Push notifications: yes or no?

[tessus]

I am not sure whether I should enable push notifications. Is the overhead worth it?

I've been happy without the push notifications until now. When I added or updated data in web/desktop/browser, it was replicated almost instantly. That's all I needed, since it's not that hard to use the pull down gesture to sync on mobile.

I also know that they are a requirement for logging in with a device.

Have you enabled push notifications? What are your opinions?

[zacknewman]

Arguing for/against push notifications is largely equivalent to arguing for/against WebSockets (i.e., wanting one but not the other is almost logically inconsistent since they solve the same problem for the different kind of clients). The only reason I use the adverb "largely" is that push notifications require registering with the Bitwarden API which may cause more overhead and may be a privacy concern.

Technically, it's possible for a client to update information overwriting information written from another client if the data was out-of-sync; but that's unlikely since the changes would have to be 1 second apart due to this diff several years ago. Since nothing is instantaneous anyway, I'm sure there is a time interval where such overwrites can still occur even with WebSockets or push notifications. I suppose if the system time on the server or client is off, then this increases the chances as well.

Personally, I don't use either since I prefer the reduction in code and am content with this 1-second window (which can be reduced on a local clone of this repo) especially since clients and server all use the same time source—forced by clients having to use an internal network to access the Vaultwarden server, and the router redirecting all NTP requests from all devices (including Bitwarden clients and Vaultwarden server) on my internal L2/L3 networks to a self-hosted NTP server.

[tessus]

Thanks a bunch for the reply.

I posted this question because I am "concerned" about the overhead (not only the number of network requests, but also the ping to the bw push servers). Your opinion is similar to mine, even though I have enabled websockets.

[zacknewman]

Performance-based questions are kinda a crapshoot. The only reasonably accurate answer is to try it and profile it to see if the performance causes noticeable overhead. It will likely be dependent on a myriad of factors that are usage specific, so only you can know. Did you test the performance impact of WebSockets before using it? The fact that other people use push notifications seems indicative that it's at least possible the overhead will be fine for you.

[tessus]

It's not a performance question per se. I worked in DB2 performance in the IBM Toronto Lab for many years.
It's just to gather some subjective opinions. e.g. The bw push servers will see the vw server's IP address and the cipher id of pretty much every transaction.
Realistically speaking not much can be done with that info. yes/no/maybe - why? why not? Stuff like that. I just wanted to put it out there, but apparently it was too boring to start an enganging discussion.

[zacknewman]

Ah, you only explicitly mentioned "overhead" in the original post; so I wasn't sure if privacy was also a concern. For me that's probably the biggest reason why I don't have push notifications enabled; but then again, I don't use WebSockets either for code reduction (and thus the probability of bugs/vulnerabilities) reasons. As a result, push notifications would also be disabled even without the middlemen Bitwarden servers; thus my opinion is likely not relevant.

[tessus]

Yea, maybe I should have expressed myself more clearly. My bad. For me "overhead" means everything that comes with flipping the switch to enable push notifications.