There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

My new favourite password manager

I’ve always hated the idea of using a subscription/cloud hosting for password management. I feel like I should have a LOT more control over that stuff and I don’t really want to hand all my keys over to a company.

All my secrets have been going in a highly encrypted archive with a long passphrase, but obviously that isn’t convenient on all devices. It’s been fine, I can open it on any computer but it’s not super quick. It does have the advantage of being able to put in multiple files, notes, private keys but it’s not ideal.

Anyway, finally found something that isn’t subscription, and has a similar philosophy - a highly encrypted archive file, and it’s open source and has heaps of clients including web browser plugins so it’s usable anywhere, and you can sync the vault with any file sync you like.

Thought you guys might appreciate the find, password managers have always been a bit of a catch 22 for me.

Note for android i found keepassxc the best app, and i’m using KeePassHelper browser plugin, and the KeePassXc desktop app as well as the free official one. Apps all seem to be cross platform.

arrr ,

I installed KeePass(XC) on Android, iOS, Windows, Linux, Mac, for Firefox and Chrome and it’s all synced via encrypted cloud share. It even has OTP functionality so you don’t have to manually type 2FA codes.

nix ,
@nix@merv.news avatar

Whats it called on ios? Keepassium?

a1mlezz ,

Yes

arrr ,

I don’t have an iPhone but I set it up for a family member. I remember we tried out two apps because the first one didn’t have what we needed. One of them was Keepassium, but I don’t remember of it was the one we kept.

whysofurious ,
@whysofurious@sopuli.xyz avatar

There’s also Strongbox available for ios

ebits21 ,
@ebits21@lemmy.ca avatar

KeePassium and Strongbox are both great.

Strongbox is rather expensive if you pay and missing too much if you don’t pay imo. I use KeePassium.

ebits21 ,
@ebits21@lemmy.ca avatar

If you keep the database in the cloud I recommend using a keyfile in addition to the password which is NOT kept in the cloud.

Very secure that way even if your cloud account is compromised.

I keep TOTP in a separate database.

TiffyBelle ,
@TiffyBelle@feddit.uk avatar

I prefer the KeePassXC fork as it’s written in C++ and not C# so it has better native integration with OSes like Linux, but yeah these are really good solutions with no subscription requirements or necessity to upload to any cloud service.

qaz ,

written in C++ and not C# so it has better native integration with OSes like Linux

What do you mean exactly?

dan ,
@dan@upvote.au avatar

it’s written in C++ and not C# so it has better native integration with OSes like Linux

Not sure what you mean by this. Any APIs that can be called from C++ can also be called from C#. C# apps run natively on Linux, and they support self-contained deployment and native AOT (ahead of time) compilation meaning they can run on any Linux system even if it doesn’t have the .NET Core framework installed.

TiffyBelle ,
@TiffyBelle@feddit.uk avatar

This thread is about KeePass and my comments relate to that. If you pull KeePass2 from the repos in Debian, for example, it’s going to pull the Mono runtime to execute it as well because it’s been built, like most C# apps, for JIT compilation. I doubt it’s even possible to compile KeePass2 using AOT compilation.

This is what the C# KeePass application looks like using the Mono runtime in Debian:

https://feddit.uk/pictrs/image/20570e86-6c0b-4325-b7f4-2df32c5d9731.png

This is KeePassXC:

https://feddit.uk/pictrs/image/590ced27-0b20-4b96-8e04-87af5aff1986.png

You can see which has better native integration into the desktop out of the box.

dan ,
@dan@upvote.au avatar

s in Debian, for example, it’s going to pull the Mono runtime to execute it as well because it’s been built, like most C# apps, for JIT compilation.

.NET Core handles JIT compilation file. It looks like the KeePass developers have not yet updated it to use .NET Core though, which is why it’s pulling Mono in.

KeePassXC definitely looks nicer, but it’s definitely possible to do that with C# too. The KeePass developers just haven’t kept up with modern .NET.

Synnr ,

Yup, I have been using KeePassXC locally since (one of) the first big LastPass breaches. I thought “password manager company… they know encryption” and then kept some of the most important things stored in my vault including notes of Bitcoin seedphrases etc. Thought "even if they get hacked, they wouldn’t let anyone exfil the huge amount of data from the USER VAULT SERVER… thought “my passphrase is like 25-30 chars long, nobody will crack that”…

5 years after my last login and I find out the breach happened, user vaults were exfil’d, the encryption was absolute shit, and the notes weren’t even encrypted.

I don’t trust cloud companies to keep promises or know what they’re doing today. and anything self-hosted isnt Internet accessable unless it’s on dedicated hardware subnetted off and wouldn’t matter if it got hacked.

Quacksalber ,

In theory at least, online services would be more safe than a locally decrypted vault. If your computer is compromised, the bad actors can pull your encrypted vault for an unlimited brute force attack. Of course, this can be mitigated by increasing the decryption time. However, if your vault is already decrypted, then bad actors can just pull all your password from your memory.

I, for one, am decrypting my vault once when I start my PC. In theory, if I were to use an online solution, bad actors wouldn’t be able to pull my vault from memory.

Synnr ,

In theory, if I were to use an online solution, bad actors wouldn’t be able to pull my vault from memory.

It’s the same issue once you login to your vault via browser extension. Even if they don’t store your vault password in memory, they either store the entire vault (unlikely for size reasons) or a more temporary key to access the vault. Local compromise is full compromise already.

Appoxo ,
@Appoxo@lemmy.dbzer0.com avatar

Bitwarden for example does public reports and is pretty cheap at 10€ per year. But the base (free) offering is more than enough. The fee is only to have TOTP and a bit of encrypted cloud storage. bitwarden.com/help/is-bitwarden-audited/

dan ,
@dan@upvote.au avatar

The fee is only to have TOTP and a bit of encrypted cloud storage.

And to keep the company alive. It’s cheap enough that IMO it’s worth paying for if you get a lot of value from it, even if you don’t need the paid features.

bappity ,
@bappity@lemmy.world avatar

I cannot stop reading it as keep ass

fuggadihere ,

It keeps your ass out of negligence I’d say

Jerkface ,

Girlfriend at the time noticed this on my phone and had some choice questions for me.

bappity ,
@bappity@lemmy.world avatar

LOL

Lifebandit666 ,

That’s half the fun, well actually it’s a utilitarian app so pretty much all the fun

_dev_null ,
@_dev_null@lemmy.zxcvn.xyz avatar

Well you don’t want your ass took, at least not without permission.

SpaceXplorer_8042 , (edited )
@SpaceXplorer_8042@lemmy.zip avatar

Why did people stop using notepads (actual physical ones) for this? No digital storage, no leaks. Besides, after a couple of times you get the muscle memory of typing in the passwords anyway.

PlutoniumAcid ,
@PlutoniumAcid@lemmy.world avatar

My password manager contains about 600 passwords by now. I use 30+ passwords on a daily basis for work (IT industry) so no chance in hell that I’ll remember half of those. And the ones I need maybe once a year?? Good luck without a manager.

Undaunted ,

I have a different password for each service I use. Each password is 30+ characters long and completely random with letters, numbers and special characters. There’s no way I could remember any of them and they’d be a hell to type out manually. I use KeePass on every device I own and it’s synced over my NAS. So it’s super convenient and no risk for leaks.

CarbonatedPastaSauce ,

I did this, stored in an encrypted container, for a long time. Problem is it’s not scalable unless you start reusing passwords across different sites and services, which is itself a terrible practice.

Switched to Bitwarden (self hosted) several months ago and am very happy with it.

Appoxo ,
@Appoxo@lemmy.dbzer0.com avatar

Try to remember (2m(&$9hso2 Ok_(#
We will see how fast you can remember that after a long and mentally exhausting work day :)

Rootiest , (edited )

I’m using randomly generated 64-character passwords with upper/lower-case letters, numbers, and symbols.

I prefer not to manually enter them every time.

Also someone could find and photograph your notepad and then all your passwords are compromised in one go.

pedro ,

Tell me you use the same password everywhere without telling me you use the same password everywhere

ebits21 ,
@ebits21@lemmy.ca avatar

And they’re very likely way too short

stardust ,

Yeah, I’ve been wary of cloud based options so gone with KeePass and syncthing to leep things synced locally.

CarlCook ,

I really like Strongbox on Mac for managing my Keepass-DBs. It is very well integrated and there even is a „no phoning home“ version that strictly runs locally.

Rootiest ,

and there even is a „no phoning home“ version that strictly runs locally.

Shouldn’t that be all the versions?

Why would a password manager app that uses a local database need to phone home?

CarlCook ,

Maybe I expressed it a bit awkwardly. The other version has some integrations for syncing with Dropbox etc. and some third-party libraries. Strongbox zero is stripped of all of that.

Rootiest ,

Ok that makes more sense lol

LievitoPadre ,

I don’t know if they fixed it, I hope so, but not long ago there was a very dangerous vulnerability that allowed an attacker to bring able to access the master password.

I was using it long time ago, then I discovered Bitwarden and I’m really happy with it. I suggest you to have a look, in terms of UI is better and can be self hosted too.

Maestro ,
@Maestro@kbin.social avatar

I think that vulnerability was a non-issue. Someone could get to your password if they had full access to your machine to run arbitrairy code. But if someone has that much access, it's already game over.

But yeah, Bitwarden is better IMHO

monetize_nothing ,

Are there users that have tried both Keepass and Vaultwarden? I enjoy using Vaultwarden on my Synology but I wonder if it's worth switching to Keepass.

Capillary7379 ,

I switched from keepass to vaultwarden years ago and for my usage I wouldn’t switch back.

I needed to be able to share some passwords with other people. I think the clients are much better. I like having a website available as a backup to access a password. All in one package that works well so I don’t need separate mechanism to synchronize between different installations. I like the easy sharing secrets through links and not having to send in cleartext with emails or texts.

And for selfhosting I like that you only need the server only for syncing newly added secrets - if vaultwarden had to be online always I’d switch back.

Rootiest , (edited )

I have both set up right now.

Things I like better about KeePass:

KeePass doesn’t use the cloud, you don’t have to worry about the server getting compromised or going down because there’s nothing public-facing to hack. You always know where your password database is.

KeePass lets you encrypt the database with not only the master password but also using the challenge-response from a YubiKey. That means every time you save your DB the encryption key is rotated and the DB is actually encrypted by two authentication factors.

While both can add custom fields to an entry, I like that KeePass has the option to set fields as protected so their contents are hidden like the passwords.

Things I like better about VaultWarden:

Convenience.

You can log in to your VaultWarden account on any device from the browser. KeePass requires some software to access the DB.

The VaultWarden companion software is just better. It just does autofill better. KeePassXC/DX work well but just not as well as the BitWarden software.

Other thoughts:

Syncing passwords between devices with KeePass requires 3rd party software like SyncThing. If you break/lose/etc your VaultWarden server you could lose all your passwords with it.

Always make/test backups.

zeluko , (edited )

I like that KeePass has the option to set fields as protected

Vaultwarden can do that, though its quite stiff in some aspects like folders.. subfolders? nonexistant..

Rootiest ,

Ah, I couldn’t find that option.

I can add custom fields to an entry but I can’t designate them as “protected”

Of course I also thought at first that you couldn’t attach files but I guess you can, they just didn’t seem to transfer over from my KeePass DB

zeluko ,

The interface is weird and unintuitive at times..
I have a dropdown menu at the button "New custom field" and can select "Hidden".

Rootiest ,

Oooh thank you!

Can’t believe I missed that

gentoo_biscuit ,

I’m on Bitwarden right now and have been thinking of switching to KeePass. My issue keeping me from actually switching is the convenience factor. Can’t imagine making it even more annoying to use for my SO

nyar ,

You can have keepass on a USB drive, an exe version that doesn’t require install, along with your db.

Rootiest ,

You sure can.

But that’s not perfect.
Often businesses will lock down their computers to prevent unauthorized software from running at all, not just installing.

nyar ,

And not lock down random external sites they see a user visiting every day that aren’t related to their work functions? Sounds like the SOC needs to get better at their monitoring.

dan ,
@dan@upvote.au avatar

In my experience, locking down non-work sites is much less common than locking down USB devices and unknown executables. USB devices and random executables are more of a security risk as a USB drive can be used to exfiltrate data very quickly while an executable could contain ransomware, other malware, keyloggers, etc. Sites are sandboxed and limited in terms of what they can do.

Rootiest ,

Like the other commenter said, typically websites are less locked down.

It’s simpler to sandbox the browser and prevent unauthorized software from running than to block out most of the Internet and deal with complaints all day about the web restrictions

Thorned_Rose , (edited )
@Thorned_Rose@kbin.social avatar

I used to use Keepass (thanks person who said keep ass, I can't not see that now) for many years but started to get frustrated with stuff not syncing properly and a few other reasons I can't remember anymore. But I think I'll have to give it a go again. I've been using Enpass for a number of years and it's been good but I've never liked that it's closed source.

ebits21 ,
@ebits21@lemmy.ca avatar

Just depends what you use for syncing since keepass doesn’t sync itself.

Syncthing is obviously popular.

Thorned_Rose ,
@Thorned_Rose@kbin.social avatar

It's been years and I have Memory Impairment so I'm not sure but I think part of the issue with syncing was that we had a 'family' database which made for multiple devices and several people needing to sync that while frustrating at times was OK, until we had an episode of data loss that just killed it for us. Enpass had built in sync, a nicer UI, more features and jut more cohesive across devices.

But again, my memory is very fuzzy and it's worth looking into again because as good as Enpass is, it's not open source.

RootBeerGuy ,
@RootBeerGuy@discuss.tchncs.de avatar

Maybe a silly question, but since I am considering making the jump to a password manager too, I am curious:

If I have a selfhosted server at home that is not connected to the public internet, can I still ise Keepass? Does it have to constantly sync with the server or is it enough that when I get home my passwords are syncing? Could that be a problem?

Clearwater , (edited )

I use KeePassXC, but am assuming KeePass is very similar.

You’ll have a single file on your machine that is your encrypted password database. Syncing is not handled by KeePass and is your responsibility.

If you want to sync only when you get home, as long as your app to manage that is fine with it, KeePass won’t know or care.

Keep in mind if you make changes on two devices without keeping them in sync, one will probably get overwritten unless you take special care to handle it. (My sync app warns me, then I take both conflicting files and in the KeePass app, I can merge them to solve the conflict without data loss.)

zeluko ,

Ideally keypass would allow handling such conflicts internally.
Thats the big disadvantage of a single-file approach.

Could easily be avoided e.g. sync whole folder and now you can have multiple files, e.g. 1 write file per program used.

clmbmb , (edited )

You have your local replica of the database on your device and once you’re home or can connect to your home server (through VPN, for example) it will sync with the remote database. I used to have synthing running for this and it worked without issues.

nx2 ,

If your server is not “online” you could vpn into your home network and use it that way. Another option is to have it local, meaning for example with bit/vault-warden you can still view your passwords if you don’t have connection. But you can’t edit or add new ones

BaalInvoker ,

I use KeePassXC on my laptop, KeePassDX on my phone and sync them with Syncthing.

This ia pretty sweet

AlexSup21 ,

I have the same setup. It’s really neat.

dbilitated OP ,
@dbilitated@aussie.zone avatar

it’s so good, wish I’d found it sooner

hottari ,

Exactly the same thought I had when I ditched Bitwarden for it. In my case, the transition was made even easier as I was already using Syncthing on my devices.

JubilantJaguar ,

Not bothered about the potential for keyloggers or even OS-level snooping on what is presumably your privacy-free Android device? Personally I would never type the master password into anything other than a computer running a FOSS stack that control, but perhaps that is excessive caution.

BaalInvoker ,

Well, there is a limit to my paranoid. It’s really hard to find a sweet spot between security and practicality.

I found mine with this settings I said

BlinkerFluid ,
@BlinkerFluid@lemmy.one avatar

Keepass clients typically have biometric input… and let’s not pretend you don’t need to type in your vaultwarden password in Android on the first run, either.

You could use a usb-c passkey but I know that’s not the majority use case.

JubilantJaguar ,

So, biometrics, master password, and USB key - 3 whole options and 3 things I personally will never be letting near Android. Unwarranted caution, no doubt.

hayalci ,

keepass2android is worth a try as well.

shadowbert ,
@shadowbert@kbin.social avatar

I personally prefer bitwarden, using a self-hosted vaultwarden. It's free, it syncs, it's easy to use.

techognito ,
@techognito@lemmy.world avatar

Passphrase generator, simplelogin/addy.io integration and sync.

This makes my life so much easier.

InvertedParallax ,

Same, and the apps work great.

bazmatazable ,

I recently made the switch to Vaultwarden when I read a series of articles making predictions about passkeys and how they are lining up to replace passwords. Bitwarden apparently is ready to implement whatever standard becomes most popular and I had FOMO of being left behind if I stuck with keepass only. Previously I was using various keepass compatible apps and then syncing the KDBX database with my Nextcloud. (Vaultwarden is the selfhosted fork of Bitwarden)

lue3099 ,
@lue3099@lemmy.world avatar

Vaultwarden isnt a fork because bitwarden isn’t selfhostable. Bitwarden has an official selfhosted version. Vaultwarden is a lightweight rust version of the backend. As the selfhosted version by bitwarden is quite fat. Vaultwarden uses the official webapp of the webvault in their fork.

thirdBreakfast ,

Love KeePass, I use it to store all my passwords including to SyncThing, then I keep my KeePass file in my SyncThing instance so I can recover from a disaster. Definitely nothing could go wrong with that ;-)

ensignrick , (edited )
@ensignrick@startrek.website avatar

What’s amusing is I am purposely not paying for bitwarden because of the check against darkweb leaks or whatever type feature when you pay. That’s seems like an anti privacy thing. I understand it’s a good idea albeit seems to expose a lot of information about you. I would like to do vaultwarden but don’t think I can trust self hosting myself without paying monthly for a vps which I don’t want to do. Home Internet hosting seems to unreliable to me for something that important.

Just random thoughts of mine here.

skilltheamps ,

The bitwarden clients also work when there’s no connection to the server, since they sync the vault. You just can’t add any new entries. That means spotty internet is not that much of an issue in terms of using it. It also means, that every device that has a client installed and gets used regularly (to give the client a chance of syncing) is automatically a backup device.

hottari ,

Follow OP’s approach. Use a Keepass file. It is offline and can be stored anywhere you can reasonably trust. You just need to sync it if you have many clients but syncthing is great for that.

ensignrick ,
@ensignrick@startrek.website avatar

Yep I’m very impressed with syncthing. I just started using it a few weeks ago.

bear , (edited )

because of the check against darkweb leaks or whatever type feature when you pay. That’s seems like an anti privacy thing. I understand it’s a good idea albeit seems to expose a lot of information about you

For the password leak checks, your passwords are never transmitted. They are one-way hashed locally, and then only the first few characters of the hash are checked against the API provided at haveibeenpwned.com which is run and designed by Troy Hunt, one of the most respected people in the cybersecurity industry. He collects major password breaches and makes them available to check against without actually exposing the data. It’s perfectly safe and secure.

Limit ,

I host vaultwarden at home. No real need for a vps since your passwords are synced to your phone or laptop(whatever client you’re using) and you can just sync it when you’re home if you make changes, or setup a VPN (I use wireguard) and sync on demand when needed.

That said, I do sync my database to a vps for dr purposes incase my home server suddenly vanishes… for critical services I follow a 3-2-1 backup rule but it’s not absolutely essential.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • [email protected]
  • lifeLocal
  • goranko
  • All magazines
    •