Hacker News new | ask | show | jobs
by ThePinion 1639 days ago
After looking for self hosted password managers off and on for over a year I finally started hosting my own BitWarden instance (have had it for half a year or so now) and I absolutely love it. I can't believe I went so long without a password manager but it seemed against the point to have the passwords given to and hosted by someone else.

Highly recommended!
1 comments
Daedren 1639 days ago
Just don't forget your backups when selfhosting, especially offsite. And don't forget to test them regularly.
link
dspillett 1639 days ago
> especially offsite

And offline¹ or immutable². Some automated ransomware actively goes after common backups³ before touching the base data, more targetted attacks will too.

[1] If part of your threat model is security, not just accidental loss/damage, as it should be for everyone, this stops an attacker jumping from your base system to get at your backups.

[2] Alternatively, this will stop them modifying your backups even if they get access. Cloud providers offer what is claimed to be immutable storage, though your level of trust in them, your sensitivity to cost, and the likelihood you might someday want to properly forget something, will factor in to whether this is suitable.

[3] One reference amongst many: https://www.advintel.io/post/backup-removal-solutions-from-c...

> And don't forget to test them regularly.

A vital step that too many people skip. Or for advanced failure patterns: setting up automated tests that don't fail safe (does no alert mean all is OK, or does it mean the alert system has failed too?) and/or not monitoring to make sure that they are working.

link