My new favourite password manager

I’ve always hated the idea of using a subscription/cloud hosting for password management. I feel like I should have a LOT more control over that stuff and I don’t really want to hand all my keys over to a company.

All my secrets have been going in a highly encrypted archive with a long passphrase, but obviously that isn’t convenient on all devices. It’s been fine, I can open it on any computer but it’s not super quick. It does have the advantage of being able to put in multiple files, notes, private keys but it’s not ideal.

Anyway, finally found something that isn’t subscription, and has a similar philosophy - a highly encrypted archive file, and it’s open source and has heaps of clients including web browser plugins so it’s usable anywhere, and you can sync the vault with any file sync you like.

Thought you guys might appreciate the find, password managers have always been a bit of a catch 22 for me.

Note for android i found keepassxc the best app, and i’m using KeePassHelper browser plugin, and the KeePassXc desktop app as well as the free official one. Apps all seem to be cross platform.

I installed KeePass(XC) on Android, iOS, Windows, Linux, Mac, for Firefox and Chrome and it’s all synced via encrypted cloud share. It even has OTP functionality so you don’t have to manually type 2FA codes.

Whats it called on ios? Keepassium?

I don’t have an iPhone but I set it up for a family member. I remember we tried out two apps because the first one didn’t have what we needed. One of them was Keepassium, but I don’t remember of it was the one we kept.

There’s also Strongbox available for ios

KeePassium and Strongbox are both great.

Strongbox is rather expensive if you pay and missing too much if you don’t pay imo. I use KeePassium.

If you keep the database in the cloud I recommend using a keyfile in addition to the password which is NOT kept in the cloud.

Very secure that way even if your cloud account is compromised.

I keep TOTP in a separate database.

I prefer the KeePassXC fork as it’s written in C++ and not C# so it has better native integration with OSes like Linux, but yeah these are really good solutions with no subscription requirements or necessity to upload to any cloud service.

written in C++ and not C# so it has better native integration with OSes like Linux

What do you mean exactly?

it’s written in C++ and not C# so it has better native integration with OSes like Linux

Not sure what you mean by this. Any APIs that can be called from C++ can also be called from C#. C# apps run natively on Linux, and they support self-contained deployment and native AOT (ahead of time) compilation meaning they can run on any Linux system even if it doesn’t have the .NET Core framework installed.

This thread is about KeePass and my comments relate to that. If you pull KeePass2 from the repos in Debian, for example, it’s going to pull the Mono runtime to execute it as well because it’s been built, like most C# apps, for JIT compilation. I doubt it’s even possible to compile KeePass2 using AOT compilation.

This is what the C# KeePass application looks like using the Mono runtime in Debian:

This is KeePassXC:

You can see which has better native integration into the desktop out of the box.

s in Debian, for example, it’s going to pull the Mono runtime to execute it as well because it’s been built, like most C# apps, for JIT compilation.

.NET Core handles JIT compilation file. It looks like the KeePass developers have not yet updated it to use .NET Core though, which is why it’s pulling Mono in.

KeePassXC definitely looks nicer, but it’s definitely possible to do that with C# too. The KeePass developers just haven’t kept up with modern .NET.

Yup, I have been using KeePassXC locally since (one of) the first big LastPass breaches. I thought “password manager company… they know encryption” and then kept some of the most important things stored in my vault including notes of Bitcoin seedphrases etc. Thought "even if they get hacked, they wouldn’t let anyone exfil the huge amount of data from the USER VAULT SERVER… thought “my passphrase is like 25-30 chars long, nobody will crack that”…

5 years after my last login and I find out the breach happened, user vaults were exfil’d, the encryption was absolute shit, and the notes weren’t even encrypted.

I don’t trust cloud companies to keep promises or know what they’re doing today. and anything self-hosted isnt Internet accessable unless it’s on dedicated hardware subnetted off and wouldn’t matter if it got hacked.

In theory at least, online services would be more safe than a locally decrypted vault. If your computer is compromised, the bad actors can pull your encrypted vault for an unlimited brute force attack. Of course, this can be mitigated by increasing the decryption time. However, if your vault is already decrypted, then bad actors can just pull all your password from your memory.

I, for one, am decrypting my vault once when I start my PC. In theory, if I were to use an online solution, bad actors wouldn’t be able to pull my vault from memory.

In theory, if I were to use an online solution, bad actors wouldn’t be able to pull my vault from memory.

It’s the same issue once you login to your vault via browser extension. They have to download your vault locally on login to decrypt it when you enter your password anyway*. Even if they don’t store your vault password in memory, they either store the entire vault (unlikely for size reasons) or a more temporary key to access the vault. Local compromise is full compromise already.

*If they don’t, then they either made a giant technological leap, or they’re storing your passwords on a simple database on their servers and that’s not what you want from a password manager.

Bitwarden for example does public reports and is pretty cheap at 10€ per year. But the base (free) offering is more than enough. The fee is only to have TOTP and a bit of encrypted cloud storage. https://bitwarden.com/help/is-bitwarden-audited/

The fee is only to have TOTP and a bit of encrypted cloud storage.

And to keep the company alive. It’s cheap enough that IMO it’s worth paying for if you get a lot of value from it, even if you don’t need the paid features.

I cannot stop reading it as keep ass

It keeps your ass out of negligence I’d say

Girlfriend at the time noticed this on my phone and had some choice questions for me.

That’s half the fun, well actually it’s a utilitarian app so pretty much all the fun

Well you don’t want your ass took, at least not without permission.

Why did people stop using notepads (actual physical ones) for this? No digital storage, no leaks. Besides, after a couple of times you get the muscle memory of typing in the passwords anyway.

My password manager contains about 600 passwords by now. I use 30+ passwords on a daily basis for work (IT industry) so no chance in hell that I’ll remember half of those. And the ones I need maybe once a year?? Good luck without a manager.

I have a different password for each service I use. Each password is 30+ characters long and completely random with letters, numbers and special characters. There’s no way I could remember any of them and they’d be a hell to type out manually. I use KeePass on every device I own and it’s synced over my NAS. So it’s super convenient and no risk for leaks.

I did this, stored in an encrypted container, for a long time. Problem is it’s not scalable unless you start reusing passwords across different sites and services, which is itself a terrible practice.

Switched to Bitwarden (self hosted) several months ago and am very happy with it.

Try to remember (2m(&$9hso2 Ok_(#
We will see how fast you can remember that after a long and mentally exhausting work day :)

I’m using randomly generated 64-character passwords with upper/lower-case letters, numbers, and symbols.

I prefer not to manually enter them every time.

Also someone could find and photograph your notepad and then all your passwords are compromised in one go.

Tell me you use the same password everywhere without telling me you use the same password everywhere

And they’re very likely way too short

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.

Rules:

Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

My new favourite password manager(keepass.info)

Selfhosted

!selfhosted@lemmy.world

Community stats

Community moderators