8 ms·
KeePass users continue to live the stress free live. I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own i
by mobeigi 5mo ago
KeePass users continue to live the stress free live.
I've managed to avoid several security breaches in last 5 years alone by using KeePass locally on my own infra.
- 1024kb 5mo agoI need my passwords to be accessible from my infrastructure and my phone. How do you achieve this with KeePass? I assumed it was not possible, but in fairness, I haven't really gone down that rabbit hole to investigate.
- piperswe 5mo agoSyncthing can synchronize Keepass files between devices quite well.
- jasonjayr 5mo agoI rely on this too, but counting down the days android no longer lets syncthing touch another app's files :(
- piperswe 5mo agoIt would be strange if Android locked that down further than even iOS - Keepassium on iOS can open files from any sync app IIRC
- antiframe 5mo agoI never enjoyed the Android syncthing experience, so I just plug my phone in once a month and manually copy the vault over. I don't ever edit on my phone, so I don't need two-way syncing.
- alcazar 5mo agoWhat happens if you add a new item on two devices simultaneously?
- 63stack 5mo agoIt renames one of them to $hostname_conflicted, or something like that. Keepass has a built in tool for reconciling two databases, you can use that in this scenario.
- prmoustache 5mo agoWhy would you do that? By the way, syncthing can manage conflicts by keeping one copy of the file with a specific name and date. You can also decide is one host is the source of truth.
- Matl 5mo agoI mean there are ways i.e. if you run something like tailscale and can always access your private network etc. but it is a hassle. Plus, now you're responsible for everything. Backups, auditing etc.
- worble 5mo agoKeepass is just a single file, you can share it between devices however you want (google drive, onedrive, dropbox, nextcloud, syncthing, rsync, ftp, etc); as long as you can read and write to it, it just works. There are keepass clients for just about everything (keepassxc for desktops, keepass2android or keepassdx for android, keepassium for iphone).
- aborsy 5mo agoHow is the quality of browser extensions compared to Bitwarden?
- worble 5mo agoI don't have any points of comparison since I've never used Bitwarden, but it works well enough for my purposes. It'll match the url, offer to autofill (sometimes those multiflow sites like Microsoft will trip it up, but you can always just right click -> enter username/password for a site and that'll work), and it does TOTP filling too.
- prmoustache 5mo agoYou don't use a browser extension if you are serious about security anyway.
- gck1 5mo agoHow do you autofill from your db then?
- prmoustache 5mo agoI don't autofill. It may be less user friendly but it is not that big of a deal.
- nathanmills 5mo agoI don't save browser cookies for obvious privacy reasons and it's absolutely a big deal to not need to pull up some program and copy paste my login details constantly for every site.
- thepill 5mo agoFor me it is nextcloud + wireguard
- yolo_420 5mo agoNot op but I mean you can use a public cloud with Cryptomator on top if you don’t trust your password DB on a non E2E cloud. Or you can just use your own cloud (but then no access outside or can risk and open up infra), and then any of the well known clients on your phone. Can optionally sandbox them if possible and then just be mindful of sync conflicts with the DB file but I assume you, like most people, will 99.9% of the time be reading the DB not writing to it.
- kay_o 5mo agoAvoid Onedrive btw - it thinks encrypted files are ransomware; previous use resulted in nonstop ransomware warnings after cryptomator use
- walrus01 5mo agoIn short, when I make a major password or credential change I do it from my laptop, consider that file on disk to be the "master" copy, and then manually sync the file on a periodic basis to my phone. I treat the file on the phone as read-only. Works fine so far. To date there have been zero instances when I needed to significantly change a password/service/login/credential solely from my phone and I was unable to access my laptop. Additionally the file gets synchronized to a workstation that sits in my home office accessible by personal VPN, where it can be accessed in a shell session with the keepass CLI: https://tracker.debian.org/pkg/kpcli https://tracker.debian.org/pkg/kpcli You can use an extremely wide variety of your own choice of secure methods for how to get the file from the primary workstation (desktop/laptop) to your phone.
- xienze 5mo agoI use self-hosted Bitwarden (Vaultwarden) for this. It runs on my local network, and I have it installed on my phone etc. When I’m on my local network, everything works fine. When I’m not on my local network, the phone still has the credentials from the last time it was synced (i.e., last time it was used while the phone was on the home network). It’s a pretty painless way to keep things in sync without ever allowing Bitwarden to be accessible outside my home network.
- salt6763 5mo agoBitwarden does not let you create credentials while not connected to a server. Its a "read only" copy. There is an alternative client called keyguard that allows you to create or modify credentials, then sync to the server later.
- mrWiz 5mo agoI use MacOS and iOS for home home devices and Windows for work, and use Strongbox on the Apple side with KeePassXC on the Windows side and sync them using DropBox.
- SV_BubbleTime 5mo agoSomeone is about hop on and tell you how they simply run a Dropbox/GDrive to host their keepass vault and how that’s good enough for me (which should be Keepass’s tagline) and mobile they use a copy or some other manually derived and dependency ridden setup. They will support ad hoc over designed because their choice of ad hoc cloud is better than a service you use.
- Ukv 5mo ago> and how that's good enough for me I'd go further than that and say for me personally, the fact it's just a file is a selling point, not a "good enough" concession. I can just put passwords.kdbx alongside my notes.txt and other files (originally on a thumbdrive, now on my FTP server) - no additional setup required. There will be people who use multiple devices but don't already have a good way to access files across them, but even then I'm not fully convinced that SaaS specifically for syncing [notes/passwords/photos/...] really is the most convenient option for them opposed to just being a well-marketed local maximum. Easy to add one more subscription, easy to suck it up when terms changes forbid you syncing your laptop, easy to pray you're not affected by recurring breaches, ... but I'd suspect often (not always) adds up to more hassle overall.
- afavour 5mo agoWhich is great for Hacker News users that can maintain their own infra. But if we're talking "stress free", that's not an answer for the average user...
- NoMoreNicksLeft 5mo agoThe average user is reusing their password everywhere, and rotation means changing the numeral 6 at the end of the password to 7.
- NegativeK 5mo agoWe should be encouraging those users to switch to a password manager.
- NoMoreNicksLeft 5mo agoI do when I can, but there's a learning curve, and the rest of the world is trying to move those users in a very different direction (passkeys and other bullshit). Password habits for many people are now decades-old, and very difficult to break.
- kelvinjps10 5mo agowhat "infra"? keepass works locally, and just opens a database file. it works the same as any other password manager.
- afavour 5mo agoMost other password managers have a cloud component so if your local storage breaks or gets lost you don't lose all your passwords.
- pregnenolone 5mo ago> KeePass users continue to live the stress free live. https://cyberpress.org/hackers-exploit-keepass-password-manager-to-distribute-malware/ https://cyberpress.org/hackers-exploit-keepass-password-mana...
- baby_souffle 5mo agoHappy 1password user for more than a decade. It's only a matter of time until _they_ are also popped :(.
- hypeatei 5mo agoThat's an AI slop article. I'm not sure how someone creating their own installer and buying a few domains to distribute it is a mark against KeePass itself. > The beacon established command and control over HTTPS
- derkades 5mo agoThis AI generated article is not about vulnerabilities in KeePass, rather about malicious KeePass clones.
- pertique 5mo agoThis article is borderline malicious in how it skirts the facts. This wasn't a case where KeePass was compromised in any way, as far as I can tell. This appears to be a basic case of a threat actor distributing a trojanized version via malicious ads. If users made sure they are getting the correct version, they were never in danger. That's not to say that a supply chain attack couldn't affect KeePass, but this article doesn't say that it has.
- dspillett 5mo agoThat looks like you'd have to download and run a hacked installer that was never avaliable from an official location. That is a much lower risk than a supply-chain attack where anyone building birwarden-cli from the official repo would be infected via the compromised dependency. Long term keepass users aren't going to be affected. If you mention software to others make sure you send them a link to a known safe download location instead of having them search for one (as new users searching like that are more at risk of stumbling on a malicious copy of the official site hosting a hacked version).
- kelvinjps10 5mo agothe only thing I can't find to do with keepass is how back up it in the cloud, like if you encrypt your back up, then where do you save that password, then where do you save the password for the cloud provider?.
- hootz 5mo agoYou save the single password in your head. All other passwords go inside Keepass.
- kelvinjps10 5mo agoso for example I use backblaze bucket or whatever, just use the same password as keepass?
- eipi10_hn 5mo agoSame as Bitwarden? You just need to remember Keepass password, just like remember Bitwarden password.
- kelvinjps10 5mo agono, I mean, for example, I save my backups in Backblaze S3 buckets, with rclone, there is the Backblaze password, the rclone password for the backups, and finally the password for keepass itself. Where do I save the 2 previous password, I either have to memorize all 3. Or make it the same password for all of them. For bitwarden I only need to know the master password itself. if I want to have cloud backups
- Perz1val 5mo agoOk, single file, blah, blah. Realistically how do you sync that and how do you resolve conflicts? What happens if two devices add a password while offline, then go online?
- eipi10_hn 5mo agoI actually was a Bitwarden user at first, but over time in reality the frequency that I change email/password is not that much. It's not like I change those things every hour or every day like with my work files/documents and need constant syncing to the drive. And the chance that I add/change passwords at 2 devices at a close time is even less. So gradually I don't feel I need syncing that much any more and switched to Keepass. I made my mind that I'll only change the database from my computer and rclone push that to any cloud I like (I'm using Koofr for that since it's friendly to rclone) then in any other devices I'll just rclone pull them after that when needed. If I change something in other devices (like phones), I'll just note locally there and change the database later. But ofc if someone needs to change their data/password frequently then Bitwarden is clearly the better choice.
- gbalduzzi 5mo agoI don't understand how this solves the issue in this case. Bitwarden vaults were not compromised, there was a problem in a tool you used to access the secrets. What makes it impossible for KeePass access tools to have these issues?
- john_strinlai 5mo ago>What makes it impossible for KeePass access tools to have these issues? the superiority of keepass users scares away the bad actors
- d3Xt3r 5mo agoIt's not impossible, but most KeePass tools are written in sane languages and built with sane tooling, and don't use trash like Javascript and npm. Of course I'm not considering browser extensions or exclusive web-clients, but the main KeePass client has a good autotype system, so you don't really need to use the browser extension. In any case, the fact that the official BitWarden client (which uses Electron btw) and even the CLI is written in Javascript/Typescript - should tell you everything you need to know about their coding expertise and security posture.
- lousken 5mo agoFully agree, I can't wait for the day when developers finally stop using javascript for shit it was never designed for. .NET is decades ahead at this point.
- prmoustache 5mo ago> I don't understand how this solves the issue in this case. I'd say since it is a local only tool, you don't really need to update it constantly provided you are a sane person that don't use a browser extension. It makes it easier to audit and yourself less at risk of having your tool compromised. It doesn't have to be keypass though, it can be any local password management tool like pass[1] or its guis or simply a local encrypted file. [1] https://www.passwordstore.org/ https://www.passwordstore.org/