Public Instances

[Y0ngg4n]

@dani-garcia @BlackDex
a friend and i are currently hosting redacted.
Hodahel Moinzadeh is currently hosting redacted

We kindly wanted to ask if there could be a place at the vaultwarden repo (Maybe a github.io page?) where we can list public instances. Would be nice if we could work together on a solution.

Have a nice day and thank you for your great support so far. :)

[Masgalor]

There is a page for third-party-packages in the wiki, why not create a page for third-party-hosting there as well?

Anyway, I'd like to add another quiet popular public instance:
redacted hosted by redacted in Germany.

[jjlin]

This subject has come up in the past, but generally, it's not really a good idea to actively point people towards instances run by people they don't know and trust. Public instances could easily serve a version of the web vault that captures the user's master password, and most users would never notice. This is especially true of users who would choose to use a public instance in the first place, as they presumably don't have the technical ability to set up their own instance. Of course, most public instances are probably run by well-intentioned people, but you can never really know.

Using a public instance could be safer if the web vault didn't have to be used (some functionality and configuration today are only available via the web vault), or the web vault code were signed (e.g., Signed Pages and Code Verify), but having to install an extension specifically for this purpose is probably still too complicated for many users.

[Y0ngg4n]

Because of this issue we have created Front Pages on the main domains to inform the users. I generally would think it would be great to have a list, but i totally agree that we should clearly state on that list that this is run by some persons on the internet. But a good tip with the signed pages.

[jjlin]

I don't really see a point to making a list of public instances while also saying that it's probably not safe to use any of them. Someone actually already added one on the wiki at one point, and it was removed for safety reasons.

[Y0ngg4n]

I mean we can go the way with page signing and say hey you can check the integrity with this addon. If you dont do. You probably shouldnt trust. Its just a list. Let people decide themself what to do with it. The pure existence of public instances means that there is a need for it.

[BlackDex]

Besides the whole safety point on which i totally agree. Because we do not know in what way the server or web-interface has been altered.

I must say I also do not like that this projects logo (designed by me), is being used on those front pages. It almost says, hey, this is an official Vaultwarden server.
Even though it says, Unofficial, Vaultwarden is also an unofficial Bitwarden backend. Which, in my eye's could be confusing for other users.

So, we are not going to be endorsing any public hosted instance somewhere from this repo.

[Y0ngg4n]

@BlackDex i will remove the vaultwarden logo and add a sentence to clarify that it is not a "official" vaultwarden instance. I can understand that point so i will do that the next days. I really want to find a sollution together we are all happy with. So please let us find a way we an also other public instances can handle it the correct way. I think the idea with page signing is a good way but if you have better ideas please come at me and we will find a solution that fits for everyone.