4 ms·

When Lastpass began charging for multi-device access, I sought out free alternatives that could be self-hosted, because I figured I wanted to own my passwords,

by gen220 5y ago

When Lastpass began charging for multi-device access, I sought out free alternatives that could be self-hosted, because I figured I wanted to own my passwords, even if they're encrypted at-rest, and I didn't want to have my life held hostage by a company that has a change of heart regarding the cost of password availability. I had heard of Bitwarden before, and looked into it. The stack struck me as incredible for a security product: numerous services that need to be updated in-sync provides a wide surface area for attack, and ultimately encourages you to use their managed solution, IMO. Keepass is better, but the surface area is still quite broad. Ultimately, I settled on `pass`[1], made by the creator of wireguard. It takes advantage of a clever inversion of responsibilities, where clients store the passwords and sync with git. You can have a "dumb" git remote with no local private key; even if compromised there's not much to consume. Encryption is powered by GPG, so the security surface area is managing your private keys, which is a very well-understood problem. It's probably the best product for security-minded hacker types. As a simple offering (a shell wrapper around GPG + git), it's easy to build clients for, which means there are many OS/browser-integrated clients to choose from. Similarly, it was trivial to import everything from Lastpass. Maybe most important of all, once setup, it passed the spouse/parent test for me. They needed me there for setup, but once setup I haven't needed to give additional support for the last year, ymmv. [1]: https://www.passwordstore.org/ https://www.passwordstore.org/

rraghur 5y ago
I've tried pass and briefly flirted with running bitwarden rs but finally settled in keepass xc I take care of the sync (syncthing) but anything would work. I've never had issues with keepass's auto type so i wonder why it isn't as popular Mobile used to be aam issue earlier but there's now a top notch implementation keepassdx that's on f droid
jobu 5y ago
LastPass was great for almost 10 years until LogMeIn bought them and they've been messing around with the business model and pricing ever since. I paid $12/year for several years to get mobile access. Then after they were bought I was somehow automatically upgraded to their premium plan for $36/yr. They had given notice but it went into my Promotions inbox and it was months before I realized it. Every year since they've tried different pricing models and it's been frustrating to keep up with. I had been planning on switching over to Bitwarden in a couple months when my current LastPass subscription runs out, but I just found out that LogMeIn is spinning them off into a separate company again - https://www.zdnet.com/article/logmein-announces-plan-to-spin-off-lastpass-into-its-own-company/ https://www.zdnet.com/article/logmein-announces-plan-to-spin...
- cobertos 5y ago
  This is why I switched to Vaultwarden. The migration was at least simple (self-host server, export LastPass, import to BitWarden) and now I can save TOTP too. And syncing works better.
- Isthatablackgsd 5y ago
  > They had given notice but it went into my Promotions inbox and it was months before I realized it. That's why I have them disabled in my gmail accounts, I have several missed important emails because they landed in the wrong section. I disabled them in my work email too. My boss keep it on and it causes my boss issues with missing RFQ and requests. I went with Keepass, it is free, open source, cross-platform. Been using Keepass for 10 years. I control my data and my file, so I don't need to worry about potential data breach which several other SaaS password management failed to keep it secure. My keepass database (vault) resides in my OneDrive and synced across all of my devices that have Keepass. And I like Keepass will generate a backup of the database before saving the entry in case of corruption. It happened to me once 5 years ago and it was in Dropbox storage that time, somehow Dropbox failed to sync the change and ended up corrupting the synced vault across of my devices. I have 260+ entries in my keepass. Neat thing about Keepass, it can check haveibeenpwned.com and compare the password in my vault. It generated a list of password that need to be changed.
- gen220 5y ago
  Trusting a company with your most valuable long-term data (passwords, medical/family records, etc.) is a losing game on a long enough time horizon (5 years, let alone 15 or 25). You can arbitrage by trying to choose more than one. But IMO, the most robust solution is to make your data "dumb" and commoditize the storage layer. With something like pass, I have my passwords physically located on all my devices, encrypted at-rest. Plus, I have a backup on a home server that can be regularly backed up to any commodity storage provider (backblaze, aws, whatever). With this, you'd need to both lose (1) all your devices (2) internet access to those devices. This kind of thing is a bit predictable, and can be mitigated. With a managed secret-manager service, mere corporate shenanigans or internet connectivity problems can take them away from you! Those are less predictable, and the only mitigation is to move to a service that doesn't have these problems.

by gen220 5y ago

rraghur 5y ago

I've tried pass and briefly flirted with running bitwarden rs but finally settled in keepass xc I take care of the sync (syncthing) but anything would work. I've never had issues with keepass's auto type so i wonder why it isn't as popular Mobile used to be aam issue earlier but there's now a top notch implementation keepassdx that's on f droid

jobu 5y ago

LastPass was great for almost 10 years until LogMeIn bought them and they've been messing around with the business model and pricing ever since. I paid $12/year for several years to get mobile access. Then after they were bought I was somehow automatically upgraded to their premium plan for $36/yr. They had given notice but it went into my Promotions inbox and it was months before I realized it. Every year since they've tried different pricing models and it's been frustrating to keep up with. I had been planning on switching over to Bitwarden in a couple months when my current LastPass subscription runs out, but I just found out that LogMeIn is spinning them off into a separate company again - https://www.zdnet.com/article/logmein-announces-plan-to-spin-off-lastpass-into-its-own-company/ https://www.zdnet.com/article/logmein-announces-plan-to-spin...

cobertos 5y ago
This is why I switched to Vaultwarden. The migration was at least simple (self-host server, export LastPass, import to BitWarden) and now I can save TOTP too. And syncing works better.
Isthatablackgsd 5y ago
> They had given notice but it went into my Promotions inbox and it was months before I realized it. That's why I have them disabled in my gmail accounts, I have several missed important emails because they landed in the wrong section. I disabled them in my work email too. My boss keep it on and it causes my boss issues with missing RFQ and requests. I went with Keepass, it is free, open source, cross-platform. Been using Keepass for 10 years. I control my data and my file, so I don't need to worry about potential data breach which several other SaaS password management failed to keep it secure. My keepass database (vault) resides in my OneDrive and synced across all of my devices that have Keepass. And I like Keepass will generate a backup of the database before saving the entry in case of corruption. It happened to me once 5 years ago and it was in Dropbox storage that time, somehow Dropbox failed to sync the change and ended up corrupting the synced vault across of my devices. I have 260+ entries in my keepass. Neat thing about Keepass, it can check haveibeenpwned.com and compare the password in my vault. It generated a list of password that need to be changed.
gen220 5y ago
Trusting a company with your most valuable long-term data (passwords, medical/family records, etc.) is a losing game on a long enough time horizon (5 years, let alone 15 or 25). You can arbitrage by trying to choose more than one. But IMO, the most robust solution is to make your data "dumb" and commoditize the storage layer. With something like pass, I have my passwords physically located on all my devices, encrypted at-rest. Plus, I have a backup on a home server that can be regularly backed up to any commodity storage provider (backblaze, aws, whatever). With this, you'd need to both lose (1) all your devices (2) internet access to those devices. This kind of thing is a bit predictable, and can be mitigated. With a managed secret-manager service, mere corporate shenanigans or internet connectivity problems can take them away from you! Those are less predictable, and the only mitigation is to move to a service that doesn't have these problems.