6 ms·

KeePassXC + Nextcloud has surplanted any other password manager for me for the last two years. The OTP integration is great as well.

galacticdessert 6y ago
Same here, the setup is working great I use Keepass2Android, which works great with Nextcloud and handles very well offline usage and subsequent merge of the database. On iOS the experience is much worse: I use KeePassium but it does not connect natively to Nextcloud, so I use BoxCryptor for that. The downside is that if Nextcloud is unreachable, I cannot see my saved passwords. Anyone managed to have a good experience on iOS?
- galacticdessert 6y ago
  Update: after writing this I checked again, and with the latest update to the Nextcloud iOS app it is possible to directly open and save the Keepass database from Nextcloud. No need for BoxCryptor anymore. Hurray for Nextcloud!
- isanengineer 6y ago
  I've had a very good experience with Strongbox. I personally haven't used the Nextcloud integration yet so I can't vouch for that specifically, but I've used it with multiple cloud services and it's been seamless every time. It also caches your database locally, which should solve the problems you were having with BoxCryptor. It is freemium, and the really useful features will cost $1 per month, but there is also an option to purchase a perpetual license. Quality indie apps are hard to come by iOS these days, and I'm glad to pay for a service that's so integral to my daily life. https://strongboxsafe.com/ https://strongboxsafe.com/
nicolaslem 6y ago
For me the winning combo is KeePassXC + Syncthing.
- m-p-3 6y ago
  I prefer KeeWeb for the UI, but Syncthing is great.
- Lendal 6y ago
  Yes, the best feature about KeePassXC is this ability to do your own syncing. I work at a Fortune 500 where they block every syncing service except OneDrive, so that's what I have to use.
  - fidelramos 6y ago
    You might be able to get Syncthing to work if you use a relay server listening on port 443, it would depend on their firewall.
- zorrolovsky 6y ago
  Same here... really well built products that just work!.
- dublinben 6y ago
  Unfortunately Syncthing does not work on iOS, so it's not a fully cross platform solution.
- jeltz 6y ago
  I am not a fan of Syncthing. I do not want a web UI, and there UI is by default unsafe and needs to be disabled or secured anyway. I do not like their config format either.
berkes 6y ago
Isn't "integrated 2fa" defeating the purpose, though? I find the 2fa should be separate, even on a separate device, from the password store. Which is why I never use this OTP/2FA feature in my favorite passwordmanager Bitwarden.
- delfinom 6y ago
  Logically, yes, reality if you think deeply, it's no different than having a OTP app on your phone and also the password manager.... At best if you are so concerned you just create a second keepass DB for OTP or if you are more concerned, have two phones ;) I can't take software like bitwarden seriously because they still require you to have a cloud account and/or run your own server which I also have no interest in. I want something I can actually backup natively on a client without extra effort like a script running agaisnt an api. A single file encrypted database is more than adequate. Control and ownership of the password blob is just so absolutely critical if you invest heavily in password management, especially with sites that take a stance of "password/otp or we'll never recover the account"
- yjftsjthsd-h 6y ago
  The advantage to OTP, even when stored with the password, is that it switches from shared-secret to asymmetric-key login. Of course in theory with a good hash+salt it's nearly the same, but with OTP I have better confidence that an attacker can't steal my credentials. (I mean, I say this as someone who also keeps 2FA separate, but I do see some benefit to 2FA even stored with the password)
  - techslave 6y ago
    eh? what OTP scheme is asymmetric?
- selykg 6y ago
  When using a password manager of sufficient security the weakness isn't the password manager. The password manager is likely the strongest security app that most people use on the daily. If you store both the password and 2FA in something that secure, is it really causing any real harm? If your threat model dictates that this IS a threat for you, then by all means, don't do that. But I think for the average person this is far more secure than some of the alternatives they'd be doing otherwise.
majkinetor 6y ago
NextCloud actually has awesome plugin, named Passwords. You get everything major players have for free and its simply awesome. You also get team communication (add LDAP/AD to it), REST API, folders, automatic icons etc.

galacticdessert 6y ago

Same here, the setup is working great I use Keepass2Android, which works great with Nextcloud and handles very well offline usage and subsequent merge of the database. On iOS the experience is much worse: I use KeePassium but it does not connect natively to Nextcloud, so I use BoxCryptor for that. The downside is that if Nextcloud is unreachable, I cannot see my saved passwords. Anyone managed to have a good experience on iOS?

galacticdessert 6y ago
Update: after writing this I checked again, and with the latest update to the Nextcloud iOS app it is possible to directly open and save the Keepass database from Nextcloud. No need for BoxCryptor anymore. Hurray for Nextcloud!
isanengineer 6y ago
I've had a very good experience with Strongbox. I personally haven't used the Nextcloud integration yet so I can't vouch for that specifically, but I've used it with multiple cloud services and it's been seamless every time. It also caches your database locally, which should solve the problems you were having with BoxCryptor. It is freemium, and the really useful features will cost $1 per month, but there is also an option to purchase a perpetual license. Quality indie apps are hard to come by iOS these days, and I'm glad to pay for a service that's so integral to my daily life. https://strongboxsafe.com/ https://strongboxsafe.com/

nicolaslem 6y ago

For me the winning combo is KeePassXC + Syncthing.

m-p-3 6y ago
I prefer KeeWeb for the UI, but Syncthing is great.
Lendal 6y ago
Yes, the best feature about KeePassXC is this ability to do your own syncing. I work at a Fortune 500 where they block every syncing service except OneDrive, so that's what I have to use.
- fidelramos 6y ago
  You might be able to get Syncthing to work if you use a relay server listening on port 443, it would depend on their firewall.
zorrolovsky 6y ago
Same here... really well built products that just work!.
dublinben 6y ago
Unfortunately Syncthing does not work on iOS, so it's not a fully cross platform solution.
jeltz 6y ago
I am not a fan of Syncthing. I do not want a web UI, and there UI is by default unsafe and needs to be disabled or secured anyway. I do not like their config format either.

berkes 6y ago

Isn't "integrated 2fa" defeating the purpose, though? I find the 2fa should be separate, even on a separate device, from the password store. Which is why I never use this OTP/2FA feature in my favorite passwordmanager Bitwarden.

delfinom 6y ago
Logically, yes, reality if you think deeply, it's no different than having a OTP app on your phone and also the password manager.... At best if you are so concerned you just create a second keepass DB for OTP or if you are more concerned, have two phones ;) I can't take software like bitwarden seriously because they still require you to have a cloud account and/or run your own server which I also have no interest in. I want something I can actually backup natively on a client without extra effort like a script running agaisnt an api. A single file encrypted database is more than adequate. Control and ownership of the password blob is just so absolutely critical if you invest heavily in password management, especially with sites that take a stance of "password/otp or we'll never recover the account"
yjftsjthsd-h 6y ago
The advantage to OTP, even when stored with the password, is that it switches from shared-secret to asymmetric-key login. Of course in theory with a good hash+salt it's nearly the same, but with OTP I have better confidence that an attacker can't steal my credentials. (I mean, I say this as someone who also keeps 2FA separate, but I do see some benefit to 2FA even stored with the password)
- techslave 6y ago
  eh? what OTP scheme is asymmetric?
selykg 6y ago
When using a password manager of sufficient security the weakness isn't the password manager. The password manager is likely the strongest security app that most people use on the daily. If you store both the password and 2FA in something that secure, is it really causing any real harm? If your threat model dictates that this IS a threat for you, then by all means, don't do that. But I think for the average person this is far more secure than some of the alternatives they'd be doing otherwise.

majkinetor 6y ago

NextCloud actually has awesome plugin, named Passwords. You get everything major players have for free and its simply awesome. You also get team communication (add LDAP/AD to it), REST API, folders, automatic icons etc.