If you are interested in privacy you are probably interested in password storage … plus I wanted everyone to know about the inevitable future enshitification of this product. Spread the word and replacement recommendations are welcome too.
If you are interested in privacy you are probably interested in password storage … plus I wanted everyone to know about the inevitable future enshitification of this product. Spread the word and replacement recommendations are welcome too.
Compromising Vaultwarden provides an opportunity to inject malicious JavaScript and steal the database password when it’s opened. NextCloud can never leak any info about how I open my password database.
Any password manager could be comprimised. A bug could even be installed on your system or malware. What’s the difference?
NextCloud doesn’t know how you open the password db, but KeePass (for example) does, so the master pass comprimise would be with that.
Specifically the syncing part being done with any tool, doesn’t matter.
Who or how are you thinking Vaulwarden is being comprimised?
Sure, any manager could be compromised, but no client that handles my password database in any way connects to the internet, and all of them come from either signed Linux packages or signed Android apps. If Vaultwarden has a security vulnerability, you can steal the key and the database. If NextCloud is compromised, you can steal the database but not the key. To compromise the password manager client would require either stealing the publishing keys or getting the original author to publish a malicious version.
I see your point, but if your server can only be accessed through a VPN, I think the risk is mitigated. Maybe I’m being naive.
Yeah, that would largely mitigate the risk, but this whole discussion started because I personally didn’t want to do that.