6 ms·

I've been using KeePassXC ever since switching from OSX to Debian Linux. On OSX, I used 1Password and have been an advocate for years. However, after being for

by preek 6y ago

I've been using KeePassXC ever since switching from OSX to Debian Linux. On OSX, I used 1Password and have been an advocate for years. However, after being forced to upgrade (and pay again) multiple times due to API changes, and the integration stopped working with various browsers, I wasn't a happy customer anymore. KeePassXC works just as good, if not better. I'm using it on Debian, with browser extensions and on iOS (and sometimes even on my old Macbook Pro on OSX). Being FOSS, I'm not afraid anymore that stuff will stop working at some point, because some proprietary API is deprecated.

cies 6y ago
You might want to checkout BitWarden. A FOSS server exists (even on in Rust, iirc) and there are opensource clients as well (browser plugins maintained by BitWarden). This system is "zero knowledge", the server does not get to see the passwords in normal operation (it does in case of imports, which I think is a huge security flaw one can mitigate by not importing). Another thing: Keepass(XC) became a snap package on recent Ubuntus. If there's one piece of software I dont want to be a snap package it is this tool. It get slow, ugly and hard to find (in a process tree). This is the last piece of software I want to run in snap.
- varjolintu 6y ago
  You can still use the official PPA or AppImage.
- tenuousemphasis 6y ago
  > (it does in case of imports, which I think is a huge security flaw one can mitigate by not importing) Wait, why is that the case?
- teekert 6y ago
  Why not? Isn't it nice that you can control what other software can reach it?
- preek 6y ago
  I did check it out before using KeePassXC, thank you. I took a whole day to check out all available FOSS options. KeePassXC won based on my criteria by a long shot. One deadly reason against BitWarden (for me): Having a FOSS server that's not officially supported and more or less reverse engineered, is even worse than a proprietary API. It can become defunct at any point in time - and it might even be hard to catch it. At least, with 1P, when they deprecated their old Apps, they announced it. Not saying that BitWarden is bad in any way. Just saying that the KeePassXC stack is FOSS all the way with no lock in and multiple implementations of the Keepass file format. As for the SNAP package: I'm not versed in that. I'm just using the regular Debian package. Works fine for me.
  - CDSlice 6y ago
    I'm not sure when you looked at Bitwarden but the official server and clients are open source under the AGPL, including the API for other people to make their own servers and clients with. So I would say that Bitwarden fills the FOSS all the way requirement. https://github.com/bitwarden https://github.com/bitwarden
    - LanternLight83 6y ago
      I've self hosted the rust server, and have attempted to host the official server but found that it was difficult to install and addly slow once configured. Running your own server also loses you many of the benefits of premium if you keep supporting the project. They changed their color scheme from my favorite blue to Facebook-blue, and after exploring it on tails, I think I'll be more than happy to transition to keepass in the future.
      - commoner 6y ago
        The bitwarden_rs server features TOTP entries and support for login with U2F (YubiKey) and Duo. It also handles Vault attachments and organizations. Which premium features are you missing?
        6y ago
- rlpb 6y ago
  > Another thing: Keepass(XC) became a snap package on recent Ubuntus. "became" is misleading. It's available as a snap if you want to use it. It [also] remains available from the apt repository maintained in the traditional way. Of course if you want keepassxc on Ubuntu 20.04 from apt/deb, you'll get 2.4.3, because that is the traditional way. The snap available is 2.6, because consuming the latest directly from upstream is how snaps work. You can choose with methodology you prefer.
  - abrowne 6y ago
    I even got the snap yesterday morning already!
  - SkyMarshal 6y ago
    My preferred way of installing and managing software on Ubuntu is compiling the source to /opt and then installing it to the system with the Debian/Ubuntu Update Alternatives system: - https://wiki.debian.org/DebianAlternatives https://wiki.debian.org/DebianAlternatives - http://manpages.ubuntu.com/manpages/trusty/man8/update-alternatives.8.html http://manpages.ubuntu.com/manpages/trusty/man8/update-alter... It allows you to install multiple different versions side-by-side and toggle which of them is called by the canonical system command in /bin, /usr/bin or wherever. You install them in /opt or somewhere else where collisions won't occur, then use the update-alternatives command to link them into /bin, /usr/bin or other system directories. It takes a little more work up front, but is worth it. It makes both upgrades and rollbacks completely painless, and you get to decide which version you use. The upfront work part is in scripting the various binaries and manpage files that need to be linked together, atomically, into system directories. Here's an old (out-of-date) example script for installing Haskell Platform after building it in /opt/ that demonstrates this. All subcommands must be slaved to the main command, and update-alternatives enables this. https://pastebin.com/74JAxdTX https://pastebin.com/74JAxdTX
  - cies 6y ago
    Dit not know that, but after "just installing it", it was suuuper slow and ugly (very not matching my other apps) and I could not find the process it was running as at first (snap obfuscates that). Also it could not read a file I put in /tmp. I want to use a tool to protect my privacy, please not package that in some security-unproven test-bed of a packaging/execution method please. (Also found the calc app was in snap, and thus verrrry slow to start, then I dumped Ubuntu altogether)
- red_trumpet 6y ago
  > It get slow > This is the last piece of software I want to run in snap. Well, KeepassXC is not that resource hungry, is it?
  - ric2b 6y ago
    I think they mean the startup is slower. Snaps don't really impact performance other than startup time.
- hanklazard 6y ago
  I started with 1P and switched to Keepass as they started pushing their subscription service. Keepass was fine, but had some annoying sync issues occasionally (via dropbox) and never really found a good ios app. The whole system worked but felt sort of cobbled together. I think this is because it is built as a local application that can sync through other services, rather than server / client. Syncing data is more front and center with BW. Running a bitwarden server has been a much better experience, particularly the bitwarden_rs fork (1). I run it in a container and it's been rock-solid. The organization / collections features make sharing pws with my family really easy, and 2FA gives me peace of mind. The ios app is really smooth too. Importing a db from keepass was pretty easy. BTW, I did try the official bitwarden container first, but found it bloated and feature-restricted (if you don't want to pay a monthly fee). 1. https://github.com/dani-garcia/bitwarden_rs https://github.com/dani-garcia/bitwarden_rs
  - selykg 6y ago
    How do you have the Bitwarden server setup? I'd love to run it locally at home on a NUC or something similar, but Bitwarden has this shitty "feature" where you can't actually save anything new unless you have a connection to the server. I'd rather not expose a server to the outside world running locally on my network if possible.
    - hoistbypetard 6y ago
      This was my answer to that: https://geoff.tuxpup.com/posts/caddy_and_wireguard/ https://geoff.tuxpup.com/posts/caddy_and_wireguard/ I never got 'round to writing up the bitwarden specifics, but it covers the path I negotiated between hosting it somewhere else and exposing it to the world.
    - hanklazard 6y ago
      I considered doing it from a home server using a wireguard connection on my Unraid box, but in the end just went for a cheap cloud instance from digital ocean. I'm also a bit uncomfortable with exposing my home network through a reverse-proxy so things that i need lots of access to go up on the VPS.
- tunesmith 6y ago
  My main problem with BitWarden is its weird Folder UX model - I can't quite put my finger on it, but I keep running into things I want to do but that I can't quite do when sharing. 1Password's "Vault" model is so much clearer. What's the advantage of BitWarden over sharing your Keepass database with a family member via Dropbox or something?
  - mikece 6y ago
    The ability to create shared folders of credentials either for corporate or family situations while maintaining separate accounts is a big one. The password to my account and my wife's to hers are in our shared folder so if I plotz without warning she can get into my credential store and get into things like the power company website, insurance website, etc without having to have all of the credentials (along with crap she'll never care about like SSH keys and passwords for my EC2 instances) she doesn't care about taking up space on her account.
    - toomuchtodo 6y ago
      What’s annoying is that space shouldn’t be an issue at all, these secrets are tiny. Instead of folders, they should be tags, with the ability to grant access and sort by those tags (IMHO as a Bitwarden paying customer). I hope Apple rolls out their iOS 14 keychain improvements soon, and supports family sharing/delegation/access controls based on the family primitives in iCloud, so we can bounce from Bitwarden.
mapgrep 6y ago
How do you sync to iOS? Sync issue caused me to switch from keypassxc on Linux to browser based 1Password there. Not thrilled to use browser crypto but sending passwords to myself via Signal was getting old.
- ahnick 6y ago
  Not OP, but I use Resilio Sync (aka Bittorent Sync) and it has been working great for sometime now. Just open the app and the latest kdb file gets pulled down. I use the Strongbox app on iOS which supports kdb.
  - juskrey 6y ago
    How do you sync kdb to Strongbox. IIRC iOS Resilio requires files to be exported manually
    - ahnick 6y ago
      With the later versions of iOS supporting "Files" now, Strongbox points to the file that is stored within the "Sync" (Resilio) location. What this means is that Strongbox is actively reading/writing to that file within the "Sync" location on iOS. Whenever I open the Resilio Sync app it will either push the changes I made on mobile to the server or pull down the file from the server and overwrite the file on iOS, depending on which is the newer file. Also, I don't use Resilio's proxy servers either, so all of this is 100% running on my own infra. I have Wireguard setup on my home network, so if I am away from home, I can "VPN" in on my phone and then open the Resilio Sync app to sync up remotely.
      - juskrey 6y ago
        Thanks, indeed with "Files" it works!
      - WorldMaker 6y ago
        I tried Files, but after some sort of timeout the File disappeared and I don't know what that was about, so I went back to Share.

by preek 6y ago

cies 6y ago

You might want to checkout BitWarden. A FOSS server exists (even on in Rust, iirc) and there are opensource clients as well (browser plugins maintained by BitWarden). This system is "zero knowledge", the server does not get to see the passwords in normal operation (it does in case of imports, which I think is a huge security flaw one can mitigate by not importing). Another thing: Keepass(XC) became a snap package on recent Ubuntus. If there's one piece of software I dont want to be a snap package it is this tool. It get slow, ugly and hard to find (in a process tree). This is the last piece of software I want to run in snap.

varjolintu 6y ago
You can still use the official PPA or AppImage.
tenuousemphasis 6y ago
> (it does in case of imports, which I think is a huge security flaw one can mitigate by not importing) Wait, why is that the case?
teekert 6y ago
Why not? Isn't it nice that you can control what other software can reach it?
preek 6y ago
I did check it out before using KeePassXC, thank you. I took a whole day to check out all available FOSS options. KeePassXC won based on my criteria by a long shot. One deadly reason against BitWarden (for me): Having a FOSS server that's not officially supported and more or less reverse engineered, is even worse than a proprietary API. It can become defunct at any point in time - and it might even be hard to catch it. At least, with 1P, when they deprecated their old Apps, they announced it. Not saying that BitWarden is bad in any way. Just saying that the KeePassXC stack is FOSS all the way with no lock in and multiple implementations of the Keepass file format. As for the SNAP package: I'm not versed in that. I'm just using the regular Debian package. Works fine for me.
- CDSlice 6y ago
  I'm not sure when you looked at Bitwarden but the official server and clients are open source under the AGPL, including the API for other people to make their own servers and clients with. So I would say that Bitwarden fills the FOSS all the way requirement. https://github.com/bitwarden https://github.com/bitwarden
  - LanternLight83 6y ago
    I've self hosted the rust server, and have attempted to host the official server but found that it was difficult to install and addly slow once configured. Running your own server also loses you many of the benefits of premium if you keep supporting the project. They changed their color scheme from my favorite blue to Facebook-blue, and after exploring it on tails, I think I'll be more than happy to transition to keepass in the future.
    - commoner 6y ago
      The bitwarden_rs server features TOTP entries and support for login with U2F (YubiKey) and Duo. It also handles Vault attachments and organizations. Which premium features are you missing?
      - 6y ago
rlpb 6y ago
> Another thing: Keepass(XC) became a snap package on recent Ubuntus. "became" is misleading. It's available as a snap if you want to use it. It [also] remains available from the apt repository maintained in the traditional way. Of course if you want keepassxc on Ubuntu 20.04 from apt/deb, you'll get 2.4.3, because that is the traditional way. The snap available is 2.6, because consuming the latest directly from upstream is how snaps work. You can choose with methodology you prefer.
- abrowne 6y ago
  I even got the snap yesterday morning already!
- SkyMarshal 6y ago
  My preferred way of installing and managing software on Ubuntu is compiling the source to /opt and then installing it to the system with the Debian/Ubuntu Update Alternatives system: - https://wiki.debian.org/DebianAlternatives https://wiki.debian.org/DebianAlternatives - http://manpages.ubuntu.com/manpages/trusty/man8/update-alternatives.8.html http://manpages.ubuntu.com/manpages/trusty/man8/update-alter... It allows you to install multiple different versions side-by-side and toggle which of them is called by the canonical system command in /bin, /usr/bin or wherever. You install them in /opt or somewhere else where collisions won't occur, then use the update-alternatives command to link them into /bin, /usr/bin or other system directories. It takes a little more work up front, but is worth it. It makes both upgrades and rollbacks completely painless, and you get to decide which version you use. The upfront work part is in scripting the various binaries and manpage files that need to be linked together, atomically, into system directories. Here's an old (out-of-date) example script for installing Haskell Platform after building it in /opt/ that demonstrates this. All subcommands must be slaved to the main command, and update-alternatives enables this. https://pastebin.com/74JAxdTX https://pastebin.com/74JAxdTX
- cies 6y ago
  Dit not know that, but after "just installing it", it was suuuper slow and ugly (very not matching my other apps) and I could not find the process it was running as at first (snap obfuscates that). Also it could not read a file I put in /tmp. I want to use a tool to protect my privacy, please not package that in some security-unproven test-bed of a packaging/execution method please. (Also found the calc app was in snap, and thus verrrry slow to start, then I dumped Ubuntu altogether)
red_trumpet 6y ago
> It get slow > This is the last piece of software I want to run in snap. Well, KeepassXC is not that resource hungry, is it?
- ric2b 6y ago
  I think they mean the startup is slower. Snaps don't really impact performance other than startup time.
hanklazard 6y ago
I started with 1P and switched to Keepass as they started pushing their subscription service. Keepass was fine, but had some annoying sync issues occasionally (via dropbox) and never really found a good ios app. The whole system worked but felt sort of cobbled together. I think this is because it is built as a local application that can sync through other services, rather than server / client. Syncing data is more front and center with BW. Running a bitwarden server has been a much better experience, particularly the bitwarden_rs fork (1). I run it in a container and it's been rock-solid. The organization / collections features make sharing pws with my family really easy, and 2FA gives me peace of mind. The ios app is really smooth too. Importing a db from keepass was pretty easy. BTW, I did try the official bitwarden container first, but found it bloated and feature-restricted (if you don't want to pay a monthly fee). 1. https://github.com/dani-garcia/bitwarden_rs https://github.com/dani-garcia/bitwarden_rs
- selykg 6y ago
  How do you have the Bitwarden server setup? I'd love to run it locally at home on a NUC or something similar, but Bitwarden has this shitty "feature" where you can't actually save anything new unless you have a connection to the server. I'd rather not expose a server to the outside world running locally on my network if possible.
  - hoistbypetard 6y ago
    This was my answer to that: https://geoff.tuxpup.com/posts/caddy_and_wireguard/ https://geoff.tuxpup.com/posts/caddy_and_wireguard/ I never got 'round to writing up the bitwarden specifics, but it covers the path I negotiated between hosting it somewhere else and exposing it to the world.
  - hanklazard 6y ago
    I considered doing it from a home server using a wireguard connection on my Unraid box, but in the end just went for a cheap cloud instance from digital ocean. I'm also a bit uncomfortable with exposing my home network through a reverse-proxy so things that i need lots of access to go up on the VPS.
tunesmith 6y ago
My main problem with BitWarden is its weird Folder UX model - I can't quite put my finger on it, but I keep running into things I want to do but that I can't quite do when sharing. 1Password's "Vault" model is so much clearer. What's the advantage of BitWarden over sharing your Keepass database with a family member via Dropbox or something?
- mikece 6y ago
  The ability to create shared folders of credentials either for corporate or family situations while maintaining separate accounts is a big one. The password to my account and my wife's to hers are in our shared folder so if I plotz without warning she can get into my credential store and get into things like the power company website, insurance website, etc without having to have all of the credentials (along with crap she'll never care about like SSH keys and passwords for my EC2 instances) she doesn't care about taking up space on her account.
  - toomuchtodo 6y ago
    What’s annoying is that space shouldn’t be an issue at all, these secrets are tiny. Instead of folders, they should be tags, with the ability to grant access and sort by those tags (IMHO as a Bitwarden paying customer). I hope Apple rolls out their iOS 14 keychain improvements soon, and supports family sharing/delegation/access controls based on the family primitives in iCloud, so we can bounce from Bitwarden.

mapgrep 6y ago

How do you sync to iOS? Sync issue caused me to switch from keypassxc on Linux to browser based 1Password there. Not thrilled to use browser crypto but sending passwords to myself via Signal was getting old.

ahnick 6y ago
Not OP, but I use Resilio Sync (aka Bittorent Sync) and it has been working great for sometime now. Just open the app and the latest kdb file gets pulled down. I use the Strongbox app on iOS which supports kdb.
- juskrey 6y ago
  How do you sync kdb to Strongbox. IIRC iOS Resilio requires files to be exported manually
  - ahnick 6y ago
    With the later versions of iOS supporting "Files" now, Strongbox points to the file that is stored within the "Sync" (Resilio) location. What this means is that Strongbox is actively reading/writing to that file within the "Sync" location on iOS. Whenever I open the Resilio Sync app it will either push the changes I made on mobile to the server or pull down the file from the server and overwrite the file on iOS, depending on which is the newer file. Also, I don't use Resilio's proxy servers either, so all of this is 100% running on my own infra. I have Wireguard setup on my home network, so if I am away from home, I can "VPN" in on my phone and then open the Resilio Sync app to sync up remotely.
    - juskrey 6y ago
      Thanks, indeed with "Files" it works!
    - WorldMaker 6y ago
      I tried Files, but after some sort of timeout the File disappeared and I don't know what that was about, so I went back to Share.