One downside is that i’ll have no more passkeys. The vault syncing, i can do via SyncThing.
I like that I’m able to use keepassxc as a keyring on Linux. I like that there is a prompt on access so no rogue script can real my whole keyring.
Syncthing is fine and secure, but be absolutely sure you set up some kind of file versioning for the shared folder. at least a trashcan versioning, if not better. protects you against accidental deletion
Something I never fully understood with file versioning is on which side to apply it. The source or the receiving end?
on the receiving end. Syncthing cant act to keep a version before you delete a file locally, but it can move a remotely deleted file to the version control instead of deleting it
I like KeepAss.
I have used KeePassXC for years. I also use Syncthing which syncs files via my wifi for all devices, including KeePass.
Works like a charm. Occasionally deleting the sync-conflict files in case they appear.
recently set mine up exactly like this, can vouch
yep, thats the way
this is the correct answer
Why not Bitwarden?
There have been too many data breaches from cloud-based services to trust another one. I have a Proton account for email and online storage, but I won’t use their password service because it’s cloud based.
https://blog.lastpass.com/posts/notice-of-recent-security-incident
Lastpass leaked their password database in 2022, and bad actors are still using it to access peoples files, stealing passwords and hundreds of thousands of dollars in crypto.
DON’T trust anything important to cloud-based storage or services. Use Keepass. Use Syncthing if you need to keep the database on multiple devices.
(I see other comments using Dropbox. Dropbox = cloud. Don’t store anything security related in the cloud.)
Isn’t protonpass E2EE?
So was LastPass. But when they’re source code leaked, turned out their encryption method was crappy. Just because something is encrypted doesn’t mean that it’s safe.
The key is that proton pass and bit warden and keypass are open source and have all passed independent security audits.
You can’t talk about E2EE on a closed source client.
What is this fight club? /s
You could totally talk about E2EE if the client was SA/Electron. If the blob is just getting transferred and stored and the passphrase is never transferred, that’s E2EE.
Come to think of it, if they throw in extra keys when you make your blob, it’s still E2EE, even if they have a key for it. Perhaps we need to think differently about E2EE being then end all.
lol I’ll just mute this convo
I know I can probably google this. But where are the passwords from Keepass stored? Or what makes it harder to hack?
I still use 1Password because the subscription is still running and I was planning to switch to Proton Pass once that is over. I know 1Password is harder to crack due to their 2nd master key password (or whatever they call it)
Keepass just uses a (local) file, but it expects and can handle if the file is modified externally. That’s important because it means you can store it on a network share, or in some sort of synchronized storage, self hosted or not (next cloud, sync thing, Google drive, whatever). It’s just up to you. If you have it open on your PC and you add an entry on your phone, your PC won’t “overwrite” it, but integrates any changes you’re making there at the same time.
For example the android client has direct support for a long list on storage services for this exact reason.
They are are stored encrypted on your computer if I’m not mistaken
It really depend on your threat model, Proton Pass is fine. Of course a self-hosted or local solution will be more privacy friendly but at the cost of being responsable for security and good backups (3,2 1 rule).
There is no black or white regarding privacy. You want to ask yourself what you want to protect from and is the investment worth being sovereign ?
Wdym by “threat model” ?
I know it’s not your question, but have you checked out Bitwarden or the alternative Selfhosted Vaultwarden. Bitwarden supports passkeys and vault syncing, and if you are offline you can still access your vault.
https://bitwarden.com/passwordless-passkeys/
Bitwarden also released a AIO selfhosted docker image, but last I checked it’s still not in “official release” status.
Ooh an AIO docker image you say? I may have to look into that.
Its called Bitwarden Unified. Its still in beta at the moment. I have been running this along side Vaultwarden myself.
There’s also vaultwarden which is a super lightweight single container bitwarden server.
I use KeepassXC on my computer and Keepass2Android on my phone. Passkeys work fine and are synchronized across my Synology.
Same here, it works well, and the Firefox plugin works well for auto fill, too.
Just make sure KeepassXC is set to Automatically save after every change & Automatically reload the database when modified externally, on the General > Basic Settings screen.
you should own your data. So yes
i use keepassxc and from protonpass and its great its a lot lot more manuel work but in theory its worth it anything with a internet connection can be hacked
Do both local and cloud backup using keepass or keepassxc, use dropbox or g drive, or private cloud. The .kdbx file is already encrypted when at rest.
I can’t daily drive both.
What do you mean daily drive both? You can just upload the keepass file to Dropbox and gdrive, its encrypted in the unlikely event of a security breach
KeePass then you have your own file instead of relying on a third party. And you are free to sync it how you wish , syncthing is great . I left proton earlier since I don’t trust them , but never used the proton pass at all.
I think proton is the most blocked by governments group of services in the entire world. To have a backup in .kbdx file sounds at least like a good idea.
Doesn’t keypass support passkeys?
As you can see from the thread, this question is divided amongst the cult of “sensible privacy is a thing provided you’re not a criminal” to the cult of “everybody’s on a FEMA/🧊 spreadsheet and they’re working their way down”.
I’d say make sure you use a separate password for proton pass, it’s an advanced option. You are far more likely to get hacked for your money and password manager goes 97% of the way to defeating those attacks.
Don’t take your eye off the ball. The real threats to your wallet have always been the shareholders.
AFAIK, no; keepass does NOT support passkeys. TOTP’s are still fine though.
Sorry, I was thinking of keepasssXC which does have passkey support
