I would not self host a password manager, simply because I don’t want running something like that on a 24/7 online server.
Still, if I needed to run a password manager on a server, I would rather self host it than use a hosted service from someone else.
In my opinion, running such a service commercially is a much harder problem than self hosting it and has a much bigger attack surface.
This is IMHO what many people do not understand about hosting as a service vs. self hosting: The full time DevOps/Admins etc. people who work at the hosting service are hopefully better than me at hosting stuff. At the same time the problem they have to solve is so much harder than self hosting, that even if they are 10x as good as me, running my own little service with a firewall, rate limiting and monitoring should at least not be less secure.
In my opinion the risk of something killing my server and wiping my passwords out is much much scarier than the prospect of a semi competent company hosting them getting hacked. Like several orders of magnitude scarier.
My solution is much simpler and more redundant: A KeepassXC file backed up to different physical locations and 2 different cloud providers.
If I ever forget my password, I am totally screwed. :-P … but OTOH an event which would lead to the deletion of all of my backups at the same time would be extinction - level. ;-)
I would not self host a password manager, simply because I don’t want running something like that on a 24/7 online server.
Still, if I needed to run a password manager on a server, I would rather self host it than use a hosted service from someone else.
In my opinion, running such a service commercially is a much harder problem than self hosting it and has a much bigger attack surface.
This is IMHO what many people do not understand about hosting as a service vs. self hosting: The full time DevOps/Admins etc. people who work at the hosting service are hopefully better than me at hosting stuff. At the same time the problem they have to solve is so much harder than self hosting, that even if they are 10x as good as me, running my own little service with a firewall, rate limiting and monitoring should at least not be less secure.
In my opinion the risk of something killing my server and wiping my passwords out is much much scarier than the prospect of a semi competent company hosting them getting hacked. Like several orders of magnitude scarier.
Fair enough!
As I said, I would not host it myself.
My solution is much simpler and more redundant: A KeepassXC file backed up to different physical locations and 2 different cloud providers.
If I ever forget my password, I am totally screwed. :-P … but OTOH an event which would lead to the deletion of all of my backups at the same time would be extinction - level. ;-)