4 ms·

While we're at it, is there any open source self-hosted alternative to LastPass etc.? At this point we'd even go so far as just using a good Keepass Client tha

While we're at it, is there any open source self-hosted alternative to LastPass etc.? At this point we'd even go so far as just using a good Keepass Client that comes with a comfortable "send encrypted password blob to xy email, than call him and tell him this decryption password"-function.

davidroetzel 10y ago
Read about passopolis (https://passopolis.com/ https://passopolis.com/) here on HN. It is a fork of mitro, a former lastpass competitor. A quick google search also turns up Passbolt (https://www.passbolt.com/ https://www.passbolt.com/). I cannot comment on either of them as I have not used them myself, but I would be interested if anyone has.
creshal 10y ago
Not that I'm aware of. There's a bunch of commercial ones, including ours, but development costs make it hard to just open source it if we don't have assurance that people will actually buy whatever value-added services around we can come up with.
- Roritharr 10y ago
  Thats the usual chicken + egg problem. Thing is, i don't trust LastPass or any other commercial solution at all, because there is no public auditing possible. And LastPass has had breaches so there is precedence. But I really get where you are coming from, as we are also a SaaS Shop that has to walk that particular line.
jbi 10y ago
As KeePass uses a single (encrypted) file, you can use any hosting service that you want. Just make sure you save the new version back into your storage when you edit entries. You can use Owncloud, Google Drive, OneDrive, ...
- zymhan 10y ago
  LastPass provides a web frontend though, which may be a feature GP is after. I mean, I think having a Web UI for your password manager is fucking insane, but some people like it.
  - andai 10y ago
    What is insane about it?
    - philsnow 10y ago
      because now you have to think about the attack surface of the browser; CSRF, auditing your chrome extensions to try to make sure none of them are exfiltrating your tab contents / metadata, etc etc etc
      - andai 10y ago
        Ahh shit, and i was just beginning to think that a site i found a while back (can't remember the name) which used a hash function to generate your passwords hash(strong_master_pass + site + user) was a perfect solution...
    - zymhan 10y ago
      There's just so many things that could go wrong when you start trusting your web browser to access a password vault.
- WorldMaker 10y ago
  Don't forget that with KeePass you can also use as many files as you want. I know that I've been slowly moving from a single password file to a small constellation of context-specific password files. It's an interesting tool in the toolbox and you can even use that to help do things like manage the sync characteristics per KeePass file (this file should never leave this device, this file is synced by Resilio Sync, I'm alright with this other file hanging out in my OneDrive for easy access on devices I only partially trust, etc).
tombrossman 10y ago
Two options that I'm aware of: Self-host Nextcloud and use the Keeweb app with Keepass encrypted databases - https://apps.nextcloud.com/apps/keeweb https://apps.nextcloud.com/apps/keeweb Run your own Firefox accounts server, and let FF store all your passwords - https://docs.services.mozilla.com/howtos/run-fxa.html https://docs.services.mozilla.com/howtos/run-fxa.html
luca_ing 10y ago
There's pass, which should be right up HN's alley: https://www.passwordstore.org/ https://www.passwordstore.org/ I've been using it for a few years. Works for me.
- VA3FXP 10y ago
  I just recently started using it myself, and I completely agree it works well for my use-case. I did find one major annoyance; the forced-use of colours for the "Directory" names. I did some digging and found out that within the program it calls the external program 'tree' for the display. I edited the file (/usr/local/bin/pass) from: tree -C -l to tree -n -l It was much easier then I expected, and I was pleased I didn't need to use a Hex-editor. (in two locations)
Roritharr 10y ago
I should have specified better. The main reason why LastPass is interesting at all, is Team Support + a good web UI. We need to be able to send passwords to team-members so we have one source of truth for our logins.
juliand 10y ago
bitwarden was mentioned in a previous thread as a free and open source alternative to lastpass. It works on mobile and the desktop. Maybe it's worth to take a look - https://bitwarden.com/ https://bitwarden.com/
WorldMaker 10y ago
You could create a new KeePass file to send in the email and copy the only password entry you need into the new file, then send then file and out-of-band the password to that file. You could probably even script a KeePass plugin to automate several of those steps.
smichel17 10y ago
masterpasswordapp.com

davidroetzel 10y ago

Read about passopolis (https://passopolis.com/ https://passopolis.com/) here on HN. It is a fork of mitro, a former lastpass competitor. A quick google search also turns up Passbolt (https://www.passbolt.com/ https://www.passbolt.com/). I cannot comment on either of them as I have not used them myself, but I would be interested if anyone has.

creshal 10y ago

Not that I'm aware of. There's a bunch of commercial ones, including ours, but development costs make it hard to just open source it if we don't have assurance that people will actually buy whatever value-added services around we can come up with.

Roritharr 10y ago
Thats the usual chicken + egg problem. Thing is, i don't trust LastPass or any other commercial solution at all, because there is no public auditing possible. And LastPass has had breaches so there is precedence. But I really get where you are coming from, as we are also a SaaS Shop that has to walk that particular line.

jbi 10y ago

As KeePass uses a single (encrypted) file, you can use any hosting service that you want. Just make sure you save the new version back into your storage when you edit entries. You can use Owncloud, Google Drive, OneDrive, ...

zymhan 10y ago
LastPass provides a web frontend though, which may be a feature GP is after. I mean, I think having a Web UI for your password manager is fucking insane, but some people like it.
- andai 10y ago
  What is insane about it?
  - philsnow 10y ago
    because now you have to think about the attack surface of the browser; CSRF, auditing your chrome extensions to try to make sure none of them are exfiltrating your tab contents / metadata, etc etc etc
    - andai 10y ago
      Ahh shit, and i was just beginning to think that a site i found a while back (can't remember the name) which used a hash function to generate your passwords hash(strong_master_pass + site + user) was a perfect solution...
  - zymhan 10y ago
    There's just so many things that could go wrong when you start trusting your web browser to access a password vault.
WorldMaker 10y ago
Don't forget that with KeePass you can also use as many files as you want. I know that I've been slowly moving from a single password file to a small constellation of context-specific password files. It's an interesting tool in the toolbox and you can even use that to help do things like manage the sync characteristics per KeePass file (this file should never leave this device, this file is synced by Resilio Sync, I'm alright with this other file hanging out in my OneDrive for easy access on devices I only partially trust, etc).

tombrossman 10y ago

Two options that I'm aware of: Self-host Nextcloud and use the Keeweb app with Keepass encrypted databases - https://apps.nextcloud.com/apps/keeweb https://apps.nextcloud.com/apps/keeweb Run your own Firefox accounts server, and let FF store all your passwords - https://docs.services.mozilla.com/howtos/run-fxa.html https://docs.services.mozilla.com/howtos/run-fxa.html

luca_ing 10y ago

There's pass, which should be right up HN's alley: https://www.passwordstore.org/ https://www.passwordstore.org/ I've been using it for a few years. Works for me.

VA3FXP 10y ago
I just recently started using it myself, and I completely agree it works well for my use-case. I did find one major annoyance; the forced-use of colours for the "Directory" names. I did some digging and found out that within the program it calls the external program 'tree' for the display. I edited the file (/usr/local/bin/pass) from: tree -C -l to tree -n -l It was much easier then I expected, and I was pleased I didn't need to use a Hex-editor. (in two locations)

Roritharr 10y ago

I should have specified better. The main reason why LastPass is interesting at all, is Team Support + a good web UI. We need to be able to send passwords to team-members so we have one source of truth for our logins.

juliand 10y ago

bitwarden was mentioned in a previous thread as a free and open source alternative to lastpass. It works on mobile and the desktop. Maybe it's worth to take a look - https://bitwarden.com/ https://bitwarden.com/

WorldMaker 10y ago

You could create a new KeePass file to send in the email and copy the only password entry you need into the new file, then send then file and out-of-band the password to that file. You could probably even script a KeePass plugin to automate several of those steps.

smichel17 10y ago

masterpasswordapp.com