Comment on Google Says Sorry After Passwords Vanish For 15 Million Windows Users.

admin@lemmy.my-box.dev ⁨1⁩ ⁨month⁩ ago

• Wistful@discuss.tchncs.de ⁨1⁩ ⁨month⁩ ago

  Keepass XC on PC, Keepass DX on Android, Syncthing to sync database

  Works flawlessly!

  source

  • nekusoul@lemmy.nekusoul.de ⁨1⁩ ⁨month⁩ ago

    Most amazingly, this setup is also unexpectedly resilient against merge conflicts and can sync even when two copies have changed. You wouldn’t expect that from tools relying on 3rd party file syncing.

    I still try to avoid it, but every time it accidentally happened, I could just merge the changes automatically without losing data.

    source

    • Shatur@lemmy.ml ⁨1⁩ ⁨month⁩ ago

      How did you enable merge conflict resolution for KeePassXC databases?

      source

      • nekusoul@lemmy.nekusoul.de ⁨1⁩ ⁨month⁩ ago

        Depends a bit on the clients.

        • KeePass: Will ask you if you want to synchronize/overwrite/discard the database when saving.
        • KeePassXC: Will autoreload the database in the background, so merge conflicts shouldn’t happen in the first place. Otherwise there’s ‘Merge database’ in the menu.
        • KeePass2Android: So I mixed up the names and this is the client I actually use. This one does all changes to an internal copy of the database that is then synchronized on request.

        source
      • PlexSheep@infosec.pub ⁨1⁩ ⁨month⁩ ago

        By ignoring the conflict files

        source
  • OfficerBribe@lemm.ee ⁨1⁩ ⁨month⁩ ago

    I store my DB in Dropbox and use KeePass2Android on phone which has built in Dropbox sync.

    source

    • Hexarei@programming.dev ⁨1⁩ ⁨month⁩ ago

      Yeah but then you have to trust Dropbox

      source

      • OfficerBribe@lemm.ee ⁨1⁩ ⁨month⁩ ago

        And I do, have used it for 10+ years I think. Keyfile is also used so even with leaked DB file and password, it should be inaccessible.

        source
• GissaMittJobb@lemmy.ml ⁨1⁩ ⁨month⁩ ago

  Bitwarden is probably a more pragmatic choice for most users, given that it’s free and without having to manage the syncing yourself.

  Any password manager is better than the alternative, though.

  source

  • 314xel@lemmy.world ⁨1⁩ ⁨month⁩ ago

    I’m not sure what you’re comparing it to. Keepass is free too, in fact it’s open source. Also, local software and database is always superior to cloud.

    But, I would say you can use any online password manager as long as it’s end to end encrypted, so Bitwarden is a good choice.

    source

    • evulhotdog@lemmy.world ⁨1⁩ ⁨month⁩ ago

      I think your bias may be showing. The average computer user doesn’t even think about using a password manager. It just exists and works in their browser.

      source
    • GissaMittJobb@lemmy.ml ⁨1⁩ ⁨month⁩ ago

      Also, local software and database is always superior to cloud.

      Now there’s an unfounded blanket statement if I ever saw one.

      source

      • Enoril@jlai.lu ⁨1⁩ ⁨month⁩ ago

        Statement related to previous cloud hacks i assume.

        Should have say: self-hosting is always superior to cloud hosting.

        Bitwarden (the client) + Vaultwarden (the self-hosted server) is a good combo if you have some knowledge on how to setup it.

        source

        • -> View More Comments
    • fmstrat@lemmy.nowsci.com ⁨1⁩ ⁨month⁩ ago

      No dislike for Keepass here, but I prefer Bitwarden. It’s also super easy to self host with Vaultwarden.

      source
• SaltySalamander@fedia.io ⁨1⁩ ⁨month⁩ ago

  Vaultwarden ftw

  source

  • GoJimi@lemm.ee ⁨1⁩ ⁨month⁩ ago

    Exactly! Self hosted FTW. Chances of a data breach… Typically pretty minor if you are smart.

    source

    • pennomi@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Chances of losing the data is higher with selfhosting too. Unless you’re doing some sort of multizone replication, or course.

      source

      • nialv7@lemmy.world ⁨1⁩ ⁨month⁩ ago

        I use syncthing so there’s a copy of my password database on each of my devices.

        source
      • communism@lemmy.ml ⁨1⁩ ⁨month⁩ ago

        I would rather lose my passwords than have my password database be accessed by someone else. Most websites have a “forgot password” function, and for passwords that don’t have that (e.g. to decrypt my hard drive or log into my computer) I’ve memorised the passphrase and always type it manually anyway. And for passwords where neither applies, it’s probably not a huge loss anyway if I’ve not prepared for the possibility of losing my password db for that particular password.

        source
      • GoJimi@lemm.ee ⁨1⁩ ⁨month⁩ ago

        Yeah. Daily and weekly cloud backups solve that for myself for sure.

        source
      • Lem453@lemmy.ca ⁨1⁩ ⁨month⁩ ago

        Borg backup to borgbase is not very expensive and borg will encrypt the data plus the vault is also encrypted

        source
      • ThePantser@lemmy.world ⁨1⁩ ⁨month⁩ ago

        I am hosting on Home Assistant which itself gets a backup to my Google drive and my personal machine. So there are two backups, as long as HA doesn’t create a corrupted backup 3 weeks in a row I am good.

        source
      • russjr08@bitforged.space ⁨1⁩ ⁨month⁩ ago

        As long as you’re still signed into BW from any of your devices, you can always export the vault from there.

        (But yes, actual backups are always a plus)

        source
    • Lem453@lemmy.ca ⁨1⁩ ⁨month⁩ ago

      Keep vaultwarden behind wireguard for local only access then also use https certs and good master password. Very secure like this

      source

      • francois@jlai.lu ⁨1⁩ ⁨month⁩ ago

        Why https if the traffic is already encrypted by the vpn?

        source

        • -> View More Comments
  • N1ghtstalk3r@lemmy.world ⁨1⁩ ⁨month⁩ ago

    +1 for a self-hosted Vaultwarden instance. If you’re technically capable and have extra hardware laying around this is the best way to go.

    source

    • TimLovesTech@badatbeing.social ⁨1⁩ ⁨month⁩ ago

      Although a backup is still required or you are gambling on hardware outliving your need for your data.

      source

      • Lem453@lemmy.ca ⁨1⁩ ⁨month⁩ ago

        Anyone with the knowledge to self host will quickly discover 3-2-1. If they choose to follow it, that’s on them but data loss won’t be from ignorance

        source
      • N1ghtstalk3r@lemmy.world ⁨1⁩ ⁨month⁩ ago

        100%. Make sure to follow the 3-2-1 backup rule with all things you do.

        source
• tabular@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Shoutouts to paper and pen.

  Keep the booklet in a safe place.

  source

  • admin@lemmy.my-box.dev ⁨1⁩ ⁨month⁩ ago

    If you never, ever need your passwords outside of your home, that’s great advice - it’s as secure as can be against digital theft. Less so against fire though, and backups are out of the question.

    source

    • Shdwdrgn@mander.xyz ⁨1⁩ ⁨month⁩ ago

      I just store all my passwords in robots.txt on my web server, makes it easy for me to access them anywhere I go…

      /s

      source
    • nous@programming.dev ⁨1⁩ ⁨month⁩ ago

      You can have backups of physical books. Just copy the text from one to the other. Yeah it is manual work but so is writing the first one in the first place. You can then store the second copy in a fire resistant safe or at a friends or family members house (maybe inside a safe as well).

      source
    • thejoker954@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Backups are easy? Just copy to another piece of paper and store somewhere else.

      I’m just being facetious though.

      source

      • admin@lemmy.my-box.dev ⁨1⁩ ⁨month⁩ ago

        I’m not being facetious though. Off-site backups of a digital password collection are easy to setup and maintain. But when you change your password or add a new entry, it’s going to be a pain in the ass to have to drive over and update a physical copy.

        If you can live with those downsides, that’s fine. But in my opinion it would be facetious to pretend a physical backup is “just as good/usable” as a digital one.

        source
    • lauha@lemmy.one ⁨1⁩ ⁨month⁩ ago

      I have a firesafe at home for important papers, passports and some emergency cash. I keep my passwords there.

      source
    • tabular@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Well you can write a copy and keep it in a shed if it’s unlikely to also catch fire.

      source
  • maccentric@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

    Typically, the drawer just below the keyboard (in my experience)

    source

    • slumberlust@lemmy.world ⁨1⁩ ⁨month⁩ ago

      If it’s my mother, post it notes stuck to the laptop…

      source
  • Ilovethebomb@lemm.ee ⁨1⁩ ⁨month⁩ ago

    This is the first suggestion here that’s actually within the technical abilities of most people, even most Lemmy users.

    The level of technical knowledge some of people here seem to think the general public has is absurd.

    source

    • tabular@lemmy.world ⁨1⁩ ⁨month⁩ ago

      I’m usually the one promoting technical literacy to all but in this case I honestly don’t use a password manager.

      source

      • Ilovethebomb@lemm.ee ⁨1⁩ ⁨month⁩ ago

        It’s honestly seemed like more trouble than it’s worth, there’s a few websites where I just reset my password every time.

        source

        • -> View More Comments
    • admin@lemmy.my-box.dev ⁨1⁩ ⁨month⁩ ago

      If getting a Dropbox account is too difficult for you, I seriously wonder why you’re subscribed here, or reading articles about password management in browsers.

      source

      • tamal3@lemmy.world ⁨1⁩ ⁨month⁩ ago

        We’re lost

        source
      • Ilovethebomb@lemm.ee ⁨1⁩ ⁨month⁩ ago

        Because I’m interested in tech news, especially since the world we live in can’t function without it.

        Besides, Lemmy seems to seriously overestimate the technical abilities of, well, most people.

        source
• suction@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Never trust your credentials to a private company, they could be bought out by state actors.

  source

  • Katana314@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Never trust your credentials to yourself, you can be bought out by beer, poor decisions, and tripping over the cables connected to your home server you cobbled together.

    source
  • CosmicGiraffe@lemmy.world ⁨1⁩ ⁨month⁩ ago

    The xz compromise having demonstrated that FOSS projects are totally immune to interference from state actors…

    source

    • suction@lemmy.world ⁨1⁩ ⁨month⁩ ago

      Right that’s why you shouldn’t trust those either

      source