Comment

Comment on Concerns Raised Over Bitwarden Moving Further Away From Open-Source

Routhinator@startrek.website ⁨3⁩ ⁨weeks⁩ ago

I’ve always loved Keepass, however I moved away from it in 2012 as it any file based vault has brute forcing issues. You need to track every copy of it that has been made and if any copy falls out of your hands, like if you loose a device, you need to do a password rotation on 100% of your passwords. Since its a file, its not possible to prevent brute forcing.

source

Sort:hotnew top

Telodzrum@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
everything’s a file

source
ocassionallyaduck@lemmy.world ⁨3⁩ ⁨weeks⁩ ago
An online database is still a file ultimately. A SQL or other DB file stored in a webserver, accessed through a web interface.

Vaultwarden, etc, are the same, only the database file is less directly visible IMO. Keepass IMO is simple. The DB in a bespoke format, stored outside the application.

You could put the vault in system32 and name it “trustedinstaller.log”, and if someone saw you had keepass they wouldn’t even know where your vault is.

Given the number of well documented breaches of online password vaults, I would much rather do a private device to device sync via syncthing and keep it out of webservers.

source