4 ms·

Putting one's keyfile in the cloud just seems to me to be asking for it. You're essentially trusting a 3rd party with the keys to your kingdom.

r3bl 10y ago
No. You're trusting the encryption of the password manager. No self-hosted password manager that I know of keeps your passwords in a clear text file.
WorldMaker 10y ago
A) You should presumably still have a good passphrase. B) You choose which 3rd Party to trust. There are many options with different security/trust/threat models. (Example: lately I've been using an encrypted share in Resilio Sync where the "cloud" option for me is a dumb VPS that can share the folder torrent but does not have decryption keys into the contents.)
TorKlingberg 10y ago
* Compared to completely cloud-based password manager like LastPass and 1Password, it's no worse. * The database in encrypted with your master password. * You can optionally also encrypt it with static "Key File" that are on all your devices but not in Dropbox.
- extra88 10y ago
  1Password seems to put saving to their cloud front and center but you can still choose to not save your passwords on their servers and use your own methods. My 1Password vaults are encrypted with my master password and synced between devices using Dropbox, I think there's also an option for directly syncing between smartphones and computers.
deleted 10y ago
[deleted]
Johnny_Brahms 10y ago
I don't trust dropbox, but I do trust the encryption of my password manager. Depending on how you measure, my key is somewhere between 100-150 bits, and even if that was feasible to brute force, I am not that important.
cookiecaper 10y ago
KeePass is a fully self-hosted solution. The grandparent suggests using Dropbox et al for convenience (the vault is always encrypted, so it's not "giving away the keys"). However, you don't have to do that; I just use SFTP to copy the file off of my workstation when I need a fresh copy on my phone/laptop.
growse 10y ago
Personally, i do the same, but on Syncthing. Works very well, to need to trust in the availability of Dropbox etc.

r3bl 10y ago

No. You're trusting the encryption of the password manager. No self-hosted password manager that I know of keeps your passwords in a clear text file.

WorldMaker 10y ago

A) You should presumably still have a good passphrase. B) You choose which 3rd Party to trust. There are many options with different security/trust/threat models. (Example: lately I've been using an encrypted share in Resilio Sync where the "cloud" option for me is a dumb VPS that can share the folder torrent but does not have decryption keys into the contents.)

TorKlingberg 10y ago

* Compared to completely cloud-based password manager like LastPass and 1Password, it's no worse. * The database in encrypted with your master password. * You can optionally also encrypt it with static "Key File" that are on all your devices but not in Dropbox.

extra88 10y ago
1Password seems to put saving to their cloud front and center but you can still choose to not save your passwords on their servers and use your own methods. My 1Password vaults are encrypted with my master password and synced between devices using Dropbox, I think there's also an option for directly syncing between smartphones and computers.

deleted 10y ago

[deleted]

Johnny_Brahms 10y ago

I don't trust dropbox, but I do trust the encryption of my password manager. Depending on how you measure, my key is somewhere between 100-150 bits, and even if that was feasible to brute force, I am not that important.

cookiecaper 10y ago

KeePass is a fully self-hosted solution. The grandparent suggests using Dropbox et al for convenience (the vault is always encrypted, so it's not "giving away the keys"). However, you don't have to do that; I just use SFTP to copy the file off of my workstation when I need a fresh copy on my phone/laptop.

growse 10y ago

Personally, i do the same, but on Syncthing. Works very well, to need to trust in the availability of Dropbox etc.