vaultwarden.fr and vaultwarden.de

[Tatayoyoh]

Hi there

Is vaultwarden.fr and vaultwarden.de a scam ?

It looks like !!

[stefan0xC]

Cf. I've found a public Vaultwarden instance. Is it associated with this project? Is it safe to use?

[Tatayoyoh]

Thanks a lot @stefan0xC ✅

Owning all vaultwarden.* main domains isn't the first step of security of this project ?

I mean, creating a so nice project to project people private password and life, and then people can leak passwords so easely ? Isn't it a major security topic ?

[stefan0xC]

Nope.
Do you know how many top-level domains there are and how much it would cost to secure everyone of them?
If users are irresponsible enough to use a public instance that is on them.

[kpfleming]

If you want to fund the purchase and maintenance of registrations for a few hundred domains, I'm sure the Vaultwarden team would be happy to take your money!

[Tatayoyoh]

First, please excuse me if my poor English was annoying; I didn't mean to be.

I know the cost of a buyout and how difficult it is to raise funds. It was foolish to write it that way.

As a simple suggestion: add a large disclaimer to the README.md.

In any case, I would point out that creating a data protection project, which is highly regarded within the community and recommended in YouTube videos, could address this problem.

[stefan0xC]

What should the large disclaimer say? How large should it be? And how do you decide which information should be in the README and which should not? Who would be helped by such a disclaimer? I mean it already says that this project is intended for self-hosting.

In general, you can treat every random public instance as a potential phishing site. If you use a random site, you don't know who is behind it. Just because a public instance displays the Vaultwarden logo does not mean it has any connection to this project.

This project distancing itself from all public instances even more prominently won't help anyone who disregards basic digital literacy. If a user decides to register on a random website to store their passwords, a disclaimer here won't stop them. And teaching fundamental digital literacy is a bit outside the scope of this project.