If you are interested in privacy you are probably interested in password storage … plus I wanted everyone to know about the inevitable future enshitification of this product. Spread the word and replacement recommendations are welcome too.
If you are interested in privacy you are probably interested in password storage … plus I wanted everyone to know about the inevitable future enshitification of this product. Spread the word and replacement recommendations are welcome too.
Some environments restrict USB access for security reasons. Some environments don’t have extra ports to spare. Sometimes, I just don’t have the right cable on hand even if the environment is otherwise fine.
No, I’m well aware of that. I mean that when the inevitable scans come, the Vaultwarden instance will freely identify itself as such. An attacker would automate the breach if they detected my NextCloud instance and had an exploit ready, but then what? The contents are too unpredictable to have a one size fits all approach from there. Even if they scan all the servers they breach for password databases, they have to contend with the fact that they still have no means to try to intercept the password. They may have a slightly easier time obtaining the database, but cracking a huge pile of password databases is an infeasible task.
Yes, if I did it the way you want, I could avoid exposing it and allowing it to advertise itself, but then I would be unable to access it without a VPN or other networking tool.
I never said that Vaultwarden had been hacked. I said essentially that Vaultwarden is a single point of failure that I do not want to risk exposing to the wider internet, and I don’t want to hide the services behind a VPN because that can complicate access. It’s a little less secure, but what’s the point of security if I can’t actually use it myself?
Of the overall system, yes. Of the password database itself, not really. Slightly less potential security through lack of access, but with a sufficiently secure password, cracking it isn’t realistic. That becomes exponentially more true if you’ve got a huge pile of password databases you need to crack, as would most likely be the case for anyone who breached my server.
Yes, and you’re just about get to the problem I have with the client if you’d finish my sentence before you got smug with me.
And it’s great that for your personal use case, that works our for you. But before you decide to act like a smug asshole, maybe consider that not every situation can resolve as cleanly as yours. There are a lot of reasons that restricting access to a VPN can at times be limiting. Sure, at home on your own hardware, not really, but some people need the same tools for different purposes in different environments.
Just think beyond your own experiences and accept that other people have different needs than you for a variety of reasons that they can’t always control.
Where are you even trying to use your password manager??? You’re absolutely batshit dude. I’m not reading this wall of text.
Corporate environments don’t like you tampering with how their networks are set up. You might be able to get your hands on a portable copy of your password manager or even get installation authorized, but you might not be able to force a hotspot VPN onto the machine, and you’ll have a WAY harder time getting a VPN cleared than you will getting a password manager to work.
You should also not be ysing a corporate laptop for your private stuff. If you do need to use it, you can do use the password manager the old way, just read from your phone and manually type it in.
Lastly, since you’re proposing a corporate scenario, you wouldn’t be able to install a random program on your laptop. IT would either block the installation or you’d have to explain why you’re installing random programs on your work computer.
This is getting pathetic dude, just move on.
Yeah, but some stuff kinda blurs the line, and some stuff is just useful both places. It’s not ideal, but I can maintain some separation with different NextCloud users and different database files.
Portable versions of password managers work sometimes. There are browser extensions you might be able to use. Most notably, both of these are more likely to be authorized than a VPN tunnel into my personal machines if I even need authorization for them. In some places and jobs, you might get a little influence over what gets installed, within reason, and an open source, strictly offline password manager is less of a threat than a VPN connection to an uncontrolled endpoint. I might be able to get a Vaultwarden client, but then I’m back to exposing Vaultwarden to the open internet, which was what I didn’t want to do.