I would only use it if the devs are highly reputable. It contains all your passwords and possibly all your wealth as well.
I'm not saying the dev isn't. I'm just saying that with this you really have to know what you do.
this post was submitted on 26 Apr 2024
20 points (100.0% liked)
Open Source
31277 readers
161 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
Na fork it and do your own security analysis
Good point. Makes me think that at some point in time no one was using KeePassXC (or KeePass or similar) or Bitwarden. Same for the first 2FA security keys. Who can you trust ? There will always be a trust decision to make or audit or have it audited or what not.
I agree. I'm glad this exists. But for certain threat models introducing extra supply chain attack vectors is unacceptable
Run Vaultwarden within your LAN and give this application no outgoing network access except to your local Vaultwarden ?
That's a reasonable thing to do. But your supply chain could still be compromised, using a different front end increases the entire risk surface. If nothing else there's less eyeballs looking at your front end. There could be IPC the front end uses to pass messages via other channels. It's a larger threat profile.
Okay. Would you recommend manually copy & paste and not use the Chrome or Firefox extension for Bitwarden ?
That's down to you and your threat model. Look at the downside of a breach, and look at the convenience of the browser integration. And make the choice for yourself.
For instance, if I was logging into a top secret military system, I would not use browser integration. That would be outside my threat model
Not to mention copy and paste on many systems is very insecure. On desktop computers any application can copy from that buffer without you being aware of it. On telephones are getting better about letting you know when an app copied the copy and paste buffer. But it's something you should model
If you decide to type the password in manually, what else is listening to your keystrokes? If you're running discord with a push to talk button. Discord usually gets to see everything that you type. Is discord part of your threat model?
I bring these scenarios up just to illustrate that being aware of your threat model trade-offs and risk tolerance is important.
Oh cool, I didn't realize that there were frontends for bitwarden. Does anybody use this, or similar ones? If so, what's your thoughts on them?
This OpenBSD developer is where I got the link from : https://bsd.network/@solene/112337523889864324 and there's Goldwarden, a desktop app for Bitwarden : https://flathub.org/apps/com.quexten.Goldwarden
What is it? I looked up rofi but that's even more confusing. Maybe a screenshot or two would help in the readme?
Rofi is a window switcher, run dialog and dmenu replacement. Screenshots : https://screenshots.debian.net/package/rofi
So that means that with a keyboard shortcut a menu will pop up where you can either start typing and it will do suggestions for you, or you click on what is already available. It's nice for people who prefer to not do too many mouse clicking (think : RSI).
That's neat but how is it related to bitwarden? That's where I'm stumped.
I've not looked much further into this software but it looks like it would use rbw, a command line tool for Bitwarden, to work with rofi.