Reevaluating my password management

[email protected]

It never made sense to me to put password managers in the cloud. Regards to what you intend it to do, you’re making it accessible to a wider audience than necessary. And yet, I’m using iCloud. It’s time for a change.

I’m thinking of just running a locally hosted password manager on my home server and letting my devices sync with it somehow when I’m at home. I have a VPN into my home network when I’m away that automatically triggers when I leave the house, so even that’s not that big an issue, but I’m really not familiar with what’s gonna cleanly integrate with all my stuff and be easy to use. All I know is I wanna kill the cloud functionality of my setup.

I already have a jellyfish server so I figured I would just throw this onto that. Any suggestions?

[email protected]

Seafile or nextcloud

[email protected]

I use keepass (KeepassXC on desktop, KeepassDX on Android but I'm sure there is an IOS client too)
I sync the database between all my devices and my server (hub and spoke) with Syncthing

[email protected]

If you’re happy with how Apple Password works for you, I can recommend StrongBox. It keeps all data in a KeePass2 database and integrates into Apple’s AutoFill API. That means it feels almost native when using it. No browser plugin needed. (At least not for Safari.) And you can decide how you sync the database file.

[email protected]

Is the data super important to you?

Let someone else host it.

~~Bitwarden in the cloud.~~

Edit: Bitwarden paying the monthly/yearly fee to BW. I wasn’t implying trying to host it yourself in the cloud.

[email protected]

i have keepass on only one device. i don't mind looking up individual passwords and typing them in manually when on other devices.

on the device which hosts keepass, the app is hidden and hoops must be jumped to reach it.

i back up the encrypted password database once a month to a cloud service as insurance against me losing that one device.

it's not the most convenient setup but i sleep so much easier for it.

[email protected]

I've been using various versions of keepass for ever. Until recently I had the database on Google drive. It's now local and sync'd with syncthing. It's a bit "different", but once you get used to it, it works very well.

[email protected]

This is how I view password managers too, even though I have my home server backing up

[email protected]

just have 1 password for everything, problem solved.

[email protected]

Self hosting a password manager is great, but be sure to read up on keeping it secure, and don’t store anything important in it until you have working, tested backup solution. And re-test it frequently in a non-destructive way.

If you lose your password storage to a disk failure or something, you’re gonna be hurting for a while.

[email protected]

I don’t really see the problem with having the password manager in the cloud if it is protected by 2FA. I tried vaultwarden (self hosted) about a year ago and the showstopper was that I couldn’t store a new password when off LAN or without first connecting the VPN. I am sure there are on demand vpn type services, but it was clunky. It would have been great it if would work locally on the phone then sync the password to the vault when it came back online

[email protected]

Agreed. Unless your setup and security practices is flawless, I think passwords are better managed by specialists paid for it.

[email protected]

If you don't have a hard requirement of it being fully (!) OpenSource, then I would recommend Enpass. Relatively pleasing UI that runs native on Win, Mac, Linux, Android and iOS. It has browser plugins for Chrome and Firefox that talk directly to the running fat client (so no multiple authentication with different browsers necessary).

The password db is completely local, but it offeres several sync mechanisms like WebDAV or Dropbox or also iCloud; basically whatever can store files. If it's a NAS in your home, it simply will sync once you are back home.

It also offers "WiFi Sync", in which case you designate one machine running Enpass as the server and link other clients to it, then you don't even need to run a separate hosting for it (but that machine needs to be on and running Enpass when you want to sync, obviously).

It's basically a less open but much more convenient and beautiful KeePass(XC).

[email protected]

Been usingthe same setup for years as well and Im happy with it, never had any issues with it

[email protected]

Well, not wrong that it solves the problem, but with data breaches happening frequently, I wouldn't want to repeat 1 single password for all services lol.

Even if companies hash passwords, it's still a gamble whether they are using an up-to-date hash algorithm (or if they do even hash it, lol). Plus, generally best to avoid exposing passwords, hashed or not, in the first place.

[email protected]

+1 to this; Time spent on your setup is an important factor too.

The more important your data is, the more time you are going to need to spend maintaining your system to ensure security, backups and fail-overs. Not everyone has luxurious amount of time to spend on their home-lab everyday.

[email protected]

Why not use KeepassXC? It's a completely local encrypted db but it integrates with cloud storage apps like nextcloud for sync. It has plugins for integration with Firefox and KeepassAndroid is pretty smooth on the current Android OS.

[email protected]

It's strange how I never see this mentioned anywhere, but there's a way to get unique secure passwords for every site/app without needing to store them anywhere. It's called LessPass, and essentially generates passwords based on 3 fields (site, username, master password) and works relatively well, because the advantages are quite obvious I'll list the potential downsides:

If one password is compromised or needs changing for whatever reason you need to increase a counter and need to remember which counter for which site (this is less problematic than it sounds, except in places that have a password policy that forces you to change your password periodically)
Android can store the master password and use fingerprint to input it, but in PC you always have to type your master password which can get annoying.
You need to change your passwords to this new format, which can take a while, and years down the line you're trying to login somewhere and don't remember if you've already migrated it or not.

[email protected]

I also use KeepassXC and Synthing together and I am very happy with this combination.

One tip that I have, if you are worried about the security of the database file being shared, is to get 2 Yubikeys and use these, along with a strong passphrase, to protect the database file.

[email protected]

I used enpass for years and was a happy user. one day it prompted me for some re-authentication bullshit security theater. although in that instant it was an easy task, took me all of 10 seconds, it demonstrated a scary amount of power they had as I couldn't bypass it and access my data. from that point on, its days were numbered.

the second issue is the export functionality that was seriously lacking and I had to resort to 3rd party converter tools to convert it to keepassXC; no way that flew by their QC, it had to be intentional.

agnos.is Forums

Reevaluating my password management