I’m going to move away from lastpass because the user experience is pretty fucking shit. I was going to look at 1pass as I use it a lot at work and so know it. However I have heard a lot of praise for BitWarden and VaultWarden on here and so probably going to try them out first.

My questions are to those of you who self-host, firstly: why?

And how do you mitigate the risk of your internet going down at home and blocking your access while away?

BitWarden’s paid tier is only $10 a year which I’m happy to pay to support a decent service, but im curious about the benefits of the above. I already run syncthing on a pi so adding a password manager wouldn’t need any additional hardware.

  • april@lemmy.worldEnglish
    521·
    22 days ago

    Because when whatever company gets a data breach I don’t want my data in the list.

    With bitwarden If your server goes down then all your devices still have a local copy of your database you just can’t add new passwords until the server is back up.

    • slackj_87@lemmy.worldEnglish
      6·
      21 days ago

      Pretty much this. Combined with how easy it is to install VaultWarden (docker ftw), it was a no brainer for me.

      Also, my little home server is a WAY less juicy target for someone looking to steal and sell a bunch of passwords.

      Been running it for probably about 2 years now. No ISP outages but a couple self-inflicted ones. Didn’t even notice the outages in the BitWarden app/extension.

    • el_abuelo@programming.devOPEnglish
      3·
      22 days ago

      This was also the most compelling reason for me to consider it.

      I do think that balanced against the time and effort and risk of me fucking up outweighs this benefit. But I can totally see why for some that balance goes the other way.

      • april@lemmy.worldEnglish
        2·
        21 days ago

        I think the main thing for not messing it up is just make sure you keep it updated. Probably set up auto updates and auto backups.

    • markstos@lemmy.worldEnglish
      13·
      21 days ago

      1Password’s security model guards against this. Even if they are breached, your passwords cannot be decrypted.

      You are more likely to screw up your own backups and hosting security than they are.

      • april@lemmy.worldEnglish
        9·
        21 days ago

        LastPass said the exact same thing. I won’t be a big target like they will though.

        • markstos@lemmy.worldEnglish
          1·
          21 days ago

          LastPass doesn’t have your password, so it can’t be stolen during a breach.

          But 1Password goes a step further, also requiring a “secret key”, which also can’t be stolen.

          https://support.1password.com/secret-key-security/

          Even if an attacker manages to steal your encrypted data from 1Password and also guess your master password, they still can’t access your data without a secret key.

          For that reason, your 1Password account is more likely to compromised through your own device, not their server. And if your own devices are thoroughly compromised, no password manager can save you— the attacker can potentially grab all you type and see all you see.