4 ms·

Are there other alternatives that are 1) open source 2) offer the same integration to begin with and finally 3) have been audited or are popular enough to be un

Are there other alternatives that are 1) open source 2) offer the same integration to begin with and finally 3) have been audited or are popular enough to be under constant scrutiny? There is of course the KeePass ecosystem, but that is why I included my second point, as with KeePass you are responsible for vault syncing, having clients for all platforms, etc. I suppose that it is good to be aware of other options. At the same time, jumping ship so easily also doesn't seem realistic or ideal behavior to me.

Glazui 2y ago
I‘ve recently learned about PassBolt, but it doesn’t meet criteria 3 I’m afraid
KPGv2 2y ago
The audited part is going to be tough to meet because it's a very niche skill people generally won't do constantly for free.
zie 2y ago
I have no affiliation, just found them this week, but https://psono.com/ https://psono.com/ exists. So 1 and 2 are met and 3 is half-way there maybe? It's a self-audit but they have been around a while. Apache2 licensed. Again, I literally found them the other day, and other than a cursory check to make sure the UI/UX is friendly enough to compete with BW or 1P, I haven't had a chance to look through their code at all yet. I have no idea if the promises they document are met.
- chickahoona 2y ago
  Hi, Sascha here, the main developer behind Psono. Psono has been audited multiple times so far, usually on a yearly bases. The last one here https://psono.com/blog/security-audit-2024 https://psono.com/blog/security-audit-2024 (you will also find a link to the audit itself)
  - zie 2y ago
    Thanks! I missed that!
g19fanatic 2y ago
i use the keepass ecosystem with app.keeweb.info. Its an open source webclient that can directly pull from your google drive (and other places!). I use a google drive through keeweb for syncing, 2 clicks and its syncd. Auto pulls when past pw. keepass works in browser (how I use it on a computer), can work offline (which is good in air-gapped instances, one of my reqs) and works directly on my android phone without issue.
- creesch 2y ago
  It is actually sort of how I used it as well, though through nextcloud. It did still remain a hassle. It also requires all different apps to be maintained and equally safe. Keeweb for example has not had an active maintainer since 2022 https://github.com/keeweb/keeweb/issues/2022 https://github.com/keeweb/keeweb/issues/2022
WD-42 2y ago
https://www.passwordstore.org/ https://www.passwordstore.org/
hedora 2y ago
I decided that vaultwarden should not have an internet accessible port. Are there any that meet those requirements and also let you (reliably!) edit/create passwords when offline? Also, sometimes the bitwarden client decides to blow away my local copy of the password database. I'd like it to store it pesistently on all machines so I have to lose my phone, my laptop, my vaultwarden server and its two backups before I get locked out of everything. Currently, the phone + laptop don't count as backup copies.
- BrandoElFollito 2y ago
  > I decided that vaultwarden should not have an internet accessible port So how does your browser extension work when outside your LAN? via Tailscale or similar VPN mesh? And for people who use it outside of the LAN entirely?
  - hedora 2y ago
    The app (and iOS keyboard integration) degrades to read only mode. It works about 95% of the time. I'd rather it work 100% of the time, and be read-write. I don't run the browser extension. (There have been too many other password managers with exploitable password bugs.)

Glazui 2y ago

I‘ve recently learned about PassBolt, but it doesn’t meet criteria 3 I’m afraid

KPGv2 2y ago

The audited part is going to be tough to meet because it's a very niche skill people generally won't do constantly for free.

zie 2y ago

I have no affiliation, just found them this week, but https://psono.com/ https://psono.com/ exists. So 1 and 2 are met and 3 is half-way there maybe? It's a self-audit but they have been around a while. Apache2 licensed. Again, I literally found them the other day, and other than a cursory check to make sure the UI/UX is friendly enough to compete with BW or 1P, I haven't had a chance to look through their code at all yet. I have no idea if the promises they document are met.

chickahoona 2y ago
Hi, Sascha here, the main developer behind Psono. Psono has been audited multiple times so far, usually on a yearly bases. The last one here https://psono.com/blog/security-audit-2024 https://psono.com/blog/security-audit-2024 (you will also find a link to the audit itself)
- zie 2y ago
  Thanks! I missed that!

g19fanatic 2y ago

i use the keepass ecosystem with app.keeweb.info. Its an open source webclient that can directly pull from your google drive (and other places!). I use a google drive through keeweb for syncing, 2 clicks and its syncd. Auto pulls when past pw. keepass works in browser (how I use it on a computer), can work offline (which is good in air-gapped instances, one of my reqs) and works directly on my android phone without issue.

creesch 2y ago
It is actually sort of how I used it as well, though through nextcloud. It did still remain a hassle. It also requires all different apps to be maintained and equally safe. Keeweb for example has not had an active maintainer since 2022 https://github.com/keeweb/keeweb/issues/2022 https://github.com/keeweb/keeweb/issues/2022

WD-42 2y ago

https://www.passwordstore.org/ https://www.passwordstore.org/

hedora 2y ago

I decided that vaultwarden should not have an internet accessible port. Are there any that meet those requirements and also let you (reliably!) edit/create passwords when offline? Also, sometimes the bitwarden client decides to blow away my local copy of the password database. I'd like it to store it pesistently on all machines so I have to lose my phone, my laptop, my vaultwarden server and its two backups before I get locked out of everything. Currently, the phone + laptop don't count as backup copies.

BrandoElFollito 2y ago
> I decided that vaultwarden should not have an internet accessible port So how does your browser extension work when outside your LAN? via Tailscale or similar VPN mesh? And for people who use it outside of the LAN entirely?
- hedora 2y ago
  The app (and iOS keyboard integration) degrades to read only mode. It works about 95% of the time. I'd rather it work 100% of the time, and be read-write. I don't run the browser extension. (There have been too many other password managers with exploitable password bugs.)