Do goldwarden and bitw overlap in use-case?

[dantefromhell]

https://github.com/mvdan/bitw/ allows reading secrets from a BW vault via DBUS, while goldwarden seems to focus on desktop features and user experience.

From my understanding, the Linux world is settling on libsecrets + DBUS as (at least one) standard to provide a central keychain function similar to MacOS Keychain feature.

Is goldwarden planning to support DBUS/ libsecret too, or is goldwarden intended to run in parallel to bitw?

[quexten]

Right now, they do not overlap. While it is not "intended" to run in parallel, you can certainly do so, but both projects are independent projects.

The feature development for Goldwarden until now was mostly just based on personal need, thus I have not added dbus/libsecret support. While technically not too challenging, I have some questions about the use-case and some other security notes.

Looking into my Keyring - on Fedora 38 - credentials are of 2 categories.

1. Application specific secrets (one key for each flatpak, a Key to encrypt Chrome's secure storage, and so on.
2. Actually re-usable credentials (Wifi password, SMB password etc.)

For 1. I don't see why one would want to store these in their Bitwarden vault, as they are tied to that machine specifically and useless on other machines
For 2. This makes more sense to store in Bitwarden, these can be re-used, even if they would have to be "encoded" as Logins/secure notes because of a lack of custom types

So far I have not encountered any apps that actually read username/password combinations from secret service. For this, Goldwarden's autotype works well.

Security wise, I have not poked at gnome-keyring / others so far, but in this area, Goldwarden would actually provide 2 benefits.

1. Through the use of memguard, credentials are encrypted at all (except microseconds during access) times, which makes memory dumps significantly more challenging
2. Access control via polkit on each access should prevent rogue scripts from dumping the keystore (which is trivially possible on the default keyring, as it only has user-based security)

Though the latter - access control on each access - might get annoying depending on apps access patterns.

Regardless, do you have any input what your use-case is? Is it mostly for synchronizing re-usable credentials such as Wifi passwords / SMB credentials between machines?

[dantefromhell]

Thanks for the extensive write-up. I do appreciate the security focus of goldwarden, not leaking credentials via memory or to permissive access control make goldwarden more attractive.

I do agree category 1 type of secrets have very little (to nothing) to gain from being stored in BitWarden. But than the harm of doing so might also be small? (Not a flatpack user).

In category there are some application passwords (e.g. Thunderbird master PW, AnyType) that I am storing and for which I explicitly want to benefit from sync as I'm working on multiple desktop machines. The pain is that some apps (looking at you AnyType) only reads the PW from a DBUS secrets implementation for auto-decrypt.

WiFi and other service credentials are less of an issue (at least for now) as those are managed through NixOS & home-manager.