5 ms·

My running note on self-hosted password managers: 1password: since version 8, dead due to cloud-only-now, not standalone, its over-usage of Electron web and it

My running note on self-hosted password managers: 1password: since version 8, dead due to cloud-only-now, not standalone, its over-usage of Electron web and its many unverified modules/libraries; remote storage of password only in encrypted form. Key stays offline. vaultwarden: yet another Electron web app and its usage of many unverified modules/libraries; remote storage of password only in encrypted form. Key stays offline. KeepassXC, with syncthing: leading contender, best-self-hosted solution that stores password remotely only in encrypted form. but still has iOS unverifiable source code imposed by Apple. Key stays offline. NordPass: best zero knowledge remote storage; has apps for Windows, macOS, Linux, Android, and iOS. When it comes to browser extensions, one would be hard-pressed to find a wider selection. You can install NordPass on Chrome, Firefox, Safari, Opera, Brave, Vivaldi, and Edge. Not open-source. LassPass, hacked in 2022; remote storage of raw passwords pwsafe, still is the safest CLI-only solution to date. The design of pwsafe (Password Safe CLI) got started by Bruce Schnier, the crypto security privacy expert. In pwsafe, unbroken TwoFish algorithm is still being used instead of currently safer Argon2i, simply because it's faster (after millions of iterations). The recommended client-wise of PasswordSafe is still Netwrix (formerly MATESO of Germany) PasswordSafe with YubiKey but stay away from its web-client variants due to ease of memory access to JavaScript variable names (by OS, browser, JS engine, and JS language) Only downside for ANY PasswordSafe-design GUI client is trusting yet another app repository source.

Aaron2222 3y ago
> Electron web and its many unverified modules/libraries What do you mean by this? That Electron itself uses unverified modules/libraries, or that 1Password is? And do you have any citations for this?
- egberts1 3y ago
  [dead]
pjmlp 3y ago
Unfortunately 1password has been a requirement in many projects I have been involved with.
- egberts1 3y ago
  You should post the name of those companies in here so we know who not to hire. But I suspect you would be a contractor and probably would not be able to. :-)
  - Shannon25 3y ago
    [dead]
  - braddanielle2 3y ago
    [dead]
js2 3y ago
I'll add a self-hosted option that no one ever mentions – PasswordWallet: https://www.passwordwallet.com/ https://www.passwordwallet.com/ I use iCloud Keychain for most of my passwords these days, but my critical passwords I continue to keep in PW as well. PW also has an occasionally very useful feature that I have not seen in any other password manager: auto type. Sometimes I just need to point my cursor somewhere and have the password typed for me (e.g. into a login screen on a VNC/RDP connection). PW uses Blowfish with 448-bit keys. There is also "pass" (from the author of Wireguard) which is essentially a shell script wrapper around gpg and git: https://www.passwordstore.org/ https://www.passwordstore.org/
- sgu999 3y ago
  I've been using "pass" for years and love it. There is also a very nice iOS app that works well and is open source. I synchronise my devices and backup directly without a central repo. Its only flaw is gpg's poor UX...
  - alwaysbeconsing 3y ago
    There is a fork of pass called "passage" that uses Age for encryption instead: https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage Unfortunately I don't believe any iOS/Android apps exist to work with it so far.
- egberts1 3y ago
  Yeah. Auto-typing of password-related field is a relatively new security feature that got its start in Apple iOS. While password auto-type is also found in Android, its security model is not quite a firm Bell-LaPadula yet like those implemented in Apple iOS/MacOS. Exposing API to monitoring keystrokes remains problematic for any OSes.
  - zuprau 3y ago
    > relatively new security feature Maybe I'm misunderstanding the feature, but I've been auto-filling login forms since I was using IE7 with RoboForm. Other than using Touch ID to trigger the auto-fill instead of 1 click, I don't see any improvements in iOS/macOS Safari.
deleted 3y ago
[deleted]
yoyohello13 3y ago
No Bitwarden?
- sphars 3y ago
  They mentioned vaultwarden, which is a self-hosted backend for Bitwarden
  - yoyohello13 3y ago
    Oh, I see. I hadn't heard of Vaultwarden. edit: It was recently renamed from bitwarden_rs which I was familiar with.
  - seized 3y ago
    Except they are different. One is a clone, BitWarden also has a self hostable version of their own backend.
Dalewyn 3y ago
>You can install NordPass on Chrome, Firefox, Safari, Opera, Brave, Vivaldi, and Edge. So Chrome, Firefox, Safari, Chrome, Chrome, Chrome, and Chrome?
- egberts1 3y ago
  Update: this post is wrong. Edge preserves and utilize Chrome app APIs. AFAICT, There is nothing Chrome about Edge.
  - sc00ty 3y ago
    Edge is based on Chromium and can install all the same extensions from the chrome web store directly.
    - egberts1 3y ago
      Thanks. Considered myself informed given that I stay away from Edge.
lxgr 3y ago
> LassPass, hacked in 2022; remote storage of raw passwords I know that it's been one dumpster fire after the other in the past few years, but did they actually go as far? The most severe one I remember hearing of was a leak of (possibly insufficiently salted, depending on the age of the account) encrypted password vaults. Still, I'll never again consider or recommend them going forward. > In pwsafe, unbroken TwoFish algorithm is still being used instead of currently safer Argon2i This is actually a negative point for it, in my view. AES is just as unbroken, yet has received considerably more scrutiny over the years. The only place were non-AES symmetric algorithms still make sense these days is platforms where hardware acceleration is not available (e.g. djb's Salsa/Chacha), and even there only for high-throughput applications, which a password safe decidedly isn't. > The recommended client-wise of PasswordSafe is still Netwrix (formerly MATESO of Germany) I've never heard of them. Is it open source or at least properly audited?
- egberts1 3y ago
  Update: This post is half-wrong; Salsa is a streaming cipher and AES is a block cipher and one still need a PBKDF mechanism to construct a safer key. Problem with AES and Salsa is that salting is required for smaller-sized password and are not considered a "hashing" algorithm; those two are block ciphers, as I recall. No, MATESO is not open source but with an enterprise license, you can negotiate for the source code. And they have contracted audits against their software. Netwrix PasswordSafe is more enterprise-ready with their SOC 2, ISO 27001 and HIPAA compliance but that is a moot point for most SMBs, SMEs, family-servers and homelabs.
  - lxgr 3y ago
    AES and Twofish are both block ciphers. Neither are hasing algorithms, and you'll need a PBKDF or some other construction to derive a key for either, no? Salsa is a stream cipher.
    - egberts1 3y ago
      Right. thanks for the update. My note should have been consulted as you being correct. Hate my memory nowadays. Need to consult some more notes before speaking.
ssbash 3y ago
Strongbox is a fantastic KeePass client on iOS and macOS. - fully native apps - open source - fully offline option (Strongbox Zero) - one time purchase - solid browser extensions for Chrome and Firefox - native keychain autofill for Safari and Orion - compatible with other KeePass apps on other platforms - multiple sync options iCloud, G Drive, Dropbox, OneDrive, SFTP, WebDav, Syncthing - support for offline vaults - biometrics, Apple Watch unlock, and Yubikey support - TOTP codes, attachments, and markdown notes can be stored - supports password auditing with Have I Been Pwned - supports importing 1PW vaults Most importantly, Strongbox is made by a small and transparent company. Unlike Bitwarden or 1Password, they are solely focused on making high quality macOS and iOS apps. https://strongboxsafe.com https://strongboxsafe.com
- egberts1 3y ago
  I really really like Strongbox. My only resistance from going the route of strongboxsafe is the lack of app-specific PIN, opposed to OS-specific PIN that is still missing from the free version. While a master password covers the specific database, the PIN covers the app. This is a problem for me there: 1. No OS-specific PIN/passcode in free version A wider acceptance should borne with this simple feature in the free version. Also Netwrix is more enterprise-ready with their SOC 2, ISO 27001 and HIPAA ready but that is a moot point for most SMBs, SMEs, family-servers and homelabs. I do do like the simple fact that Strongbox has it all out with their Github repository. https://github.com/strongbox-password-safe/Strongbox https://github.com/strongbox-password-safe/Strongbox
  - ssbash 3y ago
    You have two options: 1. Pay and support this small developer. A password manager is a critical tool that needs to be constantly updated to support the latest OS. This isn't Adobe, it's a bootstrapped indie developer making an app for a small audience. I think the free version is already quite generous. Plus Strongbox includes a one time purchase for all platforms, no subscription unlike 1Password or Bitwarden. 2. Compile and build from source. It's an open source app, you are free to sideload the app if you want to.
SSLy 3y ago
> NordPass I haven't seen a website this aggresive if you dare to open it in uBo in quite some time. Scroll down one screen and it constantly reloads. I'll stay with 1p.
dataflow 3y ago
You don't have any notes on KeePass?
manmal 3y ago
1P is zero knowledge. What does Nordpass really have over 1P?
- egberts1 3y ago
  Nordpass lets you self-host your password database. 1Password stop doing that and makes you use only their own cloud infrastructure.
  - manmal 3y ago
    I trust 1P cloud storage more with their well thought out security concept than Dropbox or self-hosted nextcloud. The 1P security whitepaper goes into great detail why their cloud concept is not at all comparable to just hosting the vault on block storage.
    - egberts1 3y ago
      There are companies who are pulling in the rein with regard to its placement of sensitive data, encrypted at rest or not. That is, going cloud-less (or more accurately, privately-owned public cloud, and more often, private cloud) The prevailing concern isn't insecurity of using public cloud by using zero knowledge, but the containment/confinement of potential damage when an end user lose control of their password manager app (hacked, laptop-stolen or accidentally leaked) by having this delete feature at the self-hosted server. This is something that Netwirx PasswordSafe really excels at. SOC 2, HIPAA, ISO 27001 and various military guidelines are a few reasons why.
    - egberts1 3y ago
      And yes, apps should also password-protect and event-log the URL configuration field separately from the password used in database(s) as well ... from any change, accidentally or maliciously. That is following inline with still-so Common Criteria guideline.
o1y32 3y ago
"Electron web app" That's the last thing I would worry about. I don't get why people would get annoyed at the implementation of UI if that UI is working well enough. Imagine someone says "although this password manager is very secure and has all the features I need, I don't use it because it uses web UI, even though the difference in performance would not matter at all compared to a native app". Honestly I find this ridiculous and it is a waste of my time to write this comment. Who
- egberts1 3y ago
  You could wait until you are able to foray deep into the field of cybersecurity and vulnerability assessment and arrive to the same conclusion as I do. Or you can Google "electron web vulnerabilities" and find out quicker.

Aaron2222 3y ago

> Electron web and its many unverified modules/libraries What do you mean by this? That Electron itself uses unverified modules/libraries, or that 1Password is? And do you have any citations for this?

egberts1 3y ago
[dead]

pjmlp 3y ago

Unfortunately 1password has been a requirement in many projects I have been involved with.

egberts1 3y ago
You should post the name of those companies in here so we know who not to hire. But I suspect you would be a contractor and probably would not be able to. :-)
- Shannon25 3y ago
  [dead]
- braddanielle2 3y ago
  [dead]

js2 3y ago

I'll add a self-hosted option that no one ever mentions – PasswordWallet: https://www.passwordwallet.com/ https://www.passwordwallet.com/ I use iCloud Keychain for most of my passwords these days, but my critical passwords I continue to keep in PW as well. PW also has an occasionally very useful feature that I have not seen in any other password manager: auto type. Sometimes I just need to point my cursor somewhere and have the password typed for me (e.g. into a login screen on a VNC/RDP connection). PW uses Blowfish with 448-bit keys. There is also "pass" (from the author of Wireguard) which is essentially a shell script wrapper around gpg and git: https://www.passwordstore.org/ https://www.passwordstore.org/

sgu999 3y ago
I've been using "pass" for years and love it. There is also a very nice iOS app that works well and is open source. I synchronise my devices and backup directly without a central repo. Its only flaw is gpg's poor UX...
- alwaysbeconsing 3y ago
  There is a fork of pass called "passage" that uses Age for encryption instead: https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage Unfortunately I don't believe any iOS/Android apps exist to work with it so far.
egberts1 3y ago
Yeah. Auto-typing of password-related field is a relatively new security feature that got its start in Apple iOS. While password auto-type is also found in Android, its security model is not quite a firm Bell-LaPadula yet like those implemented in Apple iOS/MacOS. Exposing API to monitoring keystrokes remains problematic for any OSes.
- zuprau 3y ago
  > relatively new security feature Maybe I'm misunderstanding the feature, but I've been auto-filling login forms since I was using IE7 with RoboForm. Other than using Touch ID to trigger the auto-fill instead of 1 click, I don't see any improvements in iOS/macOS Safari.

deleted 3y ago

[deleted]

yoyohello13 3y ago

No Bitwarden?

sphars 3y ago
They mentioned vaultwarden, which is a self-hosted backend for Bitwarden
- yoyohello13 3y ago
  Oh, I see. I hadn't heard of Vaultwarden. edit: It was recently renamed from bitwarden_rs which I was familiar with.
- seized 3y ago
  Except they are different. One is a clone, BitWarden also has a self hostable version of their own backend.

Dalewyn 3y ago

>You can install NordPass on Chrome, Firefox, Safari, Opera, Brave, Vivaldi, and Edge. So Chrome, Firefox, Safari, Chrome, Chrome, Chrome, and Chrome?

egberts1 3y ago
Update: this post is wrong. Edge preserves and utilize Chrome app APIs. AFAICT, There is nothing Chrome about Edge.
- sc00ty 3y ago
  Edge is based on Chromium and can install all the same extensions from the chrome web store directly.
  - egberts1 3y ago
    Thanks. Considered myself informed given that I stay away from Edge.

lxgr 3y ago

> LassPass, hacked in 2022; remote storage of raw passwords I know that it's been one dumpster fire after the other in the past few years, but did they actually go as far? The most severe one I remember hearing of was a leak of (possibly insufficiently salted, depending on the age of the account) encrypted password vaults. Still, I'll never again consider or recommend them going forward. > In pwsafe, unbroken TwoFish algorithm is still being used instead of currently safer Argon2i This is actually a negative point for it, in my view. AES is just as unbroken, yet has received considerably more scrutiny over the years. The only place were non-AES symmetric algorithms still make sense these days is platforms where hardware acceleration is not available (e.g. djb's Salsa/Chacha), and even there only for high-throughput applications, which a password safe decidedly isn't. > The recommended client-wise of PasswordSafe is still Netwrix (formerly MATESO of Germany) I've never heard of them. Is it open source or at least properly audited?

egberts1 3y ago
Update: This post is half-wrong; Salsa is a streaming cipher and AES is a block cipher and one still need a PBKDF mechanism to construct a safer key. Problem with AES and Salsa is that salting is required for smaller-sized password and are not considered a "hashing" algorithm; those two are block ciphers, as I recall. No, MATESO is not open source but with an enterprise license, you can negotiate for the source code. And they have contracted audits against their software. Netwrix PasswordSafe is more enterprise-ready with their SOC 2, ISO 27001 and HIPAA compliance but that is a moot point for most SMBs, SMEs, family-servers and homelabs.
- lxgr 3y ago
  AES and Twofish are both block ciphers. Neither are hasing algorithms, and you'll need a PBKDF or some other construction to derive a key for either, no? Salsa is a stream cipher.
  - egberts1 3y ago
    Right. thanks for the update. My note should have been consulted as you being correct. Hate my memory nowadays. Need to consult some more notes before speaking.

ssbash 3y ago

Strongbox is a fantastic KeePass client on iOS and macOS. - fully native apps - open source - fully offline option (Strongbox Zero) - one time purchase - solid browser extensions for Chrome and Firefox - native keychain autofill for Safari and Orion - compatible with other KeePass apps on other platforms - multiple sync options iCloud, G Drive, Dropbox, OneDrive, SFTP, WebDav, Syncthing - support for offline vaults - biometrics, Apple Watch unlock, and Yubikey support - TOTP codes, attachments, and markdown notes can be stored - supports password auditing with Have I Been Pwned - supports importing 1PW vaults Most importantly, Strongbox is made by a small and transparent company. Unlike Bitwarden or 1Password, they are solely focused on making high quality macOS and iOS apps. https://strongboxsafe.com https://strongboxsafe.com

egberts1 3y ago
I really really like Strongbox. My only resistance from going the route of strongboxsafe is the lack of app-specific PIN, opposed to OS-specific PIN that is still missing from the free version. While a master password covers the specific database, the PIN covers the app. This is a problem for me there: 1. No OS-specific PIN/passcode in free version A wider acceptance should borne with this simple feature in the free version. Also Netwrix is more enterprise-ready with their SOC 2, ISO 27001 and HIPAA ready but that is a moot point for most SMBs, SMEs, family-servers and homelabs. I do do like the simple fact that Strongbox has it all out with their Github repository. https://github.com/strongbox-password-safe/Strongbox https://github.com/strongbox-password-safe/Strongbox
- ssbash 3y ago
  You have two options: 1. Pay and support this small developer. A password manager is a critical tool that needs to be constantly updated to support the latest OS. This isn't Adobe, it's a bootstrapped indie developer making an app for a small audience. I think the free version is already quite generous. Plus Strongbox includes a one time purchase for all platforms, no subscription unlike 1Password or Bitwarden. 2. Compile and build from source. It's an open source app, you are free to sideload the app if you want to.

SSLy 3y ago

> NordPass I haven't seen a website this aggresive if you dare to open it in uBo in quite some time. Scroll down one screen and it constantly reloads. I'll stay with 1p.

dataflow 3y ago

You don't have any notes on KeePass?

manmal 3y ago

1P is zero knowledge. What does Nordpass really have over 1P?

egberts1 3y ago
Nordpass lets you self-host your password database. 1Password stop doing that and makes you use only their own cloud infrastructure.
- manmal 3y ago
  I trust 1P cloud storage more with their well thought out security concept than Dropbox or self-hosted nextcloud. The 1P security whitepaper goes into great detail why their cloud concept is not at all comparable to just hosting the vault on block storage.
  - egberts1 3y ago
    There are companies who are pulling in the rein with regard to its placement of sensitive data, encrypted at rest or not. That is, going cloud-less (or more accurately, privately-owned public cloud, and more often, private cloud) The prevailing concern isn't insecurity of using public cloud by using zero knowledge, but the containment/confinement of potential damage when an end user lose control of their password manager app (hacked, laptop-stolen or accidentally leaked) by having this delete feature at the self-hosted server. This is something that Netwirx PasswordSafe really excels at. SOC 2, HIPAA, ISO 27001 and various military guidelines are a few reasons why.
  - egberts1 3y ago
    And yes, apps should also password-protect and event-log the URL configuration field separately from the password used in database(s) as well ... from any change, accidentally or maliciously. That is following inline with still-so Common Criteria guideline.

o1y32 3y ago

"Electron web app" That's the last thing I would worry about. I don't get why people would get annoyed at the implementation of UI if that UI is working well enough. Imagine someone says "although this password manager is very secure and has all the features I need, I don't use it because it uses web UI, even though the difference in performance would not matter at all compared to a native app". Honestly I find this ridiculous and it is a waste of my time to write this comment. Who

egberts1 3y ago
You could wait until you are able to foray deep into the field of cybersecurity and vulnerability assessment and arrive to the same conclusion as I do. Or you can Google "electron web vulnerabilities" and find out quicker.