Comment on You probably can't trust your password manager if it's compromised
DeathByBigSad@sh.itjust.works 1 week ago
Keepass, upload the database file to random free cloud accounts after making changes to the database.
This is foulproof as long as the end-user device doesn’t get hacked, right?
Yes and no. You can store them in a free cloud account, provided you have local copies; there’s a risk your access to the cloud storage could be denied. A security risk is that they could harvest these databases, and decrypt them later.
I think your best bet, if you were to use free services, is to delete old databases from the cloud. Encrypt the new databases with the updated password manager and a new master password.
Why would you do that? Just sync thr database with Syncthing and keep it locally on your devices. I’d never put my pw dB in a publicly available cloud online, even though it’s encrypted.
For backup.
So all of my hard drives and devices are in the same house, if I was sleeping and and house caught on fire and I couldn’t even get my phone in time (just a worst case example), then I lose all my passwords.
Cloud is my “offsite backup”. Cuz where else would I put stuff?
I see. For this scenario, I have another Syncthing server, which is on 24/7, responsible for offsite backups.
Ad encrypted files: true, but why expose them to a potential adversary? If there should be a flaw in the encryption (now or future) the other party already has access to the file.
midribbon_action@lemmy.blahaj.zone 1 week ago
This is terrible advice, even if I assume you are also using a key-file on a removable usb. An attacker can brute force decrypt your db. There is no rate limiting when you literally have the database file, they could replicate it across thousands of servers each with dozens of cores, each core trying a dozen keyphrases per second. That’s assuming a motivated attacker like a government or crypto scammers, but why open yourself to that possibility?