Submitted 1 year ago by captain_obvious@lemmy.wtf to selfhosted@lemmy.world
Objective: Secure & private password management, prevent anyone from stealing your passwords.
Option 1: Store Keepass PW file in personal cloud service like OneDrive/GoogleDrive/etc , download file, use KeepassXC to Open
Option 2: Use ProtonPass or similar solution like Bitwarden
Option 3: Host a solution like Vaultwarden
Which would do you choose? Are there more options ? Assume strong masterpassword and strong technical skills
Keepass + syncthing.
Don’t let your vauld to unencrypted through the cloud.
Your vault is always encrypted very securly except when in RAM. There is no security concern with uploading it directly to the cloud.
It’s encrypted at rest with a passphrase. Syncthing encrypts it at transit with a random key.
There is a huge difference on the security of those.
I’m very happy with self-hosted Vaultwarden.
I use option 1 with Syncthing for a distributed cloud solution
Same, works like a charm!
Ditto, but with Resilio Sync.
Keepass fIle in my own nextcloud instances, synced to my phone so I can also use keepass2android. This way if something happens I at least have another copy of it, beyond my backup system.
that’s actually exactly how I have my setup. I just use syncthing to keep everything dynamically backed up as I add passwords. my main login password is memorized and not written down anywhere so I think I’m good
I do the same, but synced to Dropbox from computers and phone.
I have the Proton password manager as well but not sure yet if I’ll do a full swap over.
I used to self host Bitwarden, but didn’t want the hassle of securing it and updating it properly and consistently. So I just pay $10 for bitwarden premium and I get to support the company.
I’ve used Option 1 with my Nextcloud and it works perfectly. Other options seem more apropriate when you need scale, many user each with their own vault.
Stupid me, didnt even remember using nextcloud instead of commercial clouds. I like it
Option 2. It’s the most robust. You’ll never lose it (provided you have the redundancy), you can use it offline, you can transfer it using a USB pen, it’s available in all platforms, including web. I’ve been using this for 8+ years, on my phone, desktop, laptop, company computer, etc. I store it on a personal cloud (and on each machine, of course, by syncing).
Option 1, KeePassXC plus SyncThing, done. Works amazing on all my devices.
I’ve never heard of Syncthing, I use Keepass on Windows and my Android, syncing to Dropbox. If I change to Syncthing is it an easy swap, anything I should watch out for?
Option 2: 1Password
I use and prefer option one, but take it a step further in that I host my own cloud service.
Host your own bitwarden
Vaultwarden. And take regular back ups. I don’t trust my passwords to be safe anywhere other than my own servers. The chances of my server being hacked is very less.
I used option 1 (KeePass synced to Google Drive) for years. It’s nice that you know you have control of your passwords at all times, and as long as you can access your cloud storage account and can download a KeePass app, you can get your passwords. It works reasonably well most of the time, but I was consistently running into edge cases that weren’t as smooth as I’d have liked (mostly apps on Android)
I switched to vaultwarden (option 3), and immediately fell in love with things mostly just working. However, since I was hosting it out of my house, I had a bit of a disaster recovery problem. If i had say a fire, I could easily lose all copies of my vault, which would be… suboptimal.
After reviewing the options, I switched to straight bitwarden. I’ve been happy with the experience, and once I have disposable income, I plan to get pro long enough to have emergency contacts available so my family can still get important passwords in case of the worst.
All options have their pros and cons, but IMO password storage is something that deserves to be given proper consideration.
I do keypassXC and Syncthing. It’s cross platform with only a couple bucks needed for lifetime access to all all necessary features depending on platform. Besides I use Syncthing for a bunch of other stuff as well, so it fits right into my flow. I’m considering moving to a command line tool simply called Pass, and still syncing with Syncthing, but I’ve yet to pull the trigger on that switch yet.
I also do keepassxc, dx on Android, and syncthing to keep them updated. What is it you paid for?
I’m both an iOS and Android user for various reasons. There is a free KeePass front end for iOS, but I paid a one time lifetime license for one that was a little more feature rich. That and the only version of Syncthing for iOS requires a like $4 purchase to allow you to sync folders outside of its default location, which was a pretty necessary feature for me.
Bitwarden+vaultwarden, harden the chosen VPS, set SSH to use keys only, then setup fail2ban for webserver and ssh Also consider putting ffsync on it as well for extra browser benefits.
Remember to back that up, and test the back at intervals to make sure they work
Not watertight ofcourse but I love that the bitwarden clients keep a local copy so if the server ever goes down youve still got access just no sync.
goes without saying.
I like this one as well, technically more challenging though
Option 3: Vaultwarden + Wireguard.
I don’t have to worry about attacks from the internet. And a single wireguard connection on my phone sometimes doesn’t even appear on the battery stats.
could you expand a bit on your edit? so bitwarden extensions need a valid ssl certificate for the domain where the server is hosted? how do you get that for (i assume) a local domain? thank you for your time!
DNS-01 challenge allows for domain ownership verification without open ports and instead looks for a txt record. Using a tool like lego[1] with the respective dns provider’s API automatically creates and deletes the txt record after generating a certificate.
Because the ownership is verified by dns txt entriy, the (sub-)domain doesn’t have to point to a publicly routable host. This allows for using any IP, so I’m using a local ip only available through wireguard or my local network (E.g. bitwarden.example.com points to 192.168.1.123).
The disadvantage is that the provider has to be supported and you have to store an API key for your domain on the server.
Not the one who wrote initially, but i have the same setup (mostly).
I went with a self signed certificate. So the server is running with a certificate i have signed with my own certification authority certificate (ca-cert) .
That means I have to install the ca-cert on all devices to get vaultwarden to accept it.
The alternative is a let’s encrypt cerrtificate, which are free, but you need to open port 80 (and another one if I remember correctly) for it to work (at least every 3 months)
Option 1
Bitwarden for me. My password manager is not just for me, it’s also a crucial component of my family life so if something happened to me I want my next of kin to be able to access it
For that it needs to be an easy to access solution.
Same, I’m all for complicated things that only I know how to use but the keys to the kingdom shouldn’t be one of those when there are laypeople relying on me.
Bitwarden offer the option to set up an emergency contact.
You choose someone to be an emergency contact, it means that if they want they can request access to view your passwords.
When they send a request you receive several emails to warn you and after X (you can choose the amount) days if you don’t do anything they get access to your account.
Option 2 would be your best bet. Great balance between security and convenience. Bitwarden is my go to because afaik it stores every detail encrypted (unlike mainstream PWs) and when you open your vault, the database gets transferred to your pc and is decrypted locally. Its essentially the same as option 1, just 1000x more convenient.
Id only selfhost vaultwarden if you want bitwardens premium features, if you dont then youre maintaining a service which you wouldnt really need. Not to mention if you selfhost on a machine on your network, you have to deal with exposing that machine to the internet, not really worth it imo.
If you work for a company that uses a reasonably good manager such as BitWarden, you should look into whether or not you get it for free or reduced. For the moment, at least, I use Bitwarden because I get it for free (and a families sub to boot!). I know 1password does the same; others might too. Do make sure you’re okay with paying the full price for a period of time in case you get laid off and have to migrate. Also make sure you’re okay with any compromises you make for the price tag. There is no price tag that makes LastPass acceptable, for example.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| Git | Popular version control system, primarily for code |
| SSH | Secure Shell for remote terminal access |
| VPS | Virtual Private Server (opposed to shared hosting) |
[Thread #173 for this sub, first seen 28th Sep 2023, 18:45] [FAQ] [Full list] [Contact] [Source code]
Option 1, except for the cloud bit. My KeePass file is stored in a restricted shared folder on my home file server, and auto-syncs to my phone on the rare occasion I update it from my desktop.
I’ve been happy with Keeper
Same. Zero knowledge is good enough for me tho I may eat them words.
Realistically, I only see 3 risks using Keeper: my device has malware which lets them grab my passwords from my clipboard as I copy them, malware that lets them take control of my device after I’ve unlocked my password manager, or if the cloud storage is completely wiped out in some freak accident.
1 and 2 are risks for anyone using any password manager. And 3 is extremely unlikely since they use AWS for storage wirh multi-zone and multi-region redundancy, and certainly much more reliable than self hosting.
The risk of actually having your passwords cracked, even if the cloud data is leaked, is practically 0 as long as you have a decent complexity and length master password and 2FA enabled. And the risk is just as low with a MITM attack or other network based interceptors because of the ZK architecture (as you mentioned) and high encryption used.
Anyone promoting other password managers as more secure either aren’t considering the risks to data loss due to self hosting or are buying too much into their password manager’s marketing. I think it’s totally reasonable to prefer other options due to feature support or subscription price though. A couple of features that Keeper had that made me choose it were:
There might be other password managers now that support these features, as I haven’t kept up with them. I subscribed to Keeper about 6 years ago and haven’t had a reason to switch. I’m open to suggestions if people know of other managers with better features.
I choose keepassXC stored locally
I use option 1, I host my keepass db file on a free secure nextcloud storage account, and use nextcloud client to keep it synced to all my devices. It’s available offline on all of my devices too, in case the server goes down. I use KeepassXC on my PCs and KeepassDX on Android, to open the files.
I use option #1. Each instance of KeePass maintains a local file, but updates them automatically whenever it opens or closes. I also back up the file to my personal server automatically, so I have a copy even if the cloud service fails for some reason.
This setup has been serving me well for a long time.
Personally I’m running option 2 with self hosted bitwarden. Sure, it’s a bit more effort to make it work and while it’s not perfect that’s what I’ve ended up with. The most convinient thing with that is that I can access my passwords whenever I have internet access with a browser without any need to install any software on the thing I’m using. Obviously that doesn’t mean that I’ll happily access the vault with whatever free-to-use endpoint I happen to encounter but it also gives an option to access whatever even if I’m borrowing a computer from a (trusted) friend and once I close the private window I used it’s gone. And even more often, when I’m accessing my credentials from a family shared computer, I can just log out and I don’t need to do any cleanup on the host which might get infected by our kids browsing something malicious or some other breach of security.
With keepassxc I’d need to worry about the database file, which is a bit different than logging out and closing browser. Your usage patterns might be different, but web-based hosting solution works for me.
Having gone through all of these options I have thoughts.
Option 1 sounds awesome but will almost always leave you in a situation where you can’t get your logins when you need them in an emergency. You’re always depending on a chain of things. Depending on your situation it may not be a big deal. But this option sucks, imho.
Option 3 sounds amazing because it gives you the control of option 1 with the ease of option 2. But… unless you’re the kind of person that enjoys hosting their own email server you really don’t want this option. Fun in theory but not so much when you realize you now have a 3rd job.
So that leaves option 2. It’s great but you’re depending on someone else. This is the option that most people should choose too, imo. However it lacks some of control and trust that option 1 and 3 have.
Sooooo, that leaves us with option 4, the onion option. Breaking up your data into layers and using different tools for them.
So first and foremost I want my password storage to always be available. For me that means Bitwarden, (though I’m evaluating protonpass currently.) this is the outer layer. Things that can and should be stored here are stored here. I use it to manage web logins and 2FA tokens for those sites. I also use it for storing autofill data eg credit cards. I don’t use it to hold things like my gpg keys.
Next layer is pass. This layer is mostly things that I need to have logins or other information on headless/remote servers. Think self hosted lab services like a mariadb/postgres or backups. This is easily kept in sync with git. This is the layer where I’ll store things like gpg keys and other VERY sensitive data that I need to sync around.
For other things on this layer I use ansible vault. This is mostly used for anything where I need automation and/or I don’t want too or can’t easily use my yubikey for gpg. This is kept in sync with git as well.
Lastly the inner layer I use AGE or PGP. This is for anything else I can’t use the above for. So my Bitwarden export/backups are in this level too. I also use this layer for things that I need to use to bootstrap a system. Think sensitive dotfiles. This can be kept in sync with git as well.
Git is the best sync solution imo because you can store it anywhere and use anything to sync that repo. Just throw that raw repo on Dropbox, use ssh with it on a vps, rsync it, etc. you’ll always have it somewhere and on something.
My work flow goes like this Bitwarden -> Apple/Google/Firefox -> Pass -> Ansible -> AGE/PGP
This allows for syncing things as needed and how needed. It also gives you the option of having an encrypted text file if/when everything fails.
Option 3 sounds amazing because it gives you the control of option 1 with the ease of option 2. But… unless you’re the kind of person that enjoys hosting their own email server you really don’t want this option. Fun in theory but not so much when you realize you now have a 3rd job.
I currently host Vaultwarden and use the Bitwarden Android app and browser plugin. What does this have to do with a mail server? I don’t host a mail server and it works fine for me (tried to host a mail server, but got blocked by ISP and would need a business account to request them to unblock it, which costs double what I currently pay for the same speeds).
It wasn’t meant to be taken literally. What I mean by that is if you’re the type of person who enjoys the upkeep of something as critical (though maybe not so much theses days) as email then go ahead and host your own password vault service. I’m not saying it shouldn’t be done and couldn’t be done.
My point is that there’s going to be times where you NEED your password vault and having it be down because something happened at home or your VPS had a problem is a really shitty situation to be in.
Of course there’s work arounds and edge cases to everything too. For me planning and building for those possibilities came down to what can I do that is the most reliable, simple, and boring. Because that’s what most people need with anything that is critical.
IMHO much like backup, password storage should be reliable, simple, and boring. Kinda like flushing a toilet or flipping a light switch.
Agree 100%. I self-host a lot of services but access to my passwords needs at least 3-nines uptime and the cost of providing that via Azure/AWS isn’t really worth it to me.
That said, I trust Bitwarden way more than I ever trusted Lastpass and I still use option 1 for highly sensitive accounts along with redundant Yubikeys (FIDO2, PIV, and GPG in that order) for anything that supports it.
hummingbird@lemmy.world 1 year ago
Keepass on phone, desktop and tablet. Sync serverless via Syncthing. -> completely private -> always available when needed -> no dependency on services which may go away -> all open source software -> maximum security
Arkhive@lemmy.blahaj.zone 1 year ago
Yup. Same system here. I really like it.
jvrava9@lemmy.dbzer0.com 1 year ago
Same here. Home server to which desktop and phone connect with OpenVPN.
Rootiest@lemm.ee 1 year ago
Check out tailscale (or headscale)
It lets you connect those devices without necessarily sending all data through your home network when you are remote. (Though that is an option along with many other great features like ssh authentication)
It also uses WireGuard for the backend which is more secure and efficient than openvpn.