"PSA: Update Vaultwarden as soon as possible"
See this post from another website for more context.
Important: Make a backup first, at least one user mentioned the update breaking their install
A new version (1.32.0) of Vaultwarden is out with security fixes:
This release has several CVE Reports fixed and we recommend everybody to update to the latest version as soon as possible.
CVE-2024-39924 Fixed via #4715
CVE-2024-39925 Fixed via #4837
CVE-2024-39926 Fixed via #4737
You are viewing a single comment
Explain how can you use KeePass+Syncthing with 10-50 people (possibly different groups for different passwords) having different sets of access level while maintaining sane ease of use?
The passwords are encrypted in the first place so the security for them is only on the client side.
I do not have to share passwords with 10-50 people and neither did the op imply this. I am having trouble figuring out the reasoning behind your message. Why would this be a normal use case?
I said my needs. I was just sharing. Hardly understanding your normal use case of 10-50 users on a same kdbx. The best you could do is having multiple kdbx, fro subgroups of users. Since not everyone should have the master password to all those kdbx... But I am sure that if those were my needs I'd jump to vaultwarden too. That's why I specifically added the disclaimer sentences on my post. I didn't mean to rob vaultwarden of its value. Just pointed out the tradeoff. Your comments adds on to those tradeoffs, they're just different solutions with different pros and cons. The user who mentioned using vaultwarden behind a VPN gave great input, I wasn't considering that. Anyway, have a nice day.
Totally agreed, but there are pros and cons.
File - harder to steal but once stolen hacker can bruteforce it as much as it wants. Web service - with proper rate limits (and additional IP whitelist so you can only sync on VPN/local network) - its harder to bruteforce. (But yes, you (sometimes) have also full copy locally in the local client, but ...)
If it was only for me I probably would also go with KeePass as you will not update the same db at the same time, but with with multiple users it's getting unmanageable.
I just got triggered as those CVEs are not that bad due to the nature that the app encrypts stuff on the client side so web server is more like shared file storage, while your answer suggested to switch to a solution that doesn't work for a lot of people (as we already tried that).
10-50 people normal use case?
For KeePass no, for VaultWarden yes.
Just got triggered for the comment above suggesting a solution that doesn't work for quite a lot of deployments/users, but yes, my comment was a little bit out of place as for single user deployments KeePass is probably way simpler/better.