I’m worried about LastPass’ incident, but I’m equally worried about password managers of renown at all that have not recently disclosed any (data or code base) cybersecurity incidents. Any password manager is a huge, juicy target…
This is why the option to be able to self-host your own password manager is a great thing, provided that you properly secure it. If you have the technical skills, one can deploy their own Bitwarden instance and put it behind your own VPN so that the password manager is not accessible via the public Internet. You still get the convenience and features of a cloud password manager but without the risk of it being on the public Internet.
That or you could always just use an offline password manager like KeePass if you're absolutely paranoid about your passwords but you do lose the niceties of easily syncing multiple devices.
@deltatux @hacks4pancakes I'm someone who probably has the basic skills to self-host (I have for other things), but I'm still really skeptical that it would be a good idea for people like me who are not professionals.
Being able to set something up is not the same as being able to secure it properly, keep it secure, and maintain availability. And my experience is that many people overestimate their knowledge and abilities in infosec (Dunning-Kruger).
For example, I know for myself that I'm unlikely to keep close tabs that my backup really restores, or know how to setup good intrusion detection, or stay aware of the latest 0-day exploits. For something critical like a password vault, it may be better left to people with more expertise who have this as their primary focus.
That's perfectly valid, if you know that you're more comfortable having others manage your password vault, do that. You wouldn't want to risk your security just because you want to "self-host all the things".
When I initially wrote the reply, I didn't expect people to misinterpret that I'm pushing everyone to self-host, I'm not. All I was trying to say is that good thing the option to self-host exists for those who don't want to deal with cloud providers. It alleviates their concerns that others may not be handling their passwords safely, provides them the ability to control the process end to end. However, this isn't for everyone.
For the average person, they're better off just using off-the-shelf solutions. For instance, the built in password managers that Apple & Google have baked into their browsers & OS is a great option for the everyday consumer.
@deltatux @hacks4pancakes @keily_sdivx I agree that the ability to self host is good, and I didn't necessarily take you to be saying that everyone should.
It's just that often the focus in these discussions is on whether people have the skill to setup self hosting, and I guess my point is that securing and maintaining it is another thing entirely and, moreover, that *thinking* one can do the latter is not necessarily the same as actually being able to.
A trap we often fall into is feeling safer when we're in control, even if objectively it puts us at more risk. Added on top of that, I've met a lot of people who think they understand infosec but, in fact, only have an even shallower understanding than my own (as a non-expert).
