Submitted 1 year ago by captain_obvious@lemmy.wtf to selfhosted@lemmy.world
Objective: Secure & private password management, prevent anyone from stealing your passwords.
Option 1: Store Keepass PW file in personal cloud service like OneDrive/GoogleDrive/etc , download file, use KeepassXC to Open
Option 2: Use ProtonPass or similar solution like Bitwarden
Option 3: Host a solution like Vaultwarden
Which would do you choose? Are there more options ? Assume strong masterpassword and strong technical skills
I’ve been using option 1 for many many years. It lets me keep control of the encryption, and it’s accessible just about anywhere.
To improve security of option 1 you could use a keyfile, that is either only transferred manually to devices or stored at a second cloud provider.
I do 3 and have encrypted backups to Dropbox so I can easy restore/spin up a cloud server if I need to
Yep but use Microsoft.
For highest security don’t store in cloud or multiple places. Memorize them or keep a separate device that has no intermet access and keep them on that device encrypted/locked
Memorizing passwords just leads to passwords that are easy to attack with dictionary attacks and to password reuse.
I memorize the random generated ones, you type it in enough it becomes muscle memory.
I never understood how storing your password in an unified storage is better than just remembering it yourself
Pease be satire! 😐
Because humans are generally unable to remember passwords varied enough to be secure.
Why not Keepass on a webdav server? Both Keepass on the computer and Keepass2Android can open the file directly. If you save it on one it will merge the changes in any other copies you have open.
I went from Keepass synced via NextCloud (self hosted)… to Bitwarden (their servers) … to Vaultwarden via Docker going through Cloudflare Tunnel and fail2ban added
Option 1, with manual copying to mobile. I tried syncthing in the past but had problems with corrupted files
Option 2, because once you start thinking about the ways your stuff could be stolen (“threat modelling”) you’ll see that realistically it’s the easiest option.
I’m currently using Keepassxc. The setup that I created below gives me 3-backups of my passwords, but it’s a bit to manage.
Computer
On my computer, I have my keepassxc database and key file stored in a veracrypt container. Next to my computer, I have a piece of paper that has the password for my keepassxc database and the password for my veracrypt container.
computer -> veracrypt container -> keepassxc database AND keepassxc key file
paper -> keepassxc database pw AND veracrypt pw
KeePassXC Export File (text file that contains all of my login information)
I store this file inside of a veracrypt container, on my USB LUKS. Next to my USB LUKS, I have a piece of paper that has the associated veracrypt password.
usb luks -> veracrypt container/Tomb container -> keepassxc export file
paper -> veracrypt pw
Cloud
I store my database in cloud service a.
I store my key file in a veracrypt container, in cloud service b.
On a piece of paper, I have the login information to both of these cloud accounts and the password for the veracrypt container.
I switched to proton pass after using bitwarden for a couple years
Been using option 3 but with Bitwarden for almost 5 years at this point. First started out on a VM in a cloud provider. Now it’s in a VM on unraid behind a local HAProxy or Cloudflare tunnel for remote access.
Bitwardens full docker stack provides great daily backups which I’ve had to restore on occasion or go back to one from months ago to dig out a password for my wife.
Been testing and hoping to move to the unified-container from them soon, assuming I can replicate encrypted backups like their solution.
Apple keychain. Supposedly secure, extremely convenient, may be in the Cloud but not centralized - can’t lose everyone’s credentials at once.
The plug-in for Windows works pretty well too, although I wonder if that puts my confidential data at more risk
Lastpass /s
Oh God no kill it with fire
I did option 1 for a number of years but now I’m doing option 3 off a proxmox container and some cloud scripted backup. So far so good.
We just started doing option 3 at work and just keep it behind the firewall. It is going well so far.
I’d never store my passwords in the cloud.
I like Enpass. $25 lifetime sub via Stack social. Does the trick. If they ever pull the rug out on lifetime folks, I would go to Bitwarden.
I ended up scoring a free lifetime membership years ago, but is their stuff open source? I never fully trusted it, so I didn’t end up using it for anything
Enpass uses the open source library sqlcipher (which is an sqlite fork with encryption). So while Enpass as a whole is not fully open source, you can still exfiltrate your passwords with open source tools, should they ever vanish or radically change their business model. You can then use for example enpass-cli.
That gives me enough confidence to trust in Enpass, since they can’t easily hold my data hostage.
It’s not open source, so that’s an easy deal breaker for some. Considering the vaults are encrypted and Enpass itself stores nothing on their servers, I’ve been okay with it. The vaults just exist on my phone and wherever I’ve chosen to back it up (OneDrive, GDrive, Nextcloud, NAS, etc).
I like LessPass, essentially you choose one password and then it generates secure passwords for each website, since it uses a predefined generation algorithm it’s completely offline and doesn’t need syncing it’s very secure. However it has the inconvenience of needing to remember the way you spelled the website, but if you stick to something like all lowercase it’s fine.
dogma11@lemmy.world 1 year ago
I’m currently hosting vaultwarden on my rack, mostly just because I can really. It’s easy enough and I have plenty of resources.