I’ve always hated the idea of using a subscription/cloud hosting for password management. I feel like I should have a LOT more control over that stuff and I don’t really want to hand all my keys over to a company.
All my secrets have been going in a highly encrypted archive with a long passphrase, but obviously that isn’t convenient on all devices. It’s been fine, I can open it on any computer but it’s not super quick. It does have the advantage of being able to put in multiple files, notes, private keys but it’s not ideal.
Anyway, finally found something that isn’t subscription, and has a similar philosophy - a highly encrypted archive file, and it’s open source and has heaps of clients including web browser plugins so it’s usable anywhere, and you can sync the vault with any file sync you like.
Thought you guys might appreciate the find, password managers have always been a bit of a catch 22 for me.
Note for android i found keepassxc the best app, and i’m using KeePassHelper browser plugin, and the KeePassXc desktop app as well as the free official one. Apps all seem to be cross platform.
You must log in or register to comment.
I personally prefer bitwarden, using a self-hosted vaultwarden. It’s free, it syncs, it’s easy to use.
Same, and the apps work great.
I used to use keepassxc for years. Kept it synced with sync thing, though eventually work blocked networking with sync thing so I swapped to vaultwarden and never been happier.
I recently made the switch to Vaultwarden when I read a series of articles making predictions about passkeys and how they are lining up to replace passwords. Bitwarden apparently is ready to implement whatever standard becomes most popular and I had FOMO of being left behind if I stuck with keepass only. Previously I was using various keepass compatible apps and then syncing the KDBX database with my Nextcloud. (Vaultwarden is the selfhosted fork of Bitwarden)
Vaultwarden isnt a fork because bitwarden isn’t selfhostable. Bitwarden has an official selfhosted version. Vaultwarden is a lightweight rust version of the backend. As the selfhosted version by bitwarden is quite fat. Vaultwarden uses the official webapp of the webvault in their fork.
I use KeePassXC on my laptop, KeePassDX on my phone and sync them with Syncthing.
This ia pretty sweet
Not bothered about the potential for keyloggers or even OS-level snooping on what is presumably your privacy-free Android device? Personally I would never type the master password into anything other than a computer running a FOSS stack that I control, but perhaps that is excessive caution.
Well, there is a limit to my paranoid. It’s really hard to find a sweet spot between security and practicality.
I found mine with this settings I said
Keepass clients typically have biometric input… and let’s not pretend you don’t need to type in your vaultwarden password in Android on the first run, either.
You could use a usb-c passkey but I know that’s not the majority use case.
So, biometrics, master password, and USB key - 3 whole options and 3 things I personally will never be letting near Android. Unwarranted caution, no doubt.
keepass2android is worth a try as well.
it’s so good, wish I’d found it sooner
Exactly the same thought I had when I ditched Bitwarden for it. In my case, the transition was made even easier as I was already using Syncthing on my devices.
I have the same setup. It’s really neat.
Love KeePass. When LastPass enshittened, I went looking for something immune to enshittification. Best money I never spent
Did LastPass do anything besides charge for it service?
They didn’t use strong encryption by default, Something about not enough iterations of whatever algorithm they use.
They also got hacked (more than once) , which is roughly when they announced the encryption issue.
I feel like they got bought by a shitty company too, but that’s beyond me.
There have been reports that some of these vaults that were stolen have already been compromised, though not sure if there is any proof.
OK, it’s just not what enshitification means. I don’t like the term but if you’re using it wrong it’s just confusing.
Fair point, I misunderstood. Thought you were asking for more general points.
As for enshitification, I suppose it started in 2015 when they were bought by LogMeIn (I looked it up), that’s where it generally always starts. Don’t know if the service degraded as I switched around that time. Though getting hacked twice in six months is pretty bad for a company guarding the publics secrets
I have been using KeePass for eight years. Used to just shuffle the file around with Google Drive, now I have it sync’d with Syncthing across a few devices. I use its notes feature to store associated data like S3 keys and it stores my SSH key and KeePassXC can automatically add it to an SSH agent.
I don’t really have any complaints about it.
Been a Keepass user for years and years. Absolutely top notch. There are plugins that can auto fill websites, that can open putty ssh sessions, basically everything you can imagine (or build).
Are there advantages to this over self hosting Vaultwarden?
No in my opinion its worse in every way
Main thing I prefer about KeePass is that it’s a straightforward app that creates a file. Self-hosting a database seems just that much more complicated.
I used to be a KeePass user, but moved away because I was ultimately syncing the database using OneDrive, which I felt at that point it was a cloud password manager, which I didn’t like for being open to the internet and entrusting the security of the company hosting it.
And yes, I moved to self hosted Vaultwarden with Tailscale and haven’t looked back.
What’s amusing is I am purposely not paying for bitwarden because of the check against darkweb leaks or whatever type feature when you pay. That’s seems like an anti privacy thing. I understand it’s a good idea albeit seems to expose a lot of information about you. I would like to do vaultwarden but don’t think I can trust self hosting myself without paying monthly for a vps which I don’t want to do. Home Internet hosting seems to unreliable to me for something that important.
Just random thoughts of mine here.
because of the check against darkweb leaks or whatever type feature when you pay. That’s seems like an anti privacy thing. I understand it’s a good idea albeit seems to expose a lot of information about you
For the password leak checks, your passwords are never transmitted. They are one-way hashed locally, and then only the first few characters of the hash are checked against the API provided at https://haveibeenpwned.com which is run and designed by Troy Hunt, one of the most respected people in the cybersecurity industry. He collects major password breaches and makes them available to check against without actually exposing the data. It’s perfectly safe and secure.
The bitwarden clients also work when there’s no connection to the server, since they sync the vault. You just can’t add any new entries. That means spotty internet is not that much of an issue in terms of using it. It also means, that every device that has a client installed and gets used regularly (to give the client a chance of syncing) is automatically a backup device.
I host vaultwarden at home. No real need for a vps since your passwords are synced to your phone or laptop(whatever client you’re using) and you can just sync it when you’re home if you make changes, or setup a VPN (I use wireguard) and sync on demand when needed.
That said, I do sync my database to a vps for dr purposes incase my home server suddenly vanishes… for critical services I follow a 3-2-1 backup rule but it’s not absolutely essential.
Follow OP’s approach. Use a Keepass file. It is offline and can be stored anywhere you can reasonably trust. You just need to sync it if you have many clients but syncthing is great for that.
Yep I’m very impressed with syncthing. I just started using it a few weeks ago.
I installed KeePass(XC) on Android, iOS, Windows, Linux, Mac, for Firefox and Chrome and it’s all synced via encrypted cloud share. It even has OTP functionality so you don’t have to manually type 2FA codes.
If you keep the database in the cloud I recommend using a keyfile in addition to the password which is NOT kept in the cloud.
Very secure that way even if your cloud account is compromised.
I keep TOTP in a separate database.
Whats it called on ios? Keepassium?
KeePassium and Strongbox are both great.
Strongbox is rather expensive if you pay and missing too much if you don’t pay imo. I use KeePassium.
I don’t have an iPhone but I set it up for a family member. I remember we tried out two apps because the first one didn’t have what we needed. One of them was Keepassium, but I don’t remember of it was the one we kept.
There’s also Strongbox available for ios
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters NAS Network-Attached Storage SSH Secure Shell for remote terminal access VPN Virtual Private Network
[Thread #215 for this sub, first seen 13th Oct 2023, 19:05] [FAQ] [Full list] [Contact] [Source code]
For decent privacy oriented tool recommendations, here’s a list.
https://www.privacyguides.org/en/tools/
There was some drama about the webpages so I’ll link both to avoid angry users. Anyway, KeePassXC is on there, which it seems like it’s a fork of KeePass, you might want to check it out.
Yup, I have been using KeePassXC locally since (one of) the first big LastPass breaches. I thought “password manager company… they know encryption” and then kept some of the most important things stored in my vault including notes of Bitcoin seedphrases etc. Thought "even if they get hacked, they wouldn’t let anyone exfil the huge amount of data from the USER VAULT SERVER… thought “my passphrase is like 25-30 chars long, nobody will crack that”…
5 years after my last login and I find out the breach happened, user vaults were exfil’d, the encryption was absolute shit, and the notes weren’t even encrypted.
I don’t trust cloud companies to keep promises or know what they’re doing today. and anything self-hosted isnt Internet accessable unless it’s on dedicated hardware subnetted off and wouldn’t matter if it got hacked.
Bitwarden for example does public reports and is pretty cheap at 10€ per year. But the base (free) offering is more than enough. The fee is only to have TOTP and a bit of encrypted cloud storage. https://bitwarden.com/help/is-bitwarden-audited/
The fee is only to have TOTP and a bit of encrypted cloud storage.
And to keep the company alive. It’s cheap enough that IMO it’s worth paying for if you get a lot of value from it, even if you don’t need the paid features.
In theory at least, online services would be more safe than a locally decrypted vault. If your computer is compromised, the bad actors can pull your encrypted vault for an unlimited brute force attack. Of course, this can be mitigated by increasing the decryption time. However, if your vault is already decrypted, then bad actors can just pull all your password from your memory.
I, for one, am decrypting my vault once when I start my PC. In theory, if I were to use an online solution, bad actors wouldn’t be able to pull my vault from memory.
In theory, if I were to use an online solution, bad actors wouldn’t be able to pull my vault from memory.
It’s the same issue once you login to your vault via browser extension. They have to download your vault locally on login to decrypt it when you enter your password anyway*. Even if they don’t store your vault password in memory, they either store the entire vault (unlikely for size reasons) or a more temporary key to access the vault. Local compromise is full compromise already.
*If they don’t, then they either made a giant technological leap, or they’re storing your passwords on a simple database on their servers and that’s not what you want from a password manager.
Mine is a 3-lines-script that gpg-decrypts to runtime-dir, opens editor, encrypts back, deletes in runtime-dir. Password done via zenity/yad.
Are there users that have tried both Keepass and Vaultwarden? I enjoy using Vaultwarden on my Synology but I wonder if it’s worth switching to Keepass.
I have both set up right now.
Things I like better about KeePass:
KeePass doesn’t use the cloud, you don’t have to worry about the server getting compromised or going down because there’s nothing public-facing to hack. You always know where your password database is.
KeePass lets you encrypt the database with not only the master password but also using the challenge-response from a YubiKey. That means every time you save your DB the encryption key is rotated and the DB is actually encrypted by two authentication factors.
While both can add custom fields to an entry, I like that KeePass has the option to set fields as protected so their contents are hidden like the passwords.
Things I like better about VaultWarden:
Convenience.
You can log in to your VaultWarden account on any device from the browser. KeePass requires some software to access the DB.
The VaultWarden companion software is just better. It just does autofill better. KeePassXC/DX work well but just not as well as the BitWarden software.
Other thoughts:
Syncing passwords between devices with KeePass requires 3rd party software like SyncThing. If you break/lose/etc your VaultWarden server you could lose all your passwords with it.
Always make/test backups.
I use a yubikey on bitwarden (vaultwarden) just fine…
Custom protected fields exist.
And you can always hide it in a vpn.A big problem with keepass is if two updates to passwords try to sync simultaneously… sync- thing/ other synching software can’t merge only the updates in each file.
I also use aYubiKey in VaultWarden but the key is not used to generate the encryption keys, only the master password is, so you don’t get that added security and benefit of the encryption keys rotating every time you save the DB.
I’m on Bitwarden right now and have been thinking of switching to KeePass. My issue keeping me from actually switching is the convenience factor. Can’t imagine making it even more annoying to use for my SO
I like that KeePass has the option to set fields as protected
Vaultwarden can do that, though its quite stiff in some aspects like folders… subfolders? nonexistant…
Ah, I couldn’t find that option.
I can add custom fields to an entry but I can’t designate them as “protected”
Of course I also thought at first that you couldn’t attach files but I guess you can, they just didn’t seem to transfer over from my KeePass DB
The interface is weird and unintuitive at times…
I have a dropdown menu at the button “New custom field” and can select “Hidden”.Oooh thank you!
Can’t believe I missed that
Folder/subfolders work just fine… when you make folder ‘a’… you can add subfolder b by typing ‘a/b’
I cannot stop reading it as keep ass
I don’t know if they fixed it, I hope so, but not long ago there was a very dangerous vulnerability that allowed an attacker to bring able to access the master password.
I was using it long time ago, then I discovered Bitwarden and I’m really happy with it. I suggest you to have a look, in terms of UI is better and can be self hosted too.
I think that vulnerability was a non-issue. Someone could get to your password if they had full access to your machine to run arbitrairy code. But if someone has that much access, it’s already game over.
But yeah, Bitwarden is better IMHO
