4 ms·

> why a password manager should be a SaaS While I fully agree with you, how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering? Wh

by itake 4y ago

> why a password manager should be a SaaS While I fully agree with you, how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering? While I don't use this feature, but it is common for ppl to share an account. How can I securely share credentials with family members?

jrm4 4y ago
But what you're really asking is how can you share them conveniently and quickly. Maybe the answer is, you can't. Write them down, text each other, call each other and read it over the phone. Making a spare key for my parents to get in my house isn't "click a button easy," I have to go to the hardware store -- and maybe THAT'S the appropriate level of difficulty.
- solardev 4y ago
  I'd rather just pay for the subscription, honestly. Especially in a bigger family or team / company context. To each their own.
  - jrm4 4y ago
    I'd advise against it. Again, what many of us are saying is third party password managers are always a bad idea for fundamental reasons. Before, it was just the account owners and the site. Now there's a third party that has some kind of access, and that third party is a juicy target. Under what guarantee then? Why believe they are safe, especially since time has shown that many are not. It's dumb, and I will continue to maintain that it's dumb right up until one of these companies offers indemnifcation or some other serious grown-up guarantee. I will pay for your service if and only if you pay me if/when you mess up.
    - solardev 4y ago
      The modicum of security these companies offer are better than the nonexistent security practices at the places I've worked for, lol. I trust them way more than the average user or small business.
      - jrm4 4y ago
        ya got me there. but still, we can do better :)
        verinus 4y ago
        we can, but the average user not! if you are tech savvy, like to keep up to date on security and are ok with the hassle of setting up a NAS, sync stuff and know how to keep it secure, perhaps. If you had to pay me to do it for you, a few dollars service fee might be much cheaper...
dj_mc_merlin 4y ago
Don't. Sharing a Netflix account with your family is easy. Send it in the whatsapp group if you need to change the password or something -- how often are you going to do that in your life? Not enough to justify handing over all of your password to a 3rd party and paying them money for it. Anything more important than a Netflix account you don't share at all. If they need access, just call them.
- itake 4y ago
  > how often are you going to do that in your life? Small startups use password sharing tools to share passwords with new employees (think db passwords or other saas accounts). This happens at least a once per month in a 10 person organization.
  - dj_mc_merlin 4y ago
    That's the intended use case IMO and it absolutely makes sense. I used to share passwords in Slack before and that made me uneasy, the company investing in a password sharing SaaS absolutely made sense. However, I do not manage 100+ people at home and thus have no need of one.
droobles 4y ago
I use Firefox's built in password manager and it syncs across all my devices pretty well. The UX is not great because on mobile I have to navigate to Firefox, go to Logins, type in my phone's passcode, then search for and copy the right password, but it's secure and works well enough.
f1refly 4y ago
> how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering? Syncthing. Set up once, runs reliably forever. > How can I securely share credentials with family members? I don't do this either (and don't know anyone who does) but I imagine it'd be easy to just create a different shared database for the family for that? With password store, it's also possible to set multiple different gpg keys for a specific directory. I don't think the last option is doable for most people though.
- itake 4y ago
  Syncthing doesn't work for iOS https://forum.syncthing.net/t/syncthing-for-ios/16045 https://forum.syncthing.net/t/syncthing-for-ios/16045 > it's also possible to set multiple different gpg keys for a specific directory. I don't think the last option is doable for most people though. this seems really complex...
  - nszceta 4y ago
    I used syncthing for years and never heard of those features keepassxc + syncthing this is the way android: keepassdx off f-droid + syncthing
  - f1refly 4y ago
    Of course it doesn't work on ios. The issue you linked explains that a syncthing ios implementation would be useless because the background process can't run and the way filesystem access is managed makes the whole thing more or less pointless. It's available on all better operating systems though: Windows, macos, gnu/linux, android/linux, I think even chromebooks can run it? > this seems really complex... Like I said, it's probably not a solution for many. A second database with shared secret is very straightforward and transparent way that anyone can grasp I think. It would definitely pass the family test for me.
  - alwayslikethis 4y ago
    that's on Apple, not on Syncthing. Guess what, when you lock down your devices so much they can't perform many useful functions. Next time, just get a phone you can actually own.
janef0421 4y ago
You can use a keepass file synchronised with syncthing or a similar peer-to-peer sync system. To securely share credentials, you can share a separate password file with a unique password. There might be issue with file conflicts, but I find these can usually be managed manually; You might also be able to use a crontab.
jonathankoren 4y ago
Syncing? Just load it onto some cloud storage provider you already have. That’s what 1Password used for years before they decided to go the subscription route. It worked great.
thewebcount 4y ago
> how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering? With 1Password 7 I did this with their built-in local syncing feature. I don’t want my passwords in the cloud. I’m happy to manually sync them once a month (or probably less these days). But they removed it in version 8 and forced users into a subscription so I’m not upgrading. Eventually I’ll move to something else, but it’s still working for now.
gog 4y ago
I keep a Keepass compatible password database file in my iCloud folder so I can access it from my computer and my phone with appropriate apps.
- MisterSandman 4y ago
  So it's still SaaS, except you're using it for storage and sync and doing the password stuff yourself.
  - gog 4y ago
    My passwords are encrypted without a SaaS, they way I want to sync them is using a SaaS, but a different, one of my choosing.
qkls 4y ago
With Bitwarden you can sync on the free plan.

by itake 4y ago

jrm4 4y ago

But what you're really asking is how can you share them conveniently and quickly. Maybe the answer is, you can't. Write them down, text each other, call each other and read it over the phone. Making a spare key for my parents to get in my house isn't "click a button easy," I have to go to the hardware store -- and maybe THAT'S the appropriate level of difficulty.

solardev 4y ago
I'd rather just pay for the subscription, honestly. Especially in a bigger family or team / company context. To each their own.
- jrm4 4y ago
  I'd advise against it. Again, what many of us are saying is third party password managers are always a bad idea for fundamental reasons. Before, it was just the account owners and the site. Now there's a third party that has some kind of access, and that third party is a juicy target. Under what guarantee then? Why believe they are safe, especially since time has shown that many are not. It's dumb, and I will continue to maintain that it's dumb right up until one of these companies offers indemnifcation or some other serious grown-up guarantee. I will pay for your service if and only if you pay me if/when you mess up.
  - solardev 4y ago
    The modicum of security these companies offer are better than the nonexistent security practices at the places I've worked for, lol. I trust them way more than the average user or small business.
    - jrm4 4y ago
      ya got me there. but still, we can do better :)
      - verinus 4y ago
        we can, but the average user not! if you are tech savvy, like to keep up to date on security and are ok with the hassle of setting up a NAS, sync stuff and know how to keep it secure, perhaps. If you had to pay me to do it for you, a few dollars service fee might be much cheaper...

dj_mc_merlin 4y ago

Don't. Sharing a Netflix account with your family is easy. Send it in the whatsapp group if you need to change the password or something -- how often are you going to do that in your life? Not enough to justify handing over all of your password to a 3rd party and paying them money for it. Anything more important than a Netflix account you don't share at all. If they need access, just call them.

itake 4y ago
> how often are you going to do that in your life? Small startups use password sharing tools to share passwords with new employees (think db passwords or other saas accounts). This happens at least a once per month in a 10 person organization.
- dj_mc_merlin 4y ago
  That's the intended use case IMO and it absolutely makes sense. I used to share passwords in Slack before and that made me uneasy, the company investing in a password sharing SaaS absolutely made sense. However, I do not manage 100+ people at home and thus have no need of one.

droobles 4y ago

I use Firefox's built in password manager and it syncs across all my devices pretty well. The UX is not great because on mobile I have to navigate to Firefox, go to Logins, type in my phone's passcode, then search for and copy the right password, but it's secure and works well enough.

f1refly 4y ago

> how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering? Syncthing. Set up once, runs reliably forever. > How can I securely share credentials with family members? I don't do this either (and don't know anyone who does) but I imagine it'd be easy to just create a different shared database for the family for that? With password store, it's also possible to set multiple different gpg keys for a specific directory. I don't think the last option is doable for most people though.

itake 4y ago
Syncthing doesn't work for iOS https://forum.syncthing.net/t/syncthing-for-ios/16045 https://forum.syncthing.net/t/syncthing-for-ios/16045 > it's also possible to set multiple different gpg keys for a specific directory. I don't think the last option is doable for most people though. this seems really complex...
- nszceta 4y ago
  I used syncthing for years and never heard of those features keepassxc + syncthing this is the way android: keepassdx off f-droid + syncthing
- f1refly 4y ago
  Of course it doesn't work on ios. The issue you linked explains that a syncthing ios implementation would be useless because the background process can't run and the way filesystem access is managed makes the whole thing more or less pointless. It's available on all better operating systems though: Windows, macos, gnu/linux, android/linux, I think even chromebooks can run it? > this seems really complex... Like I said, it's probably not a solution for many. A second database with shared secret is very straightforward and transparent way that anyone can grasp I think. It would definitely pass the family test for me.
- alwayslikethis 4y ago
  that's on Apple, not on Syncthing. Guess what, when you lock down your devices so much they can't perform many useful functions. Next time, just get a phone you can actually own.

janef0421 4y ago

You can use a keepass file synchronised with syncthing or a similar peer-to-peer sync system. To securely share credentials, you can share a separate password file with a unique password. There might be issue with file conflicts, but I find these can usually be managed manually; You might also be able to use a crontab.

jonathankoren 4y ago

Syncing? Just load it onto some cloud storage provider you already have. That’s what 1Password used for years before they decided to go the subscription route. It worked great.

thewebcount 4y ago

> how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering? With 1Password 7 I did this with their built-in local syncing feature. I don’t want my passwords in the cloud. I’m happy to manually sync them once a month (or probably less these days). But they removed it in version 8 and forced users into a subscription so I’m not upgrading. Eventually I’ll move to something else, but it’s still working for now.

gog 4y ago

I keep a Keepass compatible password database file in my iCloud folder so I can access it from my computer and my phone with appropriate apps.

MisterSandman 4y ago
So it's still SaaS, except you're using it for storage and sync and doing the password stuff yourself.
- gog 4y ago
  My passwords are encrypted without a SaaS, they way I want to sync them is using a SaaS, but a different, one of my choosing.

qkls 4y ago

With Bitwarden you can sync on the free plan.