3 ms·

Me, looking at my local KeepassXC, calm, sticking with it.

by chinathrow 2y ago

selecsosi 2y ago
They can pry my offline key file from my cold dead hard drive. Some things shouldn't be on the internet.
- rcMgD2BwE72F 2y ago
  How do you make sure that file does not end up corrupt?
  - some_furry 2y ago
    Redundant encrypted backups, error-correcting codes.
  - mulmen 2y ago
    So what if it does? Worst case you just go through the account recovery process at each institution. Password managers are a convenience. Data integrity isn’t critical but security is.
    - fn-mote 2y ago
      > Worst case you just go through the account recovery process at each institution Well, worst case is your account with Google, which you can kiss goodbye. But as we all know, that’s security. If the account recovery is the weakest link, it gets attacked.
      - TeMPOraL 2y ago
        That's insanity of cybersecurity. In the real world, there's always a recovery procedure. It might involve visiting a court or some local administrative offices, but you can always recover access to anything that's important. Not so with Google, or other on-line services that came from the tech industry side. Cybersecurity "best practices" is basically giving you a razor blade, and kicking you out if you hurt yourself with it.
  - aspbee555 2y ago
    copies and replication I have used Keepass since before lastpass existed and sync with multiple machines/locations via syncthing (originally synced with rsync)
    - selecsosi 2y ago
      This. I have enough devices under frequent use of the keyfile that the chance of each of them beings corrupt is extremely unlikely (n>=3 at any given time). That being said, not an approach useful for all and a good mental model and sharing system with redundant copies on flash media / live systems/ mobile devices can be an effective strategy. Use case: 10+ year keepass user, never lost a credential or had one compromised that affected more than one account due to breach. Thank you Keepass devs!
  - sedatk 2y ago
    More importantly, how do cloud providers make sure of that?
    - myself248 2y ago
      Why does my USB stick in a fire safe care what cloud providers think?
- sneak 2y ago
  Your hard drive is connected to the internet.
blackeyeblitzar 2y ago
How do you sync it between devices like your phone? What about family sharing or access for emergencies or other such features?
- mmwelt 2y ago
  SyncThing[1] works very well for syncing with Android devices, but IIRC doesn't work with iOS. [1] https://syncthing.net/ https://syncthing.net/
  - JackMorgan 2y ago
    I managed to get syncthing working on iOS. It's definitely possible
- chinathrow 2y ago
  Actually I don't use it on my phone, at all. Another thing to care less about.
makeitdouble 2y ago
This is the kind of control that is really becoming a luxury. And I don't know how we get back to a simple state; Let's say you're a family of three with shared services and accounts: Keeping everything under Keepass means handling the file sync between all the devices and OSes, with potentially your credentials flying through third party sync services, thus negating most of the advantages of Keepass. Moving to something like a self-hosted Bitwarden instance should be the way, but then one member of the family becomes a dedicated lifetime sysop making sure that instance is secure while being accessible anytime from everywhere.
- TheDong 2y ago
  It shouldn't be a luxury, but it unfortunately is due to various big players refusing to play nice together. If everyone has only apple devices (iphones + macbooks), then you can use a shared iCloud sync'd folder. Except that doesn't actually work because the majority of iOS apps are incapable of using a shared iCloud folder correctly (including apple's notes app, most of apple's apps) because apple tries to hide the filesystem so much, that even saving a file into a folder is basically impossible for most apps. That also doesn't work if anyone uses linux or windows because apple refuses to play nice with other ecosystems. If everyone _doesn't_ use iOS devices, there are dozens of solutions that work well, from a shared google drive folder, to syncthing, but if even one person uses an iOS device, then suddenly none of the shared folders work, because apple has made it so creating a shared folder on iOS is bad for iCloud, but even worse for any third party app (be it google drive, syncthing, an FTP based solution, etc etc). I guess what I'm saying is that apple tried to kill the filesystem, and in doing so has made it so the very idea of just sharing a folder of files securely seems like a per-app luxury. Instead you need a shared photo album for photos, a shared notes folder for notes, a shared "apple invites invite" for a calendar event, etc etc. Apple has a lot to pay for, and a hatred for folders that has caused the entire industry to move away from simple secure app-independent sharing is one of them. Instead, we have a jumble of apps being forced to implement their own sharing concepts poorly and often insecurely.
  - TeMPOraL 2y ago
    FWIW, Apple has had at least two partners in crime here - both Google and Microsoft had, and still are, trying to kill the filesystem in this way, too. The trio mostly succeeded, which is a big part of why modern computing sucks so badly, and is more confusing for non-tech people than what came before, rather than less.

Me, looking at my local KeepassXC, calm, sticking with it.

selecsosi 2y ago

They can pry my offline key file from my cold dead hard drive. Some things shouldn't be on the internet.

rcMgD2BwE72F 2y ago
How do you make sure that file does not end up corrupt?
- some_furry 2y ago
  Redundant encrypted backups, error-correcting codes.
- mulmen 2y ago
  So what if it does? Worst case you just go through the account recovery process at each institution. Password managers are a convenience. Data integrity isn’t critical but security is.
  - fn-mote 2y ago
    > Worst case you just go through the account recovery process at each institution Well, worst case is your account with Google, which you can kiss goodbye. But as we all know, that’s security. If the account recovery is the weakest link, it gets attacked.
    - TeMPOraL 2y ago
      That's insanity of cybersecurity. In the real world, there's always a recovery procedure. It might involve visiting a court or some local administrative offices, but you can always recover access to anything that's important. Not so with Google, or other on-line services that came from the tech industry side. Cybersecurity "best practices" is basically giving you a razor blade, and kicking you out if you hurt yourself with it.
- aspbee555 2y ago
  copies and replication I have used Keepass since before lastpass existed and sync with multiple machines/locations via syncthing (originally synced with rsync)
  - selecsosi 2y ago
    This. I have enough devices under frequent use of the keyfile that the chance of each of them beings corrupt is extremely unlikely (n>=3 at any given time). That being said, not an approach useful for all and a good mental model and sharing system with redundant copies on flash media / live systems/ mobile devices can be an effective strategy. Use case: 10+ year keepass user, never lost a credential or had one compromised that affected more than one account due to breach. Thank you Keepass devs!
- sedatk 2y ago
  More importantly, how do cloud providers make sure of that?
  - myself248 2y ago
    Why does my USB stick in a fire safe care what cloud providers think?
sneak 2y ago
Your hard drive is connected to the internet.

blackeyeblitzar 2y ago

How do you sync it between devices like your phone? What about family sharing or access for emergencies or other such features?

mmwelt 2y ago
SyncThing[1] works very well for syncing with Android devices, but IIRC doesn't work with iOS. [1] https://syncthing.net/ https://syncthing.net/
- JackMorgan 2y ago
  I managed to get syncthing working on iOS. It's definitely possible
chinathrow 2y ago
Actually I don't use it on my phone, at all. Another thing to care less about.

makeitdouble 2y ago

This is the kind of control that is really becoming a luxury. And I don't know how we get back to a simple state; Let's say you're a family of three with shared services and accounts: Keeping everything under Keepass means handling the file sync between all the devices and OSes, with potentially your credentials flying through third party sync services, thus negating most of the advantages of Keepass. Moving to something like a self-hosted Bitwarden instance should be the way, but then one member of the family becomes a dedicated lifetime sysop making sure that instance is secure while being accessible anytime from everywhere.

TheDong 2y ago
It shouldn't be a luxury, but it unfortunately is due to various big players refusing to play nice together. If everyone has only apple devices (iphones + macbooks), then you can use a shared iCloud sync'd folder. Except that doesn't actually work because the majority of iOS apps are incapable of using a shared iCloud folder correctly (including apple's notes app, most of apple's apps) because apple tries to hide the filesystem so much, that even saving a file into a folder is basically impossible for most apps. That also doesn't work if anyone uses linux or windows because apple refuses to play nice with other ecosystems. If everyone _doesn't_ use iOS devices, there are dozens of solutions that work well, from a shared google drive folder, to syncthing, but if even one person uses an iOS device, then suddenly none of the shared folders work, because apple has made it so creating a shared folder on iOS is bad for iCloud, but even worse for any third party app (be it google drive, syncthing, an FTP based solution, etc etc). I guess what I'm saying is that apple tried to kill the filesystem, and in doing so has made it so the very idea of just sharing a folder of files securely seems like a per-app luxury. Instead you need a shared photo album for photos, a shared notes folder for notes, a shared "apple invites invite" for a calendar event, etc etc. Apple has a lot to pay for, and a hatred for folders that has caused the entire industry to move away from simple secure app-independent sharing is one of them. Instead, we have a jumble of apps being forced to implement their own sharing concepts poorly and often insecurely.
- TeMPOraL 2y ago
  FWIW, Apple has had at least two partners in crime here - both Google and Microsoft had, and still are, trying to kill the filesystem in this way, too. The trio mostly succeeded, which is a big part of why modern computing sucks so badly, and is more confusing for non-tech people than what came before, rather than less.