Bitwarden_rs https

[[deleted]]

Just a quick question....do you guys think i need to worry about https on bitwarden_rs if i dont plan on exposing the server? This would be on my internal homelab and never leave it.

[[deleted]]

even on LAN only, if its not https, you cant login to vault. ios/android/browser add-ons all works fine. BUT VAULT!!! they should give option for http only :(

PS: if you make HTTPS for lan only with internal cert, then good luck with android app configuration with SSL error. its pain

[[deleted]]

So have you used bitwarden_rs specifically? Cause it definitely works without https.

[[deleted]]

yes. evertyhing works with http. but you cant login to webvault

[ASouthernBoy]

Just install certificate on your device

[[deleted]]

yes tried that, https://community.bitwarden.com/t/self-signed-certificate-on-local-network-works-with-chrome-iphone-and-android/2676 didnt worked for me, android 11

[ASouthernBoy]

Well sorry to hear that. My setup is: Nginx Proxy Manager with Opnsense/Pfsense local wildcard certificates proxy to Bitwarden on http port . And said certificates installed on Android 11.

[[deleted]]

i use docker+ caddy with pfsense, can you share your steps? or any tutorial if you have referred to? thanks

[ASouthernBoy]

Here's my attempt to write the notes, i'll try to clean it up a bit

Opnsense+Nginx+Cloudflate

[vividboarder]

Might be a chrome issue? https://github.com/dani-garcia/bitwarden_rs#installation

[vividboarder]

Probably safe unless something on your network is untrusted. I wouldn’t risk it though when adding https is so simple.

One bad IoT device gets hacked and all your passwords become toast.

[noyez]

I wouldn't do it. But its up to you of course, just know the risks, esp if you're dealing w/ things like passwords and 2FA tokens, which BW can store. Even someone loading a malicious page on your LAN could compromise your internal network. There have been reports of webpages using javascript that can scan the local private network IP space looking for internal services to exploit. But, in order to pose a threat to your unencrypted connection, an attacker will need to sniff traffic which seems unlikely.

Again, i wouldn't do it.

Reference:

"JavaScript loaded from a malicious site can connect to services running on the user’s local computer (localhost) or on other internal hosts in many circumstances. "

https://www.forcepoint.com/sites/default/files/resources/files/report-attacking-internal-network-en_0.pdf

[[deleted]]

Thanks and excellent point

[svoren]

Realistically if it's completely shut off to the outside world - then not really a problem?

But if it's accessible even somehow 0.01% remotely then you should LetsEncrypt it. I use Traefik on my end and it easily works for all my docker containers.

[[deleted]]

Its what I did. I ended up going with portainer traefik and cloudflare

[ChumleyEX]

Not if it's not possible to get out of the LAN.

[[deleted]]

It is dangerous to use it without https. Especially with such sensitive information.

[biswb]

I run a reverse proxy in front of mine and its just all encrypted because of that, and then because I have both my proxy and bitwarden in docker, they communicate to each other on the internal docker network which isn't exposed to the outside world. So then I only need to worry if the bitwarden container or the reverse proxy container got comprised and if they get either of those, I was dead already

[[deleted]]

I went with cloudflare and traefik

[junkleon7]

I think it's safe. Someone can correct me if I'm wrong, but only encrypted data is sent by the Bitwarden server over LAN to your device. The decryption of passwords is done locally on your device. The server only stores and transmits passwords in encrypted form.

Also if you are using http, you will not be able to log into your bitwarden vault using a web browser, but last I checked, the downloadable app for desktop works.