is still a lot of memory -- probably an order of magnitude (or even two) more than what is realistically required for the task. But this is just my own philosophy, and I do realize that the days of careful memory utilization are long gone.

Thanks for sharing.

For me, RSS 35 MB, SHR 23 MB. The vaultwarden executable is 38 MB (typical Rust executable that links Rust code statically, and only dynamically links libssl.so and libc.so dynamically).

So probably its RSS usage is just mostly its own executable code?

I think the memory hog you're thinking of is the official Bitwarden self-hosted backend. Vaultwarden is pretty light on resources.

> and you can use bitwarden's phone client

What will you use when this stops working in the near future?

You use Keyguard (https://github.com/AChep/keyguard-app).

May be worth submitting this to the front page

>The source code is available for personal use only.

Not sure how switching from a "FOSS with some proprietary source-available components" client, that can be forked mostly intact if need arises, to a full proprietary source-available client, that author can make closed source at any point with no forks being possible, is an improvement.

Why does everyone act like this hypothetical (and however likely) future is something that needs to be acted on now?

I'll just export my vault and move to KeepPass or something else?

I moved to the cloud for a simple reason: if I die tomorrow people who depend in the service are screwed. And this is an important service, like email or digital archives.

I'm confused, so you are self hosting it for other people?

Yes I was - for me and my family (and a few friends)

Yeah I have no problems letting family and friends use cloud services. I keep the self hosted stuff for myself.

Because people don't trust themselves to do proper backups as if this is some kind of black magic or something.

I've been self hosting Vaultwarden for me and my wife for years without issue. People like to tell others what they should and shouldn't do because they want to feel superior to others, I suppose.

It's especially strange since self hosting is, aside from the 'fun' aspect of it, about personal control. So this tsk tsk'ing from others about self hosting a password manager is especially ridiculous.

As a self-hoster, I don't think password managers should be self-hosted.

On the contrary. If there's one thing you should self-host is definetly password manager.

Why, you can of course self-host it, too, but the infrastructure should be entirely separate.

What? Why not?

password managers should not involve hosting at all, use something file-local, keepass(xc) or alike

It should be something like, well, git (but likely not directly git): something that replicates easily, so that you'd have a remote copy accessed via internet ("hosted"), and local copies where you see fit.

pass can use git

https://www.passwordstore.org/

gopass is pretty nice and do its job https://github.com/gopasspw/gopass

Keepass people always in these topics with ”offline rules!! … now let me tell you how I use it with a copy on my phone and sync it with Dropbox and a backup on a git repo”

I setup it up for myself once and it was too much effort, and I found the browser integration very poor compared to Bitwarden.

How do you share a file-local system between multiple computers, your phone, tablet, etc?

I don't see much reason not to self-host a properly built password manager like Vaultwarden or something similar? The clients keep a local encrypted copy of the vault, so the server only needs to be up for syncing. If it went down for a week, you probably wouldn't even notice unless you were saving new logins. And even if the server got hacked, everything on it is encrypted. Why do you think it should not be selfhosted?

you just listed all the reasons why you don't need to self host yourself

Thanks, on these topics I feel like I’m fucking crazy for not wanting to self host.

If you believe that the technology works, that encryption is happening and that the decryption is only happening on your local machine then why in the fuck would I host this myself?

You need to believe that it does not work when they do it, but does work when you do it.

I have not seen any evidence of that.

It works just fine when they do it as long as they want, that is not the point. For me self hosting is a mostly a question of independence and digital sovereignty. We've seen all kinds of service providers turn into garbage over time, so I'd rather not rely on a company that needs to extract as much money from me as possible.

So what do you think the threat is? That they’re skimming data off with their extension? That they’re going to close up shop and take your encrypted vault with them? That they’re lying and storing your master and then peeking at your vault?

In order for snooping to be true, the extension would need to phone home what you’re viewing and I think that would be a pretty big no-go with everyone.

In order for them to close shop and take your vault… do you have any serious reason to assume that might happen? I’m sure it’s happened with X or Y obscure company before. Does it seem likely at bitwarden’s size? Is this threat not just as equally remedied with your own paper backup?

There are a lot of ways they can make the service worse without doing anything illegal. I would not be not worried about my secrets, I would be worried about all other things they can do when they sit at my browser.

The top comment in the post has a blog post which already shows that they are hiking prices without proper notifications, etc. To me it seems that Bitwarden is in a state where the software is pretty much complete, and majority of further development will go into capturing more value.

While "enshittification" might not happen here, its a typical pattern and there are many early signs here. When you selfhost things that just work, you need to worry far less about it.

Like, there are just so many things they can do. Their plugin already knows where you visit, they can sell your visitor data if they want. They can just increase prices. They can start making stupid limitations that force you to upgrade. They can remove possibility to export your data, claiming its a security feature, making leaving as hard as possible. They can start spamming you with all new obscure features and some NPS surveys and what not. Nothing bad, but increases cognitive load.

If you don't mind the risk, good for you. It is great that everyone can choose for themselves.

Can’t relate. If you’re worried about you’re own reliability to keep it online, just keep paper backups

But passwordstore.org can.

No reason to use anything more complicated.

Reply on news.ycombinator.com