When you all self-host this, you also do the following, right?
- Create threat models that identify weaknesses in the design of your self-hosted setup.
- Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering.
- Deploy an intrusion detection system to know if you've been compromised.
- Perform all OS and app patching automatically, or regularly without fail.
- Follow CVE feeds in case a zero day needs to be fixed before the next patch window.
- Arrange for an expert to perform regular penetration tests.
- Deploy a tool that detects and alerts on things like firewall misconfigurations.
- Regularly test your backup and recovery methods, since if you also store 2FA codes and backup codes in there, you could be permanently locked out of your accounts.
1. If for some reason a state-based actor takes interest in me, I'm boned no matter what I do. I wouldn't trust any hosted service in that circumstance and that includes the service I'm running Vaultwarden on. My vault isn't even what they'd necessarily attack; they'll go straight after my bank and straight after my other high-value accounts and there's nothing I can do about that either.
2. My self-hosted Vaultwarden setup will defeat any random scanner and the majority of random Joe Schmoe Hacker guys. In principle it even defeats a casual insider on my hosting service because just grabbing a disk image actually shouldn't help them much; they need to compromise Vaultwarden (not just the OS generally, Vaultwarden specifically) somehow, and probably actually my Vaultwarden client too.
The rest of your concerns hypothesize a class of attacker I think borders on, but is perhaps not quite, nonexistent. I'm not really concerned about the super-skilled hacker, who is limited to only my vault as their attack vector, and apparently has very fresh if not zero-day vulns that they are willing to deploy against me and specifically me, only me, their payoff for their personalized and specialized hacking effort is just that they get specifically my (encrypted) vault and nobody else's. That is a very specific level[1] of interest in me this hacker, that is not defeated by my current setup, but is defeated by what you outline, has in me.
Edit: Actually what makes me the most nervous overall is compromises of the client, not the self-hosted server I run. For practical purposes 100% of my risk in this setup is there.
You posed it as a joke, but it's quite true: the "real deal" professionals get hacked frequently. Doing the barebone basics will protect you from 99% of the crap out there.
As another poster mentioned, if some state-based actor gets interested in me, I'm hosed no matter what.
For me it is worth it to host a password manager for me and my family, although I just did a one-click install on Digital Ocean (using Bitwarden, not Vaultwarden ... so far).
To me (and I'm pretty ignorant about this stuff), the biggest weakness of a password manager is that it's the one link in a chain that somebody needs to break to have all of my passwords. Hosting that at bitwarden.com or lastpass.com or whatever makes it an even sweeter target because those are known targets. At least self-hosting makes it more difficult for somebody else to find my password manager.
Moving to Vaultwarden has its complications but it would also be fun, and maybe a cool project for the kids. And like you say, if we screw up and they lose their instagram password they won't even remember the pain once they've all grown up and the world is a dystopian nightmare of climate catastrophes, wars, etc. They'll be busy looking for the fattest grubs to eat.
The vault is client side encrypted so it doesn't actually matter. My host provider could be the robot devil living in North Korea and it wouldn't matter, that's literally the defined purpose of encryption, secure communication across adversarial channels.
I don't really understand why people bother with this security theater, all the self hosting is completely redundant.
I don't self host because of "security theater". I do it because I want to control my data and not be at the behest of a third-party to resist the siren song of enshittification.
1) I’m going to go out on a limb and guess Lastpass, Okta, et al., WERE and ARE SOC2 type II certified. Didn’t stop them from getting breached.
2) SOC2 is defined by the American Institute of Certified Public Accountants. That it is held up as some sort of exemplary cyber security standard is absolutely ridiculous.
Not to defend them, but it doesn't matter if a hosting provider does that. So long as you can sue them for your full damages when it goes wrong.
That's the whole point of SaaS isn't it? We pay you to manage this, you manage it appropriately taking advantage of economies of scale, we sue the shit outta you if it goes wrong.
The whole point of saas is someone the CTO can blame when things go wrong.
Doesn't matter if the downtime is higher, doesn't matter if there are more succesful attacks.
If a CTO goes in-house, they carry the risk. If they outsource it to a vendor, especially one with a Gartner report, they can play golf and not risk their bonus.
Or, you might pay an insurance company to cover you for the risk - and so long as you have the right attestations from your SaaS providers, your insurer pays out in the event of a problem (and maybe goes after the SaaS if they feel the need to).
The bigger risk is likely your client, which might even be inside your browser, gets hacked / compromised. And that is the same regardless if you self-host.
That said, I got a Proton family account and switched, in Proton Pass it is much more intuitive and easy to share with family (just say: share this folder with that fam member, read or read/write), since you don't need the whole "Organizations" layer needed in Bit/Vaultwarden (which also has it's ups, I know). Happy to report that Vaultwarden exported everything nicely to .json and importing into Proton Pass was flawless.
I also find Proton Pass to be a bit more helpful in associating urls with credentials, + I now use the 1 alias per login (each credential set has a unique email address) without any effort, Vaultwarden can't do that (yet? Although seems complicated to implement), only (paid) Bitwarden I guess.
I don't currently self-host Vaultwarden, though I do have quite a few services running on my home server.
I lean on Tailscale to avoid exposing the server to the public internet. That doesn't handle the backup and restore concern, but unless I'm missing something I should be pretty well mitigated on network security issues since I avoided firewall and port configuration all together.
Well, first off, Strongbox is Apple specific, and I don't use Apple devices. Second, it does not appear to be 100% open source, though it is based on some open source code from KeePass.
So the real question for me would be why not use KeePass, which is what I used before switching to Bitwarden. I switched because at the time, Bitwarden had better clients, better integration with Android and Firefox. That situation has changed some since, but I haven't had any good reason to switch back.
I wouldn't use this because six months from now this very well meaning developer may sell the company to a buyer who ends up being less scrupulous. You're one update away from losing control of your entire digital life.
- Create threat models that identify weaknesses in the design of your self-hosted setup.
- Harden the OS with things like MAC, and harden the container with dropped privs, read-only root filesystem, and outbound network filtering.
- Deploy an intrusion detection system to know if you've been compromised.
- Perform all OS and app patching automatically, or regularly without fail.
- Follow CVE feeds in case a zero day needs to be fixed before the next patch window.
- Arrange for an expert to perform regular penetration tests.
- Deploy a tool that detects and alerts on things like firewall misconfigurations.
- Regularly test your backup and recovery methods, since if you also store 2FA codes and backup codes in there, you could be permanently locked out of your accounts.