Comment on Concerns Raised Over Bitwarden Moving Further Away From Open-Source

ocassionallyaduck@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

• druidjaidan@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

  This is incredible Image

  Right next to each other lol

  source

  • Cris_Color@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

    Syncthing fork seems to still be under active development

    source
• cyberwolfie@lemmy.ml ⁨4⁩ ⁨weeks⁩ ago

  Was going to be my solution as well, bjt Syncthing-Android just got discontinued.

  source

  • ocassionallyaduck@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

    F-Droid syncthing-fork is still actively developed and had a patch in the last few weeks.

    So hopefully this isn’t the end.

    source
  • _edge@discuss.tchncs.de ⁨4⁩ ⁨weeks⁩ ago

    What? I need syncthing-android, where is it going?

    source

    • ocassionallyaduck@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

      F-Droid syncthing-fork is still actively developed and had a patch in the last few weeks.

      source

      • _edge@discuss.tchncs.de ⁨4⁩ ⁨weeks⁩ ago

        Good to know

        source
• Routhinator@startrek.website ⁨4⁩ ⁨weeks⁩ ago

  I’ve always loved Keepass, however I moved away from it in 2012 as it any file based vault has brute forcing issues. You need to track every copy of it that has been made and if any copy falls out of your hands, like if you loose a device, you need to do a password rotation on 100% of your passwords. Since its a file, its not possible to prevent brute forcing.

  source

  • Telodzrum@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

    everything’s a file

    source
  • ocassionallyaduck@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

    An online database is still a file ultimately. A SQL or other DB file stored in a webserver, accessed through a web interface.

    Vaultwarden, etc, are the same, only the database file is less directly visible IMO. Keepass IMO is simple. The DB in a bespoke format, stored outside the application.

    You could put the vault in system32 and name it “trustedinstaller.log”, and if someone saw you had keepass they wouldn’t even know where your vault is.

    Given the number of well documented breaches of online password vaults, I would much rather do a private device to device sync via syncthing and keep it out of webservers.

    source
• prosp3kt@lemmy.dbzer0.com ⁨4⁩ ⁨weeks⁩ ago

  I was thinking the same. But, it is safe to share the password database like this?

  source

  • ocassionallyaduck@lemmy.world ⁨4⁩ ⁨weeks⁩ ago

    Syncthing is encrypted transfers.

    The database is encrypted.

    And you can set it to not use relays for data, only matchmaking between your own devices.

    So it’s an encrypted file, encrypted again, and sent directly from an IP you own to an IP you own.

    source
  • GhiLA@sh.itjust.works ⁨4⁩ ⁨weeks⁩ ago

    Consider the possibility that someone could get your database.

    It isn’t a safe. You can’t weld through the side of it and get in. You either make it ridiculous or impossible to get in.

    Use something memorable, but insane.

    My password is a three-line film quote with numbers in some of the places for letters.

    Haikus work great. Memorable, complex. Wrote it yourself? Even better.

    source