3 ms·

Let this be your Last non-selfhosted Pass solution.

simpleguitar 5y ago
Self hosting sucks for an average user, and terrible for a mobile user. It is possible to have hosted password solution that is secure, so why not use it? This is basically the same "cloud" vs "on-prem" debate. Cloud won, I think.
- jimsi 5y ago
  I use KeePassDX on Android and KeePassXC on a laptop, and they are synced with Syncthing. I have no issues with this setup
  - Isthatablackgsd 5y ago
    That is not selfhosting. Selfhosting means web/cloud applications maintained by the users. Technically Syncthing is selfhosting but Keepass variants are not. So your setup is not really selfhosting because you are not hosting Keepass in the webserver.
- qzx_pierri 5y ago
  My setup: - Windows Desktop - Macbook Air I installed Keepass on my windows desktop along with iCloud drive sync. I keep my Keepass database in my iCloud directory. I can now use this Keepass database on my iPhone (via Files app), on my Macbook (iCloud Drive). Any changes made are automatically synced daily. Is that really too difficult? And yes, it does "just work". Bonus: Any passwords stored in my iCloud Keychain are also synced to my Windows Chrome instance via Apple's 'iCloud Passwords'[1] plugin. [1] https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj https://chrome.google.com/webstore/detail/icloud-passwords/p...
  - blondin 5y ago
    love this setup. are you able to sync your keepass database to your windows machine? i need to add this one drawback for people to keep in mind. and also because it happened recently and made hn frontpage. apple can decide to suspend your account for one reason or another. it is very rare but can definitely happen.
  - julianlam 5y ago
    For what it's worth, my attempt at using Keepass drove me away because the password database kept becoming conflicted, necessitating a merge. Keepass' options for dealing with conflicts were to "accept mine" or "accept theirs", but I'd often end up in situations where the conflict went sideways and I lost my login completely. In the end I was running the conflict resolution command once every couple days. Normally I wouldn't mind, but the only time the warning comes up saying that my db file is conflicted is when I need to enter a password in... which is the last time I want to be dealing with this. This was Keepass with the db file on Dropbox, by the way. Not sure how Syncthing would handle it differently, but it wouldn't have anything to do with merging db files if they go out of sync.
    - Narigo 5y ago
      I had this problem as well, these conflicts may happen when you keep Keepass clients open and add passwords on two different machines. I have written a CLI tool in Rust called keepass-diff that may help you with this: https://github.com/Narigo/keepass-diff https://github.com/Narigo/keepass-diff
    - exlurker 5y ago
      This used to be a problem for me too, but later versions of Keepass happily syncs any conflicting databases. I use Syncthing to share my database.
- jtbayly 5y ago
  The fact that 1Pass is dropping local hosting means I’ll be dropping 1Pass.
laurent123456 5y ago
Securing a server is hard for the average user. But in any case LastPass uses E2EE so if the password was compromised that's most likely on client side, and for this self-hosted or not would make no difference.
- CyberRage 5y ago
  While I agree, Cloud based PM do have other issues. Mainly with compromised\rogue updates, you push a malicious update to customers and then get access without needing to compromise the hosts. Very similar to a supply-chain attack.
kgwxd 5y ago
I prefer to keep my password db off the internet all together. I just copy it from my PC to my phone whenever I make a change.
jcoq 5y ago
That has almost nothing to do with it. It's about convenience vs security, and specifically, auto-filled passwords across devices and applications. Anything that provides such a feature will be inherently less secure than an encrypted file. If LastPass and others are to blame for anything, it would possibly be their marketing around the this tradeoff, though I think they avoid direct misrepresentation by just avoiding the issue completely.
arthur_sav 5y ago
No no. Everything has to be hosted on the cloud with a monthly subscription.
- robbedpeter 5y ago
  Exactly, otherwise how will you ever get updates or product support?
Isthatablackgsd 5y ago
Selfhosting solution is not always the answer. It can be effective if everyone knows how to set it up. However, I imagine 90% (I want to say 99.99%) of world population don't have knowledge or the skill to set it up. I tried selfhosting in the past and it is painful process to set it up since I don't have an experience with it and the documentations on selfhosting are barely minimal. I tried selfhost an RSS Reader (FreshRSS) through webserver that are closed off to the public network. It is rewarding BUT frustrating experience for me beacuse of how much it needs to be functional. And don't forget the difficulty of setting up a CA for the HTTPS (SSL/TLS), it is PITA to set it up and it kept having problems. I am considering Caddy server since it generates its own CA automatically. Their documentation are not beginner-friendly and requires some prior knowledge to set it up.
- Krasnol 5y ago
  Let them use a single, tiny file from Keepass as an alternative to self hosting. It's doable. I managed to teach a 50+ year old to do it.
akho 5y ago
Self-hosting is slightly better as you are not creating a honeypot. But it’s not inherently more secure against client-side attacks (browser extensions, mobile apps), and adds its own attack vectors (put a contaminated version on DockerHub). I still self-host.

Self hosting sucks for an average user, and terrible for a mobile user. It is possible to have hosted password solution that is secure, so why not use it? This is basically the same "cloud" vs "on-prem" debate. Cloud won, I think.

jimsi 5y ago
I use KeePassDX on Android and KeePassXC on a laptop, and they are synced with Syncthing. I have no issues with this setup
- Isthatablackgsd 5y ago
  That is not selfhosting. Selfhosting means web/cloud applications maintained by the users. Technically Syncthing is selfhosting but Keepass variants are not. So your setup is not really selfhosting because you are not hosting Keepass in the webserver.
qzx_pierri 5y ago
My setup: - Windows Desktop - Macbook Air I installed Keepass on my windows desktop along with iCloud drive sync. I keep my Keepass database in my iCloud directory. I can now use this Keepass database on my iPhone (via Files app), on my Macbook (iCloud Drive). Any changes made are automatically synced daily. Is that really too difficult? And yes, it does "just work". Bonus: Any passwords stored in my iCloud Keychain are also synced to my Windows Chrome instance via Apple's 'iCloud Passwords'[1] plugin. [1] https://chrome.google.com/webstore/detail/icloud-passwords/pejdijmoenmkgeppbflobdenhhabjlaj https://chrome.google.com/webstore/detail/icloud-passwords/p...
- blondin 5y ago
  love this setup. are you able to sync your keepass database to your windows machine? i need to add this one drawback for people to keep in mind. and also because it happened recently and made hn frontpage. apple can decide to suspend your account for one reason or another. it is very rare but can definitely happen.
- julianlam 5y ago
  For what it's worth, my attempt at using Keepass drove me away because the password database kept becoming conflicted, necessitating a merge. Keepass' options for dealing with conflicts were to "accept mine" or "accept theirs", but I'd often end up in situations where the conflict went sideways and I lost my login completely. In the end I was running the conflict resolution command once every couple days. Normally I wouldn't mind, but the only time the warning comes up saying that my db file is conflicted is when I need to enter a password in... which is the last time I want to be dealing with this. This was Keepass with the db file on Dropbox, by the way. Not sure how Syncthing would handle it differently, but it wouldn't have anything to do with merging db files if they go out of sync.
  - Narigo 5y ago
    I had this problem as well, these conflicts may happen when you keep Keepass clients open and add passwords on two different machines. I have written a CLI tool in Rust called keepass-diff that may help you with this: https://github.com/Narigo/keepass-diff https://github.com/Narigo/keepass-diff
  - exlurker 5y ago
    This used to be a problem for me too, but later versions of Keepass happily syncs any conflicting databases. I use Syncthing to share my database.
jtbayly 5y ago
The fact that 1Pass is dropping local hosting means I’ll be dropping 1Pass.

laurent123456 5y ago

Securing a server is hard for the average user. But in any case LastPass uses E2EE so if the password was compromised that's most likely on client side, and for this self-hosted or not would make no difference.

CyberRage 5y ago
While I agree, Cloud based PM do have other issues. Mainly with compromised\rogue updates, you push a malicious update to customers and then get access without needing to compromise the hosts. Very similar to a supply-chain attack.

kgwxd 5y ago

I prefer to keep my password db off the internet all together. I just copy it from my PC to my phone whenever I make a change.

jcoq 5y ago

That has almost nothing to do with it. It's about convenience vs security, and specifically, auto-filled passwords across devices and applications. Anything that provides such a feature will be inherently less secure than an encrypted file. If LastPass and others are to blame for anything, it would possibly be their marketing around the this tradeoff, though I think they avoid direct misrepresentation by just avoiding the issue completely.

arthur_sav 5y ago

No no. Everything has to be hosted on the cloud with a monthly subscription.

robbedpeter 5y ago
Exactly, otherwise how will you ever get updates or product support?

Isthatablackgsd 5y ago

Selfhosting solution is not always the answer. It can be effective if everyone knows how to set it up. However, I imagine 90% (I want to say 99.99%) of world population don't have knowledge or the skill to set it up. I tried selfhosting in the past and it is painful process to set it up since I don't have an experience with it and the documentations on selfhosting are barely minimal. I tried selfhost an RSS Reader (FreshRSS) through webserver that are closed off to the public network. It is rewarding BUT frustrating experience for me beacuse of how much it needs to be functional. And don't forget the difficulty of setting up a CA for the HTTPS (SSL/TLS), it is PITA to set it up and it kept having problems. I am considering Caddy server since it generates its own CA automatically. Their documentation are not beginner-friendly and requires some prior knowledge to set it up.

Krasnol 5y ago
Let them use a single, tiny file from Keepass as an alternative to self hosting. It's doable. I managed to teach a 50+ year old to do it.

akho 5y ago

Self-hosting is slightly better as you are not creating a honeypot. But it’s not inherently more secure against client-side attacks (browser extensions, mobile apps), and adds its own attack vectors (put a contaminated version on DockerHub). I still self-host.