Bitwarden login down due to Azure outage

https://status.bitwarden.com/

by yakz • 3 years ago

116 123 3 years ago

status.bitwarden.com

bombcar• 3 years ago

If you are using Tor, try changing your exit node.

Bitwarden doesn't run an onion service? Anyone who acknowledges Tor and wants to support users there and doesn't have an onion is missing out.

hijinks• 3 years ago

just run your own and use vaultwarden so your passwords aren't on someone else's server

542458• 3 years ago

Unless you own a datacenter I don’t think that’s a full solution to the “passwords on someone else’s server” problem.

unforeseen9991• 3 years ago

Considering I just lost power to my house containing my homelab due to a storm, absolutely lol

ndsipa_pomu2• 3 years ago

Well, I run my own vaultwarden instance (it's great), but I host it on a free Oracle (ewww) cloud instance. At least if that goes down, I can just run it from my last backup and host it in my house until I find something more resilient.

sotix• 3 years ago

When I looked into running it locally on my own server, I couldn’t get it to work because it required https. I connect to my local server with WireGuard without exposing it otherwise to the internet, so I don’t have a need for https. There’s probably a way to set up https, but I gave up after a few hours trying various workarounds while the rest of my local services continue to work via http and WireGuard.

Isthatablackgsd2• 3 years ago

I tried to self host for some services in Docker and they requires https as well. I gave up trying to set up my own after few days of trying set up https, it is way out of my league and I don't have experience with it. I remember Caddy provides automatic https right out of the box. Maybe try looking into Caddy?

coder5433• 3 years ago

Plain Wireguard would require more work to replicate this feature, but I remembered hearing that Tailscale offers a beta feature to provision certificates, which I still need to try out sometime.

https://tailscale.com/kb/1153/enabling-https/

DavideNL• 3 years ago

Well, any server will at some point crash / need a (partial) restore / need an urgent update / have a power outage / etc, including the one your run yourself - which you also need to manage yourself, which can sometimes be an issue when you're busy.

- It's great they offer it of course, as for many people it _is_ a good fit.

Wowfunhappy• 3 years ago

I have more faith in Bitwarden's ability to secure their servers than I do in my ability to secure my own server. Bitwarden has people who work on this full time, and I do not.

I do self-host things, but nothing so security-sensitive.

xoa5• 3 years ago

I have more faith in Bitwarden's ability to secure their servers than I do in my ability to secure my own server. Bitwarden has people who work on this full time, and I do not.

First: E2EE. You're thinking in terms of a web gui, not a E2EE client-server where the server itself is untrusted. If done properly (and I've seen no indication Bitwarden's isn't) that would mean that server compromise is irrelevant anyway beyond uptime.

But second in general: Bitwarden has people attacking it full time, and necessarily must be on the public internet with untrusted clients. And I do not. One's own server doesn't need to be on the public internet at all, you can have 100% of access exclusively through a Wireguard or other secure VPN. You have completely control of every single client, because they're all yours. Server blocked from internet entirely, update it out of band, or at least restrict what it can talk to to exclusively upstream update servers. This massively reduces attack surface. If only trusted clients can access something, then compromising it means going through a trusted client. But if the trusted client is compromised in this scenario you're hosed regardless. The server is irrelevant.

There's lots of good reasons of course not to run your own thing, but the security aspect gets overdone with false equivalences. It's the equivalent of people pointing at what the likes of Amazon or Google or whomever have to do for database work. But while they have far more resources, they also have far more demands and requirements. Stuff that is very challenging at hyperscale can be done far more simply but still effectively at small/medium scale. It's not wrong to think about the tradeoffs, but worth being cautious of apples to watermelons comparisons.

suddenclarity• 3 years ago

This is what stopping me from migrating to Bitwarden. Do I trust their servers and hope they are not as bad as Lastpass? Or do I need to host everything myself and accidently leak it? I've had plenty of Wordpress sites through the years that were exploited before they introduced auto update. I've also heard that the autofill is quite bad.

I wish password protection was a lot simpler.

Jnr• 3 years ago

I don't trust them either, so the only way I am OK running anything self-hosted is behind private VPN. Wireguard is great for this since it is a silent protocol and no mass scanning of internet will reveal it is running there. It can be found out only by snooping on data traffic but even then it has good security. On top of that I also use https for internal-only services.

Another great option is Cloudlare with it's "cloudflared" tool. Combine that with OIDC+forwardauth and I would be OK exposing some not so critical systems to the internet.

l72• 3 years ago

I self host vault-warden on my home network, but it is not publicly accessible. Like all my services I self host, I keep them internal only, then use wireguard to have an always on vpn back to my home network.

This way, I only have to focus on making sure my vpn is secured.

HumblyTossed• 3 years ago

I trust Bitwarden more than my own abilities, but I have been thinking to do this just as a backup and have it offline unless I need it.

_lvbh• 3 years ago

I do that & make sure it’s only accessible by connecting via my WireGuard VPN. Works amazingly and I would bet probably more secure than just a master password.

Barrin92• 3 years ago

so your passwords aren't on someone else's server

being able to transmit information across open or even adversarial channels is the literal reason encryption exists

This is security theater, if your security method is keeping your data local you can use notepad, you don't need to go through the hassle of setting up a password manager

squeegee_scream3• 3 years ago

I’m not a bitwarden user, does this mean users can’t access their secrets on their own machine if they are logged out? Because that’s not how 1Password works. I suspect that isn’t the case but it sounds like it to me

harryquach• 3 years ago

I use Bitwarden and am able to access and create secrets

squeegee_scream3• 3 years ago

But are you able to log out of the desktop client or mobile client, then log in and see your things?

msh• 3 years ago

Bitwarden works offline. You can just not sign in on a new device.

aquova• 3 years ago

I just tried it myself on a machine completely logged out, and the login page is simply spinning.

squeegee_scream3• 3 years ago

That is deeply concerning, no?

mqus• 3 years ago

There is a difference between logged out and locked(default state of the client after opening the browser/restarting android/something you can configure in your settings). If it's only locked you can get your data, no problem. If you're logged out, no data is stored on the client. Not sure if this distinction exists in 1password.

selykg• 3 years ago

1Password stores data locally and syncs. So, this wouldn’t impact 1Password as far as I am aware. They use AWS, not Azure though.

jiofj• 3 years ago

Yeah... tried to edit a password before and took me a few attempts. It was odd because bitwarden always works very well for me.

bobse• 3 years ago

I have a paper notepad where I keep my secrets. No fucker can hack me.

dartos• 3 years ago

Just never take it outside or the camera satellites will snap a pic

CoastalCoder• 3 years ago

Oh, please.

Everyone know the satellites are arranged into a constellation to form a massive C.T. scanner.

So leaving the house is irrelevant.

kioleanu• 3 years ago

My wife used to have one of those. The amount of times she called me to read a password from the notebook because she forgot it at home is… well… quite staggering

lxgr7• 3 years ago

Thinking about this scenario, but combined with AI voice impersonation, makes me very uncomfortable.

ndsipa_pomu2• 3 years ago

However, that leads to the problem of either always carrying it with you, which makes it more likely to be lost or stolen, or not having it with you when you want access to it.

The lack of backups is also a concern.

darkwater• 3 years ago

The lack of backups is also a concern.

Carbon copy

moffkalast3• 3 years ago

Same applies for using mobile phones as 2FA.

fastball• 3 years ago

Obligatory XKCD: https://xkcd.com/538/

xoa5• 3 years ago

Obligatory: that comic is one of the few (only?) times Mr Munroe got a topic completely, absolutely and utterly wrong and made a really, really bad comic. That it gets pushed an astonishingly high number of times on technical forums kind of illustrates though how little critical thinking even people who should know better do sometimes I guess. And I suppose how fractally wrong it is can be a good starter for discussion.

Edit: commenting about downvotes is almost always pointless. But pointing out the truth about this comic always gets lots of commentless downvotes, and so this time I want to say that you people are wrong, and you are actively misinforming people. Security is about economics, increasing the time/cost for attackers vs defenders. Additionally, different security measures are about specific threat models. Encryption is entirely orthogonal to physical attacks, which are addressed by physical defenses. But physical attacks are much more expensive and riskier, if they're possible at all, vs electronic. And encryption still yields the important value of knowing you were attacked at all. If you are going through an airport and they demand your password at gunpoint, you can surrender it right away and you've lost nothing, but now you also know they were interested and all the data is likely compromised. Whereas if it was all unencrypted, they could have just quickly and transparently copied it all off, added a root kit, etc with you never being the wiser. But in much of the world, official services threatening you physically isn't legal. And if it's criminals, how often is the "lead pipe" a thing vs "we stole this from some tourist and we don't even know who it belongs to" or the like?

XKCD is rightfully popular. But this comic is shallow and bad. It shouldn't be held up as at all valuable in security discussions on HN or anywhere else.

nilamo• 3 years ago

So you lose everything everywhere in the event of a fire, flood, etc? That doesn't sound like an improvement...

paulryanrogers• 3 years ago

Assuming all passwords are long, random, and unique. Preferably paired with MFA where possible.

moffkalast3• 3 years ago

This sends some schadenfreude into my veins for those people that constantly advocate for using a password manager in the most annoying way possible. Congrats, you now have a single point of failure for all your accounts.

nicoburns• 3 years ago

Bitwarden stores a (encrypted) local copy of your vault on your device. So as long as you were signed in somewhere using any of the desktop app, mobile app or browser extension then you should still be able to access your passwords during this outage. It's just the sync that isn't working (and if you need to sign in on a new device).

Astronaut3315• 3 years ago

It still works fine as long as you don’t log out. Nothing is broken on my end.

dotnet004• 3 years ago

Not at all a single point of failure, as others have mentioned, this is only for logging into new devices, devices which are already setup will have a local copy of the database. Plus you can export the database to have a backup that can be restored elsewhere. I keep a database backup (encrypted of course) on a flash drive with my yubikey for instance.

Have never had a point where I haven't been able to access my passwords.

moffkalast3• 3 years ago

That's not what I was referring to, but the single master password that decrypts everything. Though this would be bad as well.

jwnin2• 3 years ago

appears to be a localized outage as there's no mention on https://azure.status.microsoft . Though, that's more of a PR status than actual status.

sysadm1n3• 3 years ago

I 'mirror' my Bitwarden login entries in a KeepassXC database, so I have an offline carbon copy incase Bitwarden's servers are wiped or not accessible, or for whatever reason, I can't access my Bitwarden vault. I would suggest everyone do the same. The only pain point is remembering to make a carbon copy of each entry you add to Bitwarden, in the KeepassXC database.

I also make copies of my KeepassXC database in several cloud storage services incase of a house eating event which destroys my hard-drives (unlikely but still a possibility). I really don't like the idea of being locked out of my digital life.

Terence Eden has a good article about this potential scenario;

https://shkspr.mobi/blog/2022/06/ive-locked-myself-out-of-my...

For those wondering why I use Bitwarden as-well as KeepassXC:

1.) Redundancy. Can't get at my KeepassXC?, then I try Bitwarden. Can't get at my Bitwarden? Then I try KeepassXC. Can't get access to both? Then I'm screwed (but this is unlikely).

2.) Browser extension. I like to be able to login easily to sites using their extension.

3.) LOCKSS (Lots of copies keeps stuff safe). Having a cloud-based mirror of my login entries stored in Bitwarden is marginally better than solely relying on KeepassXC.

4.) Logging into KeepassXC is sometimes more complicated than logging into Bitwarden. I have a long seven word passphrase for KeepassXC, and use a keyfile which I have to 'hunt down' in the filesystem each time I go to access KeepassXC (I have disabled the ability to store the last used database & keyfile for security reasons). With Bitwarden I just open the app and if it's unlocked, I get quick access to everything.

dotnet004• 3 years ago

Why not just periodically backup your bitwarden vault to external storage?

lxgr7• 3 years ago

From GP:

incase of a house eating event which destroys my hard-drives

I worry about this as well. Yes, a friend's house is an option, but not everybody has friends or family in the same city, and if they're further away, updating copies is a pain.

havnagiggle2• 3 years ago

What exactly is Bitwarden getting you if you're doing this copy process? I have only used Keepass and haven't read why Bitwarden would be superior for some scenarios over what I am already doing.

sysadm1n3• 3 years ago

What exactly is Bitwarden getting you

1.) Redundancy. Can't get at my KeepassXC?, then I try Bitwarden. Can't get at my Bitwarden? Then I try KeepassXC. Can't get access to both? Then I'm screwed (but this is unlikely).

2.) Browser extension. I like to be able to login easily to sites using their extension.

3.) LOCKSS (Lots of copies keeps stuff safe). Having a cloud-based mirror of my login entries stored in Bitwarden is marginally better than solely relying on KeepassXC.

blue_pants• 3 years ago

I manually export my Bitwarden vault to KeePass from time to time as well. The benefit of still using Bitwarden for me is that I can access and update my main vault from any linked device (desktop PC, laptop, phone) without needing to synchronize data between devices. It's far from an ideal way, but you can have a little more confidence that you will have access to your data (although it might be a slightly outdated snapshot of the data) even if you can't access the Bitwarden server. That is exactly what happened today, and I was still able to retrieve my password from the local copy.

Isthatablackgsd2• 3 years ago

My understanding that BW have superior auto-fill features and wide support for different OS. Keepass don't have auto-fill for browsers, Keepass have to rely on third-party to provide the auto fill features and various apps for all variety of OS.

I'm a Keepass user since 2006 and never had a problem with them. My database is saved in OneDrive and always keep local copy in my system. If OneDrive is down, my local copy is always there for me.

lucideer3• 3 years ago

haven't read why Bitwarden would be superior

1. Out-of-the-box integrated sync with a dedicated default host: keepass has 8 different sync plugins, all with different levels of maintenance & UX, each for separate sync backends, all requiring separate 3rd party backend account setup

2. Consistent cross-device features & UX: Keepass has 3 browser plugins with varying levels of browser support (not sure if any have mobile support?)

On top of the above, Bitwarden is open source and allows self-hosted sync

Timber-65393• 3 years ago

Why not just use KeePassXC ?

sysadm1n3• 3 years ago

1.) Redundancy. Can't get at my KeepassXC?, then I try Bitwarden. Can't get at my Bitwarden? Then I try KeepassXC. Can't get access to both? Then I'm screwed (but this is unlikely!).

2.) Browser extension. I like to be able to login easily to sites using their extension.

3.) LOCKSS (Lots of copies keeps stuff safe). Having a cloud-based mirror of my login entries stored in Bitwarden is marginally better than solely relying on KeepassXC.

ronnier• 3 years ago

I just host my own Bitwarden. I try to self host as much as possible and be anti cloud

RyeCombinator• 3 years ago

Anti public cloud here as well

seanthemon2• 3 years ago

Using something like vaultwarden? I'm curious how do you keep it secure from intrusion? I'm looking to do the same

CommanderData• 3 years ago

When Bitwardens servers are inaccessible mobile and windows app continue to work just fine using a cached version.

In my case even sync new passwords once the seever/Internet comes back up.

BiteCode_dev• 3 years ago

Indeed, it worls online fine. Also there is a stand alone desktop version, no need for keypass.

I do use keypass to save things I don't want to expose in an online service, no matter how secure it is.

54ty45hg• 3 years ago

why not just self host at this point? this seems like security theater.

lxgr7• 3 years ago

I've been considering this, but to be honest, I don't trust myself to keep up with updates and other aspects of opsec for something that I only use for myself and would have to do consistently and reliably at nights and weekends.

That would probably be balanced out with my self-hosted instance hopefully being less of a target, but the downside there is that I might not even know that my database was compromised and it's down to my passphrase strength now.

With Bitwarden's SaaS, I'd hope that I would hear about such a compromise before too long, giving me time to rotate passwords while GPUs gnaw at my (and everybody else's) passphrase.

Additionally, there are certain opportunities for account access recovery that are much harder or impossible when self-hosting, e.g. things like a cool-down period and a warning e-mail before allowing a less-secure 2FA method.

noam_compsci• 3 years ago

Genuine question: why all the hassle when it’s so easy to reset passwords?

miketery2• 3 years ago

Password reset assumes two things:

A - the service doesn't encrypt your data (or has access to your private keys), and

B - that you have access to the second factor which is used to reset your password (e.g. a backup email address).

Secure password managers do not have access to your private key (i.e. the encryption key), as such if you lose the seed there is no recovery.

In the case with other services (i.e. they can reset your password) there is a chance you could lose access to your backup email or phone number used for resetting.

Edit: some services do allow reset by proving your "identity" (e.g. bank), in which case you have to go through customer service and provide requested information. (I put "identity" in quotes, because nefarious actors can sometimes prove this too).

thefz2• 3 years ago

I 'mirror' my Bitwarden login entries in a KeepassXC database

I do this manually and I want to know if you automate it and how.

miketery2• 3 years ago

I'm working on a product to solve this problem (i.e. where do you backup your seed, high value keys / secrets, 2FA codes). The approach is social recovery (threshold cryptography) for the root seed, and a digital agent component (i.e. DWN - distributed web noted) SaaS or self hosted. The digital agent is used for encrypted backups and to communicate with other parties (contacts). Does this sound interesting to you?

nonfamous• 3 years ago

There’s no mention of Azure on the Bitwarden status page.

aaomidi2• 3 years ago

Yeah no idea where OP got Azure from?

linuxdaemon• 3 years ago

Bitwarden's help pages state storage is in Azure cloud: https://bitwarden.com/help/data-storage/#on-bitwarden-server...

So if there is an observation of an issue, it's reasonable to connect those dots, plus their statement on that page "All uptime, scalability, security updates, and guarantees are backed by Microsoft and their cloud infrastructure" pretty much says any issues are MS/Azure problems.

ravivyas• 3 years ago

What is a good safe way to take a backup of your vault?

kekebo2• 3 years ago

Safety is in your hands but the bitwarden client allows you to export your vault https://bitwarden.com/help/export-your-data/

kekebo2• 3 years ago

(which also allows for encrypted exports https://bitwarden.com/help/encrypted-export/ )

dudeinjapan• 3 years ago

1Password or you’re doing it wrong.

hiAndrewQuinn• 3 years ago

Ha. Back when I was considering learning C# to compliment my Azure skills and get a safe, sustainable job in enterprise I remember finding Bitwarden as one of the only major C# projects on GitHub I could find. I had a strong hunch after that who they were hosted by.

awinter-py• 3 years ago

self hosted vaultwarden (formerly bitwarden_rs) is not down fwiw

must be in a different AZ

devwastaken• 3 years ago

I did not realize bit warden uses azure. I will now be changing password managers. Never trust MS to do anything.

jacooper• 3 years ago

Bitwarden is E2EE, it doesn't matter where its hosted.

tamimio• 3 years ago

Yesterday I bought their premium, guess I broke it!! But as other mentioned, I do have a plan B and C and even D.

Bitwarden login down due to Azure outage

Related Stories