6 ms·

Bring Your Own Password Manager: Portable BitWarden on a Pi Zero

154 points by kickaha 4y ago

orangepurple 4y ago
So many commenters here are running air gapped solutions on a dedicated device. What's your backup story? How quickly can you add a new entry? It just seems like a HUGE hassle and risk of data loss compared to the classic KeepassXC + Syncthing burrito.
atemerev 4y ago
On one hand, this is incredibly cool, and brings some great security. On the other hand, docker containers on a RPi Zero? What a sad state of affairs we have in 2022.
- jeroenhd 4y ago
  I much prefer normal systemd services to sandbox my applications but if the software you want to run isn't packaged in some normal, updateable way (like a standard repository) then Docker is definitely the way to go.
- bheadmaster 4y ago
  Why? Sincere question - AFAIK, Raspberry PI OS is a Linux distribution like any other, with dependency/distribution issues like any other. Why would using Docker on it be a sad state of affairs, in contrast to using it on any other distribution?
  - vxNsr 4y ago
    Not the OP but maybe bec this is a single use device… why not just install direct on the OS and back the whole thing up?
    - osrec 4y ago
      In case you ever wish to change the operating conditions/environment/hardware in the future. Having a consistent operating environment is a big win, in my opinion.
      - jalk 4y ago
        Yes absolutely, but if the hardware requirements for running docker currently doesn't fit on a keychain (a physical one that is), perhaps its not the best choice today for secure password storage.
    - deberon 4y ago
      Docker has been a godsend for home labs. People don't need to know where on the filesystem their configs have been scattered (distro dependent). They just need to know how to docker pull and configure their container.
    - Dayshine 4y ago
      Is there a generally supported way to back up an entire Linux installation from the device itself while it's running? Is there a way to do it without backing up all the os packages? With docker I can stop the service, then snapshot its data volume, then restart it. And restoring is very easy. I have no idea how to get that workflow at an os level without a vm manager.
    - jeroenhd 4y ago
      One reason is that software isn't always distributed in normal distro repositories anymore. People can't (or don't want to) deal with dependency management so they ship an entire (slightly outdated version of an) OS with their application to make deployment foolproof. The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden. If you want to install native binaries, you're going to have to git fetch/checkout/pull the latest release tag and run `cargo build --features sqlite --release` yourself. Doable in a cronjob, but it'll probably take a compile to build a system like vaultwarden on a low-power ARM core.
      - atemerev 4y ago
        Yes, Docker is a black box. You don't know anything, you just launch something without understanding what components it consists of, what are they doing individually, what is their attack surface. Not to mention that it encourages sloppiness and software bloat. The password manager could be put on a simple MCU device, instead, we have a large non-transparent multi-component installation swept under the rug with Docker. I do not think this is a good thing.
        jeroenhd 4y ago
        The same can be said of any software that you don't review and compile yourself. Whether I run a Docker container or pull in 500 npm/pip/cargo/gems/composer dependencies, the attack service remains. With Docker these individual layers can be separated and inspected at the very least. Based on the name, I expected someone to take vaultwarden and make it an αcτµαlly pδrταblε εxεcµταblε that runs on its own without an OS; instead, this is just a quick tutorial for "how to set up vaultwarden".
        deleted 4y ago
        [deleted]
  - atemerev 4y ago
    Because a password manager is a tiny piece of software. Instead, it is now a multi-component black box installation with a general purpose operating system running on a full-scale Linux machine with a containerization platform designed for datacenters. I am not a fan of this kind of redundancy and opaqueness.
    - hk1337 4y ago
      BitWarden isn't all that tiny. I am pretty sure the main reasons for the docker container is that is built with dotnetcore and uses sql server for its database. BitWarden is complicated to install for self-hosting as opposed to using it on PiZero. That said, I am skeptical of running it on a PiZero. I could see running it on a Pi3 or Pi4 where I can leave it connected to my network and cron backups to a NAS. The BitWarden documentation itself shows 12 containers running. https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/
    - bheadmaster 4y ago
      When you put it that way, I agree - a password manager should really be implementable as a single statically linked binary. There seem to be some other Docker features used, like healthcheck [0], and MariaDB seems to be installed, too, so it might be worth considering how much additional OS-dependent complexity would the equivalent functionality without using Docker require. At the very least, you need some kind of service manager to run your program on boot, and restart it on error. At that point, Docker may as well be used as a glorified service manager - just slap your static binary in a `FROM scratch` container, and you're done. > I am not a fan of this kind of redundancy and opaqueness. Me neither. But I wouldn't blame Docker itself - it's just a tool. If it wasn't for Docker, some other way of circumventing good engineering would be found :-) [0] https://github.com/dani-garcia/vaultwarden/blob/main/docker/arm64/Dockerfile#L147 https://github.com/dani-garcia/vaultwarden/blob/main/docker/...
    - jorvi 4y ago
      Reminds me of someone writing a little status light app (in the macOS menu bar / windows tray) and choosing Electron for that. Something ridiculous like 200MB+ install size and 150MB memory use.
- deleted 4y ago
  [deleted]
bm3719 4y ago
This is an interesting tech stack, but seems heavy-handed for managing such a small amount of raw data (the l/p list itself). My solution for the past 14 years has been a simple GPG-encrypted org-mode (text) file. I can get to a password multiple ways from any device. The main way I check one is to open the file in Emacs which prompts for the master password via pinentry. You could also use a keyfile. Usually I just ssh and connect to a tmux session with emacs -nw already running, but I can also decrypt and grep it from the CLI, or clone the private repo its on to do the same locally. I only do anything involving PII or money in a dedicated PureOS VM though, so I generally don't jump through any hoops and it's relatively transparent.
- nordsieck 4y ago
  > My solution for the past 14 years has been a simple GPG-encrypted org-mode (text) file. Have you ever taken a look at pass?
  - zikduruqe 4y ago
    Pass synced to a bare git repo at home... via WireGuard of course. Same dev. Also look at Passage which uses Age encryption.
rpgbr 4y ago
Holy cow, that seems complex! What are the advantages of this setup over carrying a pendrive with am encrypted KeePassXC vault in it?
xd1936 4y ago
Keeping all of my passwords on a failure-prone SD card acting as a boot drive makes me nervous. I think I'd prefer a SyncThing-based solution for self-hosting a Bitwarden Vault or KeePass file... if I wasn't already a happy customer of Bitwarden's hosting solution.
- _cenw 4y ago
  You can chainload EDK2 builds for the Pi 3 and up (putting them on the SD card) and then boot into generic UEFI capable ARM linux on USB mass storage.
resoluteteeth 4y ago
Using something like an RPI Zero and carrying this around would make more sense if the device had a display and could be airgrapped.
- criddell 4y ago
  I’m not sure a RPI makes sense at all for stuff like this. They are so heavyweight compared to a little microcontroller board.
- jrexilius 4y ago
  That was our approach. Build it into the keyboard, do all the various secrets management (passwords, TOTP, et al) and message encryption behind a data diode (sorta air gapped). And RPi isn't the ideal compute module for it as you don't want a wireless chip on the inside of the "airgap". https://www.anomie.tech/ https://www.anomie.tech/
Bluecobra 4y ago
Seems pretty complicated to me. There’s lots of steps involved which increases the chance of something going wrong. For example, the self signed cert will eventually expire, how easy would it be to renew it? How do I keep this up to date? It would just be a heck of a lot easier to just use KeePass and save the database on a SD card.
cstuder 4y ago
I have a general question regarding the BitWarden server: How would you rate the security between using the official BitWarden server and self-hosting Vaultwarden? I am sympathetic (and capable) of self-hosting, but if my instance and my passwords are compromised, the fallout could be catastrophic for me. Am I better of in the long term by just using the BitWarden server and assuming that they have better security than I do, even though they are the even jucier target?
- the_svd_doctor 4y ago
  I think the idea is that if you use the official client, there is “no risk” because everything is encrypted client side anyway. In theory.
evernite 4y ago
Yeah, it seems to me that if you use a standalone Pi for your self hosted password manager, then why not just run everything as systemd services. I did something similar on a Pi 3 for the CCC congress event last year using NixOS and it's been running ever since.
dusted 4y ago
There's still enough lack of good password-manager infrastructure that I'll venture to say that FinalKey is still relevant, even in the face of Ubikey and Fido.
slowhand09 4y ago
That's such a tease. I check RPI-locator daily. Buying a Pi anything in the US is hard now.
- 16mb 4y ago
  I ended up getting some ROCK64 boards instead. They’re a great price One downside is the PoE hats are massive https://pine64.com/product/rock64-4gb-single-board-computer/ https://pine64.com/product/rock64-4gb-single-board-computer/
  - 3np 4y ago
    Just get 5V 3A PoE China splitters from Aliexpress.
  - green-salt 4y ago
    I got the waveshare ones for the pi 4 and they're really compact. Not sure if they would work with the rock64 though
- misnome 4y ago
  I had some luck in the UK where rpi-locator only showed the main SKU, but the sellers had “kit” stock available with a case and charger for like £10 more, on a separate page.
ctoth 4y ago
Does Bitwarden's setup process still involve entering your master key in the browser? This always felt very sketchy to me, for some reason.
- hatware 4y ago
  As long as the master key stays local and is hashed/salted before being sent to BW, you have nothing to worry about. You can verify this yourself.
bee_rider 4y ago
The general idea is neat. I wonder why they didn't emulate a keyboard instead...
Barrin92 4y ago
honestly to me this falls into the category of LARP security. the entire point of encryption is to move sensitive data across adversarial channels. Meaning, if you trust Bitwarden enough to use it at all there's no benefit to not just using their servers (you keep a local copy of your data anyway). If you want to keep your data secure by keeping them on you, just use a notebook. Cheaper than this and works without a power chord.
- Karunamon 4y ago
  It not so much that I do not trust the company today, it is that I do not trust them to not silently become adversarial in the future when the government comes knocking or if they get bought out, or whatever. This is a bit of attack surface that all hosted cloud solutions share, and it is one that it has never been easier to eliminate.
  - Barrin92 4y ago
    all of these password managers (including bitwarden) encrypt your data end-to-end and nothing ever leaves your client in a plain state so regardless of who has the backend your data is never touchable. You always only ever need to trust the client, which you do here as well.
    - Karunamon 4y ago
      The client is made by the same people at the end of the day, so that is of little comfort. Also, adversarial does not refer to just possibly breaking encryption, it also applies to daily continuity. I trust my ability to keep a small encrypted password database safe more than I trust some random companies to get bought or change their business model and suddenly I have to decide between a massive Flag Day or paying for something I did not have to before or having some kind of other unwelcome limitation placed on me. I like controlling my own destiny, thank you very much.
syntaxing 4y ago
An alternative to this is to expose this to your local network and use tailscale to connect to it so you do not have to carry it around while being secure.
- iso1631 4y ago
  My understanding of tailscale is you give full access to the tailscale company to allow any public key to access any of your machines. I think I'll stick with running my own wireguard thanks.
  - vermon 4y ago
    Or you can run Headscale: https://github.com/juanfont/headscale https://github.com/juanfont/headscale
- mbreese 4y ago
  That similar to what I was thinking too… instead of carrying around a device, why not have a server that is physically secured somewhere and connect with Wireguard? It could be at home or on a cloud, if you trust that. Tailscale and wireguard are available for all major devices, including mobile. So, if you do this, your password manager can live anywhere and doesn’t need to be exposed to the main internet at all. You don’t even need SSH/network access to the remote machine, just HTTPS over Wireguard (and local or console access). Everything else can be locked down tight.
alexk307 4y ago
This is cool, but you can just leave it at home plugged into your router. DDNS + Nginx + Let's Encrypt might be easier to set up, and definitely easier to use.
gigel82 4y ago
Seems unnecessarily complicated. I self-host Vaultwarden at home (and expose it to the internet via WireGuard), nice and seamless.
qwerpy 4y ago
I've seen so many interesting password manager solutions over the years, but I have yet to move away from a Keepass file hosted on cloud storage. I can read and write to it using apps from every device I use: windows and linux PCs, iOS and Android devices. The file is versioned so accidentally clobbering it isn't a concern. There is zero maintenance, and if my home server goes down my passwords are unaffected. If I'm going somewhere without internet and need a backup mechanism of getting to my passwords, I can copy the database onto a memory stick.
- zmxz 4y ago
  What happens when there's more than you who uses the Keepass file and how do you store new passwords to the file when you create new accounts on the web (for various services)? What's the usage flow? Is there browser extension that allows you to interact with it without opening Keepass program? Maintenance you described is easy, but what about the actual usage and sharing passwords?
  - Semaphor 4y ago
    Not OP. Sharing is not a thing, but I never had the need to share passwords. Storing new accounts syncs just like everything else.
  - pmontra 4y ago
    Not OP. I add only from my laptop, I share with Syncthing to my other devices. Nobody else use my passwords. If a customer has a per team password they either never change it or in the very rare cases they do, they tell me the new password when I ask why the old one doesn't work anymore. They don't let me in their shared password manager anyway (only one customer has one.)
  - antisthenes 4y ago
    What's the use case for sharing passwords? I've never had the need to share one in 20+ years of being a power user. If I end up dead, my master password will be shared in my will with appropriate parties. > Is there browser extension that allows you to interact with it without opening Keepass program? I sure hope not.
synergy20 4y ago
What about using the $4 rp2040 to make an open source yubikey instead?
- joshka 4y ago
  You'd want some sort of TPM for that to be viable.
  - synergy20 4y ago
    forgot that key piece indeed, thanks! not sure if there is an external approach(with a separate chip) to add TPM-alike functions though.
Vexs 4y ago
Something that's been on my mind for some time is the seeming inevitability of getting RCE'd by some innocuous application- web browser, chat app, videogame, whatever. These vluns keep popping up and eventually one might hit me. And if it does, it might come with something targeting keepass and _if_ it does I'm Fucked with an upper case F. Building a portable terminal that can emulate a keyboard with a reasonable screen for ease of use seems like a fairly reasonable solution.
grepLeigh 4y ago
Great write-up, thanks for sharing this! One thing I would add: a self-signed certificate is not adequate for password transmission. In some ways, it's even worse than transmitting over clear-text http because it provides an illusion of security. Any actor on your network can man-in-the-middle, provide their own certificate, and you'd be none the wiser. I'd suggest provisioning LetsEncrypt leaf-node certificate on a node that can respond to HTTP-01 or DNS-01 challenges (don't open your home network to :80 :443 - use a VM in the Cloud to respond to challenges), then transfer the certificate to the Raspberry Pi. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/
- GekkePrutser 4y ago
  IMO Letsencrypt is way too difficult to bother with for such scenarios: devices that are not open to the internet. The hassle of forwarding the ports for their verification and having to do it so regularly (3 months) is a real pita. I used to just pay for yearly certs for this reason but prices have gone up so now I'm back to using self signed. I'd love to set up my own PKI but the tool chain is so complex and many OSes like Android allow apps to opt out of user -added root certificates which makes it very hard to deal with.
  - snapplebobapple 4y ago
    you could use the dns authentication, just set the ip to the local one this box for the domain you own/will be always use then all you have to be able to do is hit external dns and letsencrypt to update the cert.
    - deleted 4y ago
      [deleted]
    - GekkePrutser 4y ago
      Ah but I use a personal TLD which does not really exist in the real internet. Can I still use letsencrypt with that?
allanrbo 4y ago
Cool idea with the ethernet gadget. If I understood it right, the RPI acts as a virtual ethernet adapter over USB.
guenthert 4y ago
Now I won't lament the overkill in hardware (512MiB RAM for a password manager?), but the lack of protected memory (Smart Card or otherwise) makes this approach imho quite questionable. Lose the device, lose all your passwords?
password4321 4y ago
If you have an old Android phone you might be interested in https://github.com/tejado/Authorizer https://github.com/tejado/Authorizer > Authorizer is a Password Manager for Android. It emulates an HID keyboard over USB and enters your credentials on your target device. Additionally it supports OTP
sorcix 4y ago
This article is using Vaultwarden, not the Bitwarden server. It's wrongly referring to Vaultwarden as "BYOPM hosts a Bitwarden instance" and "the Docker Image of Bitwarden." It is not, it is hosting a Vaultwarden instance. This is an issue as people using Vaultwarden report bugs to the Bitwarden project, where they can't be helped.
- patmorgan23 4y ago
  Yep, it's a bitwarden compatible vault but is not bitwarden

154 points by kickaha 4y ago

So many commenters here are running air gapped solutions on a dedicated device. What's your backup story? How quickly can you add a new entry? It just seems like a HUGE hassle and risk of data loss compared to the classic KeepassXC + Syncthing burrito.

atemerev 4y ago

On one hand, this is incredibly cool, and brings some great security. On the other hand, docker containers on a RPi Zero? What a sad state of affairs we have in 2022.

jeroenhd 4y ago
I much prefer normal systemd services to sandbox my applications but if the software you want to run isn't packaged in some normal, updateable way (like a standard repository) then Docker is definitely the way to go.
bheadmaster 4y ago
Why? Sincere question - AFAIK, Raspberry PI OS is a Linux distribution like any other, with dependency/distribution issues like any other. Why would using Docker on it be a sad state of affairs, in contrast to using it on any other distribution?
- vxNsr 4y ago
  Not the OP but maybe bec this is a single use device… why not just install direct on the OS and back the whole thing up?
  - osrec 4y ago
    In case you ever wish to change the operating conditions/environment/hardware in the future. Having a consistent operating environment is a big win, in my opinion.
    - jalk 4y ago
      Yes absolutely, but if the hardware requirements for running docker currently doesn't fit on a keychain (a physical one that is), perhaps its not the best choice today for secure password storage.
  - deberon 4y ago
    Docker has been a godsend for home labs. People don't need to know where on the filesystem their configs have been scattered (distro dependent). They just need to know how to docker pull and configure their container.
  - Dayshine 4y ago
    Is there a generally supported way to back up an entire Linux installation from the device itself while it's running? Is there a way to do it without backing up all the os packages? With docker I can stop the service, then snapshot its data volume, then restart it. And restoring is very easy. I have no idea how to get that workflow at an os level without a vm manager.
  - jeroenhd 4y ago
    One reason is that software isn't always distributed in normal distro repositories anymore. People can't (or don't want to) deal with dependency management so they ship an entire (slightly outdated version of an) OS with their application to make deployment foolproof. The vaultwarden install instructions assume Docker, for example: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden. If you want to install native binaries, you're going to have to git fetch/checkout/pull the latest release tag and run `cargo build --features sqlite --release` yourself. Doable in a cronjob, but it'll probably take a compile to build a system like vaultwarden on a low-power ARM core.
    - atemerev 4y ago
      Yes, Docker is a black box. You don't know anything, you just launch something without understanding what components it consists of, what are they doing individually, what is their attack surface. Not to mention that it encourages sloppiness and software bloat. The password manager could be put on a simple MCU device, instead, we have a large non-transparent multi-component installation swept under the rug with Docker. I do not think this is a good thing.
      - jeroenhd 4y ago
        The same can be said of any software that you don't review and compile yourself. Whether I run a Docker container or pull in 500 npm/pip/cargo/gems/composer dependencies, the attack service remains. With Docker these individual layers can be separated and inspected at the very least. Based on the name, I expected someone to take vaultwarden and make it an αcτµαlly pδrταblε εxεcµταblε that runs on its own without an OS; instead, this is just a quick tutorial for "how to set up vaultwarden".
        deleted 4y ago
        [deleted]
- atemerev 4y ago
  Because a password manager is a tiny piece of software. Instead, it is now a multi-component black box installation with a general purpose operating system running on a full-scale Linux machine with a containerization platform designed for datacenters. I am not a fan of this kind of redundancy and opaqueness.
  - hk1337 4y ago
    BitWarden isn't all that tiny. I am pretty sure the main reasons for the docker container is that is built with dotnetcore and uses sql server for its database. BitWarden is complicated to install for self-hosting as opposed to using it on PiZero. That said, I am skeptical of running it on a PiZero. I could see running it on a Pi3 or Pi4 where I can leave it connected to my network and cron backups to a NAS. The BitWarden documentation itself shows 12 containers running. https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/
  - bheadmaster 4y ago
    When you put it that way, I agree - a password manager should really be implementable as a single statically linked binary. There seem to be some other Docker features used, like healthcheck [0], and MariaDB seems to be installed, too, so it might be worth considering how much additional OS-dependent complexity would the equivalent functionality without using Docker require. At the very least, you need some kind of service manager to run your program on boot, and restart it on error. At that point, Docker may as well be used as a glorified service manager - just slap your static binary in a `FROM scratch` container, and you're done. > I am not a fan of this kind of redundancy and opaqueness. Me neither. But I wouldn't blame Docker itself - it's just a tool. If it wasn't for Docker, some other way of circumventing good engineering would be found :-) [0] https://github.com/dani-garcia/vaultwarden/blob/main/docker/arm64/Dockerfile#L147 https://github.com/dani-garcia/vaultwarden/blob/main/docker/...
  - jorvi 4y ago
    Reminds me of someone writing a little status light app (in the macOS menu bar / windows tray) and choosing Electron for that. Something ridiculous like 200MB+ install size and 150MB memory use.
deleted 4y ago
[deleted]

bm3719 4y ago

This is an interesting tech stack, but seems heavy-handed for managing such a small amount of raw data (the l/p list itself). My solution for the past 14 years has been a simple GPG-encrypted org-mode (text) file. I can get to a password multiple ways from any device. The main way I check one is to open the file in Emacs which prompts for the master password via pinentry. You could also use a keyfile. Usually I just ssh and connect to a tmux session with emacs -nw already running, but I can also decrypt and grep it from the CLI, or clone the private repo its on to do the same locally. I only do anything involving PII or money in a dedicated PureOS VM though, so I generally don't jump through any hoops and it's relatively transparent.

nordsieck 4y ago
> My solution for the past 14 years has been a simple GPG-encrypted org-mode (text) file. Have you ever taken a look at pass?
- zikduruqe 4y ago
  Pass synced to a bare git repo at home... via WireGuard of course. Same dev. Also look at Passage which uses Age encryption.

rpgbr 4y ago

Holy cow, that seems complex! What are the advantages of this setup over carrying a pendrive with am encrypted KeePassXC vault in it?

xd1936 4y ago

Keeping all of my passwords on a failure-prone SD card acting as a boot drive makes me nervous. I think I'd prefer a SyncThing-based solution for self-hosting a Bitwarden Vault or KeePass file... if I wasn't already a happy customer of Bitwarden's hosting solution.

_cenw 4y ago
You can chainload EDK2 builds for the Pi 3 and up (putting them on the SD card) and then boot into generic UEFI capable ARM linux on USB mass storage.

resoluteteeth 4y ago

Using something like an RPI Zero and carrying this around would make more sense if the device had a display and could be airgrapped.

criddell 4y ago
I’m not sure a RPI makes sense at all for stuff like this. They are so heavyweight compared to a little microcontroller board.
jrexilius 4y ago
That was our approach. Build it into the keyboard, do all the various secrets management (passwords, TOTP, et al) and message encryption behind a data diode (sorta air gapped). And RPi isn't the ideal compute module for it as you don't want a wireless chip on the inside of the "airgap". https://www.anomie.tech/ https://www.anomie.tech/

Bluecobra 4y ago

Seems pretty complicated to me. There’s lots of steps involved which increases the chance of something going wrong. For example, the self signed cert will eventually expire, how easy would it be to renew it? How do I keep this up to date? It would just be a heck of a lot easier to just use KeePass and save the database on a SD card.

cstuder 4y ago

I have a general question regarding the BitWarden server: How would you rate the security between using the official BitWarden server and self-hosting Vaultwarden? I am sympathetic (and capable) of self-hosting, but if my instance and my passwords are compromised, the fallout could be catastrophic for me. Am I better of in the long term by just using the BitWarden server and assuming that they have better security than I do, even though they are the even jucier target?

the_svd_doctor 4y ago
I think the idea is that if you use the official client, there is “no risk” because everything is encrypted client side anyway. In theory.

evernite 4y ago

Yeah, it seems to me that if you use a standalone Pi for your self hosted password manager, then why not just run everything as systemd services. I did something similar on a Pi 3 for the CCC congress event last year using NixOS and it's been running ever since.

dusted 4y ago

There's still enough lack of good password-manager infrastructure that I'll venture to say that FinalKey is still relevant, even in the face of Ubikey and Fido.

slowhand09 4y ago

That's such a tease. I check RPI-locator daily. Buying a Pi anything in the US is hard now.

16mb 4y ago
I ended up getting some ROCK64 boards instead. They’re a great price One downside is the PoE hats are massive https://pine64.com/product/rock64-4gb-single-board-computer/ https://pine64.com/product/rock64-4gb-single-board-computer/
- 3np 4y ago
  Just get 5V 3A PoE China splitters from Aliexpress.
- green-salt 4y ago
  I got the waveshare ones for the pi 4 and they're really compact. Not sure if they would work with the rock64 though
misnome 4y ago
I had some luck in the UK where rpi-locator only showed the main SKU, but the sellers had “kit” stock available with a case and charger for like £10 more, on a separate page.

ctoth 4y ago

Does Bitwarden's setup process still involve entering your master key in the browser? This always felt very sketchy to me, for some reason.

hatware 4y ago
As long as the master key stays local and is hashed/salted before being sent to BW, you have nothing to worry about. You can verify this yourself.

bee_rider 4y ago

The general idea is neat. I wonder why they didn't emulate a keyboard instead...

Barrin92 4y ago

honestly to me this falls into the category of LARP security. the entire point of encryption is to move sensitive data across adversarial channels. Meaning, if you trust Bitwarden enough to use it at all there's no benefit to not just using their servers (you keep a local copy of your data anyway). If you want to keep your data secure by keeping them on you, just use a notebook. Cheaper than this and works without a power chord.

Karunamon 4y ago
It not so much that I do not trust the company today, it is that I do not trust them to not silently become adversarial in the future when the government comes knocking or if they get bought out, or whatever. This is a bit of attack surface that all hosted cloud solutions share, and it is one that it has never been easier to eliminate.
- Barrin92 4y ago
  all of these password managers (including bitwarden) encrypt your data end-to-end and nothing ever leaves your client in a plain state so regardless of who has the backend your data is never touchable. You always only ever need to trust the client, which you do here as well.
  - Karunamon 4y ago
    The client is made by the same people at the end of the day, so that is of little comfort. Also, adversarial does not refer to just possibly breaking encryption, it also applies to daily continuity. I trust my ability to keep a small encrypted password database safe more than I trust some random companies to get bought or change their business model and suddenly I have to decide between a massive Flag Day or paying for something I did not have to before or having some kind of other unwelcome limitation placed on me. I like controlling my own destiny, thank you very much.

syntaxing 4y ago

An alternative to this is to expose this to your local network and use tailscale to connect to it so you do not have to carry it around while being secure.

iso1631 4y ago
My understanding of tailscale is you give full access to the tailscale company to allow any public key to access any of your machines. I think I'll stick with running my own wireguard thanks.
- vermon 4y ago
  Or you can run Headscale: https://github.com/juanfont/headscale https://github.com/juanfont/headscale
mbreese 4y ago
That similar to what I was thinking too… instead of carrying around a device, why not have a server that is physically secured somewhere and connect with Wireguard? It could be at home or on a cloud, if you trust that. Tailscale and wireguard are available for all major devices, including mobile. So, if you do this, your password manager can live anywhere and doesn’t need to be exposed to the main internet at all. You don’t even need SSH/network access to the remote machine, just HTTPS over Wireguard (and local or console access). Everything else can be locked down tight.

alexk307 4y ago

This is cool, but you can just leave it at home plugged into your router. DDNS + Nginx + Let's Encrypt might be easier to set up, and definitely easier to use.

gigel82 4y ago

Seems unnecessarily complicated. I self-host Vaultwarden at home (and expose it to the internet via WireGuard), nice and seamless.

qwerpy 4y ago

I've seen so many interesting password manager solutions over the years, but I have yet to move away from a Keepass file hosted on cloud storage. I can read and write to it using apps from every device I use: windows and linux PCs, iOS and Android devices. The file is versioned so accidentally clobbering it isn't a concern. There is zero maintenance, and if my home server goes down my passwords are unaffected. If I'm going somewhere without internet and need a backup mechanism of getting to my passwords, I can copy the database onto a memory stick.

zmxz 4y ago
What happens when there's more than you who uses the Keepass file and how do you store new passwords to the file when you create new accounts on the web (for various services)? What's the usage flow? Is there browser extension that allows you to interact with it without opening Keepass program? Maintenance you described is easy, but what about the actual usage and sharing passwords?
- Semaphor 4y ago
  Not OP. Sharing is not a thing, but I never had the need to share passwords. Storing new accounts syncs just like everything else.
- pmontra 4y ago
  Not OP. I add only from my laptop, I share with Syncthing to my other devices. Nobody else use my passwords. If a customer has a per team password they either never change it or in the very rare cases they do, they tell me the new password when I ask why the old one doesn't work anymore. They don't let me in their shared password manager anyway (only one customer has one.)
- antisthenes 4y ago
  What's the use case for sharing passwords? I've never had the need to share one in 20+ years of being a power user. If I end up dead, my master password will be shared in my will with appropriate parties. > Is there browser extension that allows you to interact with it without opening Keepass program? I sure hope not.

synergy20 4y ago

What about using the $4 rp2040 to make an open source yubikey instead?

joshka 4y ago
You'd want some sort of TPM for that to be viable.
- synergy20 4y ago
  forgot that key piece indeed, thanks! not sure if there is an external approach(with a separate chip) to add TPM-alike functions though.

Vexs 4y ago

Something that's been on my mind for some time is the seeming inevitability of getting RCE'd by some innocuous application- web browser, chat app, videogame, whatever. These vluns keep popping up and eventually one might hit me. And if it does, it might come with something targeting keepass and _if_ it does I'm Fucked with an upper case F. Building a portable terminal that can emulate a keyboard with a reasonable screen for ease of use seems like a fairly reasonable solution.

grepLeigh 4y ago

Great write-up, thanks for sharing this! One thing I would add: a self-signed certificate is not adequate for password transmission. In some ways, it's even worse than transmitting over clear-text http because it provides an illusion of security. Any actor on your network can man-in-the-middle, provide their own certificate, and you'd be none the wiser. I'd suggest provisioning LetsEncrypt leaf-node certificate on a node that can respond to HTTP-01 or DNS-01 challenges (don't open your home network to :80 :443 - use a VM in the Cloud to respond to challenges), then transfer the certificate to the Raspberry Pi. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/

GekkePrutser 4y ago
IMO Letsencrypt is way too difficult to bother with for such scenarios: devices that are not open to the internet. The hassle of forwarding the ports for their verification and having to do it so regularly (3 months) is a real pita. I used to just pay for yearly certs for this reason but prices have gone up so now I'm back to using self signed. I'd love to set up my own PKI but the tool chain is so complex and many OSes like Android allow apps to opt out of user -added root certificates which makes it very hard to deal with.
- snapplebobapple 4y ago
  you could use the dns authentication, just set the ip to the local one this box for the domain you own/will be always use then all you have to be able to do is hit external dns and letsencrypt to update the cert.
  - deleted 4y ago
    [deleted]
  - GekkePrutser 4y ago
    Ah but I use a personal TLD which does not really exist in the real internet. Can I still use letsencrypt with that?

allanrbo 4y ago

Cool idea with the ethernet gadget. If I understood it right, the RPI acts as a virtual ethernet adapter over USB.

guenthert 4y ago

Now I won't lament the overkill in hardware (512MiB RAM for a password manager?), but the lack of protected memory (Smart Card or otherwise) makes this approach imho quite questionable. Lose the device, lose all your passwords?

password4321 4y ago

If you have an old Android phone you might be interested in https://github.com/tejado/Authorizer https://github.com/tejado/Authorizer > Authorizer is a Password Manager for Android. It emulates an HID keyboard over USB and enters your credentials on your target device. Additionally it supports OTP

sorcix 4y ago

This article is using Vaultwarden, not the Bitwarden server. It's wrongly referring to Vaultwarden as "BYOPM hosts a Bitwarden instance" and "the Docker Image of Bitwarden." It is not, it is hosting a Vaultwarden instance. This is an issue as people using Vaultwarden report bugs to the Bitwarden project, where they can't be helped.

patmorgan23 4y ago
Yep, it's a bitwarden compatible vault but is not bitwarden