Passwords utilization

qwerty123, passw0rd, 123456789, some examples of the most used passwords. It may look obvious that none of them should be used as they don’t resist more than 1 second to any Brute-Force-Attack. It is sadly real that they are part of a long list of vulnerable passwords that are used over 30 millions breached accounts in 2020.

A strong password must be a combination of capital letters, lower case letters, numbers and special characters. And the longer, the better. The following website gives you an overview on how vulnerable a password can be: https://www.grc.com/haystack.htm.

For example, qwerty can be cracked in less than 1 second. g6-M?3Vl is a much better password with all above requirements but it doesn’t resist much longer than 1 minute to an attack coming from an array of powerful computers… which doesn’t happen every day, I admit.

The same array of machines could take more than 1.4 hundred millions of centuries to crack a 16 long passwords like g6-M?3Vl@p6/43L(

But how could we memorize this type of password if I have a different strong one for each of my account… mail, bank, retail, … We may easily have more than 100 accounts we frequently use.

Let’s use an Excel spreadsheet to collect all the passwords and protected it with a strong password… why not, but you need to have this file on all your devices and make sure it is always synchronized after each and every change… not very convenient.

What about Passwords Managers embedded into browsers, the database is kept synchronized wherever you go but here you’re stuck with one type of browser.

My advise, use a proper Password Manager application which is independant from any browser. There are plenty of them as listed below (not in any specific order):

  • 1password
  • dashlane
  • lastpass
  • keepass
  • bitwarden

Most of them offer free or premium features but the basic is helping you to create strong passwords (embedded generator with choice of length, type of characters), store them in a password protected database (the unique password you have to remember and must not forget !!), database which can be synced between your different devices (computers or mobile). It also fill-in these info when required when you browse whatever browser you use thanks to plugins.

I started using one 8 years ago and I never came back.

Now, I won’t give you any recommendations on the one you should choose, there are a lot of comparisons online. Here, I’m just saying I’m using Bitwarden and the self-hosted version of Bitwarden.

It brings me all the features I just described above and the database where I store everything sits with me on a home server and not on any hard disk on an unknown server somewhere in the world.

So here is the installation guide for the self-hosted version of Bitwarden on a Synology

Installation guide

Preambule: On May 1st 2021, the bitwardenrs/server image was deprecated and replaced with vaultwarden/server.

  1. Install Docker application on your Synology if not already installed
  2. From Registry tab, download the latest version of vaultwarden/server:latest (fka bitwarders/server)
  3. Once downloaded, launch the image and configure the Advanced Parameters as following:
    1. Volume:
      • map docker/bitwarden to /data
    2. Network:
      • use the predefined Bridge network
    3. Ports:
      • map 1666 (or any port of your choice as local port) to 80 (container port)

 

  1. Create a domain name on a DDNS pointing to your WAN IP address: for example bitwarden-mydomain.com
  2. Create a SSL certificate with Let’s Encrypt for the domain you just created
  3. Create a reverse proxy rule forwarding https://bitwarden-mydomain.com:443 to http://host_server_IP_address:1666 (or the port you chose)
  4. Browse to https://bitwarden-mydomain.com and create your 1st user using a strong password you must not forget

 

  1. Once done, stop the container and edit it to add in Environment Variables
    • SIGNUPS_ALLOWED=false in order to restrict creation of new user from the portal
    • put this variable to true each time you need to add new users via the bitwarden homepage

  1. Install plugins to your browsers (Chrome, Safari, Firefox, Edge, Opera, Tor, … are supported) and configure your server https://bitwarden-mydomain.com
  2. The easiest way to add your different accounts from the web to Bitwarden is to browse on the site and log in, the plug in will then propose to save the account into the database which will be sync’ed to all you devices with Bitwarden configured