4 ms·
I use git to version my Keepass database files. It's not great, because if you store binary files inside the Keepass database, the git repo's size grows very fa
by dmos62 7y ago
I use git to version my Keepass database files. It's not great, because if you store binary files inside the Keepass database, the git repo's size grows very fast. I do it because I don't trust the apps I use to not corrupt the file. Does anyone have alternative solutions?
Something like pass lends itself ideally to version control, but all my entries' metadata (names, dates) are visible, which is a problem for me. I want to be able to store my secret database even on untrusted infrastructure.
Currently, I'm pondering storing big or often updated binary data separately from the passphrases and similar low-footprint data.
- mackrevinack 7y agoive never got around to trying pass, just read a few things about it. I remember something called tomb that works with pass to hide all the file names
- dmos62 7y agoUnfortunately tomb isn't very portable.
- novirium 7y agoI've been using SyncThing for years with my KeePassXC database without issues (including Android for use with Keepass2Android). On the odd occasion it's been modified on two devices without a sync and SyncThing produces a sync-conflict file, a simple "Merge from database..." within KeePassXC happily pulls in the newer data from both databases to merge them again. I use the Staggered File Versioning feature on at least one device + a separate backup mechanism to satisfy my paranoia about losing the database.
- bavell 7y agoLove it! I just recently started using Syncthing and may implement what you've outlined here. As a fellow paranoid, what mechanism are you using for the separate backup?
- neumann 7y agoLikewise. SyncThing and suitable file based databases allow so many instant 'cloud' solutions! KeePassXC across 5 devices with instant updates!
- iszomer 7y agoThis is what I do too. I also configured it to only sync with a specific WAP.
- benhurmarcel 7y agoI just have it backed up regularly, along with all my other files. My backup system keeps versions, so I can roll back in case I need it.
- fractalf 7y agoI keep the db + image file in a selfhosted (gitea) private repo. The repo contains 100s of files and I named the keepass files very general to hide in the open if my server is hacked.
- dmos62 7y agoWhat do you mean by db + image file?
- fractalf 7y agoStrike image. I just happen to use an image. KeePass db can be locked using a password AND a file
- bavell 7y agoHmmm... I haven't taken a look at what the raw DB file looks like but I imagine it wouldn't be too hard to differentiate from the other files if looking at the bytes on disk. Food for thought...
- fractalf 7y agoYes its possible, but needs finding out. There is also another file among the 100s that needs to be used with a strong password tough. All these layers make me feel it's safe enough
- phasor 7y agoI store my keepass database on a private Seafile server hosted on a cheap cloud VPS. What I like about this solution is: 1) the file is stored in an encrypted seafile library with client side encryption so that a potential hacker could not access the file even with access to the server. 2) delta sync for my other large files. Disclaimer: I am in no way associated with seafile, just a happy user for many years.
- Iolaum 7y agoI just branch my kdbx file every ~4 months to withstand dB corruption. Appending -$date suffix on the filename. I also sync the database (using nextcloudpi) between mobile (keepassdx) and desktop.