11 ms·

How do people mange passwords themselves across laptop/tablet/mobile? I have been meaning to leave lastpass but always seems like too much hassle.

gabrielgio 4y ago
I use a third party app to sync the database file, in my case Nextcloud.
theSage 4y ago
I use KeepassXC + Syncthing. On a few devices that never connect to the same wifi i use tailscale to connect Syncthing.
- rglullis 4y ago
  Syncthing (the most recent versions, at least) also allows for password-encrypted sharing. So even if you are syncing across a relay, no data is in clear.
  - j0057 4y ago
    Relays can't see your data, because the connections between your synchthing instances are mTLS encrypted. Using an additional shared secret on a folder allows you to sync a folder to an untrusted device, which then itself only sees encrypted files.
_dain_ 4y ago
The password database is literally just A File On Your Computer. So any file synchronization tool will work. I use Syncthing.
sigio 4y ago
Vaultwarden self-hosted bitwarden and passwordstore.org
bhbh 4y ago
I keep my KeePass file on my OneDrive / iCloud account. This way it is always up to date as it syncs automatically after each change and my devices always open the most recent version.
2Gkashmiri 4y ago
you dont exactly need to have it hot synced imo. i've been running this scheme where i keep the "live" DB on my phone so any change i need to do, i do it on the phone and every often i sync or copy it to the laptop. this has served me well for like the past 6-9 years so i guess it works. You definitely do not need an online service. its not like passwords change like crazy. i've had entries that i only change because of stupid password reset policies (every 4 months for example), other than that, i only update the DB if i add a new entry.
ycombinete 4y ago
That part freaks me out about using keepass. That I need to use a third part app to access it on my phone.
- brokenmachine 4y ago
  Do you mean the App to open the password database, or the App for syncing the file? The kbdx file is encrypted, so given a strong password it should not matter how secure the app for syncing the file is. Most people seem to use it with syncthing.
InCityDreams 4y ago
Keepass on pc and on android. The android saves as .kdbx files, which once saved as such, the pc reads and writes (default is .kdb files). I also use a keyfile common to both devices. Manual sync as i update irregularly. Nothing touches a cloud, everything stays with me. My .kdbx files are steganographically encoded, and the file extension is changed. Seems cumbersome - isn't.
shoffmeister 4y ago
I use cloud storage to save my .kdbx file(s). On Linux and Windows, KeepassXC is my software of choice. On Android, I like (and have donated multiple times to) https://play.google.com/store/apps/details?id=keepass2android.keepass2android https://play.google.com/store/apps/details?id=keepass2androi... With the cloud storage setup (which, in my case, happens to be Google Drive), I always have the most recent version of my password safe(s) where I need them to be. With this, my major threat exposure comprises of * the cloud provider losing my data, letting an aggressor get hold of my (encrypted) password store(s) - and then the aggressor brute-forcing * I myself losing my password store data to an aggressor * I myself losing my password store credentials to an aggressor I am explicitly not using any of the online password providers simply because they are by themselves a much too valuable target. I myself, hopefully, am not valuable (or visible) enough, and therefore am not subject to "at-scale" attack patterns.
- noisy_boy 4y ago
  Same but I use Syncthing to sync the files between my laptop and phone. The database also gets backed to local backup + Backblaze B2.
- distances 4y ago
  Keepass2Android also has an offline version: https://play.google.com/store/apps/details?id=keepass2android.keepass2android_nonet https://play.google.com/store/apps/details?id=keepass2androi... I find this one nice, there's no need for a password manager to have Internet access when the database is synced with a separate client (in my case Nextcloud).
jeduardo 4y ago
pass (passwordstore.org) backed by a remote git repo works well across Linux, Windows, macOS, iOS, and Android, as all of them have decent clients available and there is working browser integration for all popular browsers using browserpass (https://github.com/browserpass/browserpass-extension https://github.com/browserpass/browserpass-extension). The learning curve to understand all the moving pieces and the initial setup can be more hassle than many are willing to put up with, but after the initial legwork is done, adding new devices is not that much more complicated than what it is on paid services, and using it is as simple as any of the popular services, IMHO.
- aborsy 4y ago
  In my opinion, this is one of the most secure options. Pass is a short bash bash script (very little code). It passes the encryption to a dedicated utility GnuPG (out of which only the AES and cv25519 routines are used). You should use smart card to store the GPG key. Every touch of the security key gives out only one password. So if you copy the HN password, other passwords such as your bank password is not at risk. The missing part is integration with browsers, which increases the attack surface (although it’s minimal here, since only one password is at stake), but protects against phishing. Pass probably doesn’t need an audit, since you can just read the script.
  - doubled112 4y ago
    Browserpass works pretty well. https://github.com/browserpass/browserpass-extension https://github.com/browserpass/browserpass-extension
  - codethief 4y ago
    > In my opinion, this is one of the most secure options. Only if you disregard that pass doesn't encrypt file names.
    - aborsy 4y ago
      That’s part of the appeal. It allows for sandboxing each password to its own vault essentially (you pay a privacy cost, which I don’t mind anyways, and my disk is encrypted). Gopass does encrypt file names too.
jordibc 4y ago
I encrypt with gpg and upload the .xkdb file (itself already encrypted) to a server I have access to with scp. Not manually, and not only for this file: this is a system I have to sync the files I want in different machines, by running a little program I wrote (https://gitlab.com/jordibc/csync https://gitlab.com/jordibc/csync just in case). I would use syncthing otherwise, but this system has several advantages for me. If I hadn't access to an online server, I'd use some cloud storage for the same thing.
Fire-Dragon-DoL 4y ago
I'll answer this for you since people circles around it: For people without need for sharing, use cloud storage. Make sure to use an app that protects from writes from different clients though. For people with need for sharing, you are doomed. (e. g. Family sharing)
- omnicognate 4y ago
  Not doomed in the least. I self-host vaultwarden (and many other services) on my home network and access them from mobile devices (web and/or bitwarden app) using wireguard.
  - Fire-Dragon-DoL 4y ago
    That requires a whole more competency than pasting a file on a cloud drive
    - omnicognate 4y ago
      We're on hackernews :-)
      - Fire-Dragon-DoL 4y ago
        I'm aware, just raising the flag
JohnTHaller 4y ago
For something like KeePassXC, sync your kdbx file across all of them with your choice of cloud drive. Secure it with a key file you manually add to each of your devices but do not include on your cloud drive and a good password.
Macha 4y ago
I self host vaultwarden (formerly bitwarden_rs) and use the bitwarden clients. This is more of a lastpass-esque experience than KeePass in a sync program, which was my previous solution from about 10 years ago to about 3 years ago when I switched to bitwarden.
- RussianCow 4y ago
  How do they compare? I've been eyeing Bitwarden for a while only because there's an iPhone in my household and it doesn't support Syncthing, so we end up manually syncing the DB on that device occasionally. It would be great to avoid that manual sync.
  - Macha 4y ago
    For me the big advantage was just never having to think about sync conflicts ever again, which happened to me often enough to be annoying. There's also things like the browser integration is more streamlined, using the bitwarden CLI is convenient in some of my automation, and while android supports syncthing, android has always been a bit less reliable in desktop platforms in allowing syncthing to run in the background or in allowing other apps to know that syncthing has updated a file.
    - elp 4y ago
      I use Dropbox for my mobile devices and keypassxc had been great. I had the same issues as you with syncyhing on mobile.
      - Macha 4y ago
        I actually moved from Dropbox to Syncthing as I found Syncthing more reliable, as Dropbox would sometimes generate spurious conflicts even between my desktop devices.
mdaniel 4y ago
> I have been meaning to leave lastpass but always seems like too much hassle I mean this in all seriousness: how have you stayed on Lastpass after the innumerable breaches? There's "my weekends are not best spent exporting and importing csvs" and then there's borderline criminal negligence of credentials one pays a company to keep safe I mean, it's your life, I'm just genuinely curious how that calculus plays out
- SV_BubbleTime 4y ago
  Let’s leave the hyperbole aside. It hasn’t been innumerable breaches. And none of the breaches have resulted in password loss if you used a strong pass phrase. All the talk about PBKFD2 iterations has been about preventing loss when you used a weak password. The same brute forcing for the most part also applies to keepass if you host your vault in ways that someone could access. I don’t love Lastpass in anyway, but let’s not pretend that there was outright catastrophe.
  - aborsy 4y ago
    It was very bad. It was bad that servers of a popular password manager with millions of users were compromised. The security controls were bad: a lastpass engineer had access to critical credentials in the same machine that he watches Plex open to internet (and possibly more). It was bad because a lot of users don’t have strong master passwords, and their vaults are at risk. Also, insufficient pbkdf2 iterations did not protect well against brute forcing the vault. Sure users should use strong master passwords as much as possible. But a weak password would not have been a problem if the servers had not been compromised. It was bad because a lot metadata has been leaked, that can be useful in further attacks. A compromised server could also push a malicious update to the users and steals master passwords.
- Barrin92 4y ago
  Lastpass like pretty much any modern password manager has zero knowledge of your encrypted vault so regardless of how crappy the service they physically cannot leak your data. This is the reason why encryption exists, to move secure information across not just insecure, but even adversarial channels. When you use cryptography you go through all the hassle exactly so you don't have to have a panic attack when a company behaves stupidly.
lotsofpulp 4y ago
KeepassXC and Strongbox, stored in iCloud Drive.
ducknalddon 4y ago
I keep my database in a git repo.
- remram 4y ago
  And then how do you sync the Git repo?
  - executesorder66 4y ago
    Device A -> git push to remote repo Device B -> git pull from remote repo ¯\_(ツ)_/¯
    - remram 4y ago
      Where do you host that remote repo? How do you push/pull from mobile?
      - chlorion 4y ago
        There is an app on Android at least called "pass" that allows you to do this. The Android pass app is developed and distributed by the same person who maintains the Android wireguard app iirc, otherwise I probably wouldn't have trusted it!
teo_zero 4y ago
Keepass + rclone to synchronize to Google Drive.
lamontcg 4y ago
I would recommend just switching to bitwarden for minimum-viable-not-lastpass. You can then choose at some later date to migrate to self-hosting or not.
txtsd 4y ago
Most people who use KPXC use SyncThing to sync their DB across devices.

gabrielgio 4y ago

I use a third party app to sync the database file, in my case Nextcloud.

theSage 4y ago

I use KeepassXC + Syncthing. On a few devices that never connect to the same wifi i use tailscale to connect Syncthing.

rglullis 4y ago
Syncthing (the most recent versions, at least) also allows for password-encrypted sharing. So even if you are syncing across a relay, no data is in clear.
- j0057 4y ago
  Relays can't see your data, because the connections between your synchthing instances are mTLS encrypted. Using an additional shared secret on a folder allows you to sync a folder to an untrusted device, which then itself only sees encrypted files.

_dain_ 4y ago

The password database is literally just A File On Your Computer. So any file synchronization tool will work. I use Syncthing.

sigio 4y ago

Vaultwarden self-hosted bitwarden and passwordstore.org

bhbh 4y ago

I keep my KeePass file on my OneDrive / iCloud account. This way it is always up to date as it syncs automatically after each change and my devices always open the most recent version.

2Gkashmiri 4y ago

you dont exactly need to have it hot synced imo. i've been running this scheme where i keep the "live" DB on my phone so any change i need to do, i do it on the phone and every often i sync or copy it to the laptop. this has served me well for like the past 6-9 years so i guess it works. You definitely do not need an online service. its not like passwords change like crazy. i've had entries that i only change because of stupid password reset policies (every 4 months for example), other than that, i only update the DB if i add a new entry.

ycombinete 4y ago

That part freaks me out about using keepass. That I need to use a third part app to access it on my phone.

brokenmachine 4y ago
Do you mean the App to open the password database, or the App for syncing the file? The kbdx file is encrypted, so given a strong password it should not matter how secure the app for syncing the file is. Most people seem to use it with syncthing.

InCityDreams 4y ago

Keepass on pc and on android. The android saves as .kdbx files, which once saved as such, the pc reads and writes (default is .kdb files). I also use a keyfile common to both devices. Manual sync as i update irregularly. Nothing touches a cloud, everything stays with me. My .kdbx files are steganographically encoded, and the file extension is changed. Seems cumbersome - isn't.

shoffmeister 4y ago

I use cloud storage to save my .kdbx file(s). On Linux and Windows, KeepassXC is my software of choice. On Android, I like (and have donated multiple times to) https://play.google.com/store/apps/details?id=keepass2android.keepass2android https://play.google.com/store/apps/details?id=keepass2androi... With the cloud storage setup (which, in my case, happens to be Google Drive), I always have the most recent version of my password safe(s) where I need them to be. With this, my major threat exposure comprises of * the cloud provider losing my data, letting an aggressor get hold of my (encrypted) password store(s) - and then the aggressor brute-forcing * I myself losing my password store data to an aggressor * I myself losing my password store credentials to an aggressor I am explicitly not using any of the online password providers simply because they are by themselves a much too valuable target. I myself, hopefully, am not valuable (or visible) enough, and therefore am not subject to "at-scale" attack patterns.

noisy_boy 4y ago
Same but I use Syncthing to sync the files between my laptop and phone. The database also gets backed to local backup + Backblaze B2.
distances 4y ago
Keepass2Android also has an offline version: https://play.google.com/store/apps/details?id=keepass2android.keepass2android_nonet https://play.google.com/store/apps/details?id=keepass2androi... I find this one nice, there's no need for a password manager to have Internet access when the database is synced with a separate client (in my case Nextcloud).

jeduardo 4y ago

pass (passwordstore.org) backed by a remote git repo works well across Linux, Windows, macOS, iOS, and Android, as all of them have decent clients available and there is working browser integration for all popular browsers using browserpass (https://github.com/browserpass/browserpass-extension https://github.com/browserpass/browserpass-extension). The learning curve to understand all the moving pieces and the initial setup can be more hassle than many are willing to put up with, but after the initial legwork is done, adding new devices is not that much more complicated than what it is on paid services, and using it is as simple as any of the popular services, IMHO.

aborsy 4y ago
In my opinion, this is one of the most secure options. Pass is a short bash bash script (very little code). It passes the encryption to a dedicated utility GnuPG (out of which only the AES and cv25519 routines are used). You should use smart card to store the GPG key. Every touch of the security key gives out only one password. So if you copy the HN password, other passwords such as your bank password is not at risk. The missing part is integration with browsers, which increases the attack surface (although it’s minimal here, since only one password is at stake), but protects against phishing. Pass probably doesn’t need an audit, since you can just read the script.
- doubled112 4y ago
  Browserpass works pretty well. https://github.com/browserpass/browserpass-extension https://github.com/browserpass/browserpass-extension
- codethief 4y ago
  > In my opinion, this is one of the most secure options. Only if you disregard that pass doesn't encrypt file names.
  - aborsy 4y ago
    That’s part of the appeal. It allows for sandboxing each password to its own vault essentially (you pay a privacy cost, which I don’t mind anyways, and my disk is encrypted). Gopass does encrypt file names too.

jordibc 4y ago

I encrypt with gpg and upload the .xkdb file (itself already encrypted) to a server I have access to with scp. Not manually, and not only for this file: this is a system I have to sync the files I want in different machines, by running a little program I wrote (https://gitlab.com/jordibc/csync https://gitlab.com/jordibc/csync just in case). I would use syncthing otherwise, but this system has several advantages for me. If I hadn't access to an online server, I'd use some cloud storage for the same thing.

Fire-Dragon-DoL 4y ago

I'll answer this for you since people circles around it: For people without need for sharing, use cloud storage. Make sure to use an app that protects from writes from different clients though. For people with need for sharing, you are doomed. (e. g. Family sharing)

omnicognate 4y ago
Not doomed in the least. I self-host vaultwarden (and many other services) on my home network and access them from mobile devices (web and/or bitwarden app) using wireguard.
- Fire-Dragon-DoL 4y ago
  That requires a whole more competency than pasting a file on a cloud drive
  - omnicognate 4y ago
    We're on hackernews :-)
    - Fire-Dragon-DoL 4y ago
      I'm aware, just raising the flag

JohnTHaller 4y ago

For something like KeePassXC, sync your kdbx file across all of them with your choice of cloud drive. Secure it with a key file you manually add to each of your devices but do not include on your cloud drive and a good password.

Macha 4y ago

I self host vaultwarden (formerly bitwarden_rs) and use the bitwarden clients. This is more of a lastpass-esque experience than KeePass in a sync program, which was my previous solution from about 10 years ago to about 3 years ago when I switched to bitwarden.

RussianCow 4y ago
How do they compare? I've been eyeing Bitwarden for a while only because there's an iPhone in my household and it doesn't support Syncthing, so we end up manually syncing the DB on that device occasionally. It would be great to avoid that manual sync.
- Macha 4y ago
  For me the big advantage was just never having to think about sync conflicts ever again, which happened to me often enough to be annoying. There's also things like the browser integration is more streamlined, using the bitwarden CLI is convenient in some of my automation, and while android supports syncthing, android has always been a bit less reliable in desktop platforms in allowing syncthing to run in the background or in allowing other apps to know that syncthing has updated a file.
  - elp 4y ago
    I use Dropbox for my mobile devices and keypassxc had been great. I had the same issues as you with syncyhing on mobile.
    - Macha 4y ago
      I actually moved from Dropbox to Syncthing as I found Syncthing more reliable, as Dropbox would sometimes generate spurious conflicts even between my desktop devices.

mdaniel 4y ago

> I have been meaning to leave lastpass but always seems like too much hassle I mean this in all seriousness: how have you stayed on Lastpass after the innumerable breaches? There's "my weekends are not best spent exporting and importing csvs" and then there's borderline criminal negligence of credentials one pays a company to keep safe I mean, it's your life, I'm just genuinely curious how that calculus plays out

SV_BubbleTime 4y ago
Let’s leave the hyperbole aside. It hasn’t been innumerable breaches. And none of the breaches have resulted in password loss if you used a strong pass phrase. All the talk about PBKFD2 iterations has been about preventing loss when you used a weak password. The same brute forcing for the most part also applies to keepass if you host your vault in ways that someone could access. I don’t love Lastpass in anyway, but let’s not pretend that there was outright catastrophe.
- aborsy 4y ago
  It was very bad. It was bad that servers of a popular password manager with millions of users were compromised. The security controls were bad: a lastpass engineer had access to critical credentials in the same machine that he watches Plex open to internet (and possibly more). It was bad because a lot of users don’t have strong master passwords, and their vaults are at risk. Also, insufficient pbkdf2 iterations did not protect well against brute forcing the vault. Sure users should use strong master passwords as much as possible. But a weak password would not have been a problem if the servers had not been compromised. It was bad because a lot metadata has been leaked, that can be useful in further attacks. A compromised server could also push a malicious update to the users and steals master passwords.
Barrin92 4y ago
Lastpass like pretty much any modern password manager has zero knowledge of your encrypted vault so regardless of how crappy the service they physically cannot leak your data. This is the reason why encryption exists, to move secure information across not just insecure, but even adversarial channels. When you use cryptography you go through all the hassle exactly so you don't have to have a panic attack when a company behaves stupidly.

lotsofpulp 4y ago

KeepassXC and Strongbox, stored in iCloud Drive.

ducknalddon 4y ago

I keep my database in a git repo.

remram 4y ago
And then how do you sync the Git repo?
- executesorder66 4y ago
  Device A -> git push to remote repo Device B -> git pull from remote repo ¯\_(ツ)_/¯
  - remram 4y ago
    Where do you host that remote repo? How do you push/pull from mobile?
    - chlorion 4y ago
      There is an app on Android at least called "pass" that allows you to do this. The Android pass app is developed and distributed by the same person who maintains the Android wireguard app iirc, otherwise I probably wouldn't have trusted it!

teo_zero 4y ago

Keepass + rclone to synchronize to Google Drive.

lamontcg 4y ago

I would recommend just switching to bitwarden for minimum-viable-not-lastpass. You can then choose at some later date to migrate to self-hosting or not.

txtsd 4y ago

Most people who use KPXC use SyncThing to sync their DB across devices.