3 ms·

That's why KeePass is still the king. Offline vault > online vault.

by baal80spam 8mo ago

spacebuffer 8mo ago
What to do if my house catches on fire, including my computer where the passwords are stored?
- judofyr 8mo ago
  It’s just an encrypted file on disk. You’d depend on whatever backup solution you already have in place.
- deleted 8mo ago
  [deleted]
- wps 8mo ago
  Well, the same issue exists for your BitWarden recovery keys or 2fa method. You need to have proper and redundant off site backups for anything valuable.
  - fullstop 8mo ago
    Not exactly. I need to have those offsite, but they are not modified at the same frequency as passwords.
    - Telaneo 8mo ago
      How often do your change your passwords? Assuming they are decently long and all that, why would you change them at all other than when a site gets breached? The only reason my Keepass database changes is because I make new accounts on sites every now and then, and that's a fairly rare thing these days. And if I get so ungodly unlucky that my house burns down before my off-site database is updated to have that new account listed, I'll still have access to the email that account is associated with, so I can still recover the account either way.
      - fullstop 8mo ago
        Every time I add an account, for one. And there's still plenty of (dumb) sites which force me to change my password and sometimes username periodically. Keeping an offsite database in sync is tedious, especially if it's delivered via sneakernet.
        Telaneo 8mo ago
        I add an account to that database maybe twice a year, probably less. Do you make a lot more accounts than that? The off-site solution I have updates a lot more often than that, although that's only because only the really important stuff is backed up in that way; the stuff I truly need to survive my house burning down.
        fullstop 8mo ago
        I take it that you don't have children? I'm almost done with that aspect of my life now, but every school year it feels like there's a new slate of apps, parent communication portals, etc. I need to manage these as well. It's way more often than twice a year for me. And it's accelerating.
        Telaneo 8mo ago
        I don't, and now I have yet another reason not to.
    - wps 8mo ago
      Fair enough, but it’s genuinely super easy to have a regular copy of your password manager saved in the cloud. You can also have a less frequently updated version stored somewhere physical that isn’t your house. My house burning down has never been a concern for me, as I’ve taken the proper precautions for my data.
- Telaneo 8mo ago
  Off-site backup.
- eblume 8mo ago
  I recently orchestrated this, although in my case I've chosen to use 1password's cloud based store as my primary secret store, so I'm accepting some exposure right off the bat that you might not be comfortable with. I've documented the recovery process here: https://docs.eblu.me/how-to/operations/restore-1password-backup https://docs.eblu.me/how-to/operations/restore-1password-bac... Basically, I have a borg backup job which runs every day, in a 3-2-1 replication strategy with the backups being sent both to a locally encrypted NAS (backups themselves have an additional layer of encryption via borg) as well as off-site with BorgBase. Those backups scoop up an export of 1password that I have a reminder to kick off manually about once a month via this script: https://github.com/eblume/blumeops/blob/main/mise-tasks/op-backup https://github.com/eblume/blumeops/blob/main/mise-tasks/op-b... The password that decrypts the key (along with the password that decrypts the backup) is stored on a piece of paper in a fireproof safe in my house. I've got a reminder to practice the entire DR process every six months, although I've only done it once so far as this is all pretty new. It was fun to build!
  - Krutonium 8mo ago
    Just a heads up, Fireproof Safes are not failure proof, you should have that key securely stored somewhere else as well.
    - eblume 8mo ago
      Thanks, it's also available via my 1password cloud account, so it'd have to be a joint fire at my home and the 1password data center (and my phone, for that matter). Pretty bad day I feel. Unrelated note: this was the first time I've linked to my static generated docs for this project and it was really fun watching the grafana dash of my fly.io nginx proxy pick up all the scraping traffic. Thanks for warming my cache :) I work with this tech all the time at my day job but this is the first time I've hosted something from my home, it's genuinely made my afternoon to see it light up.
- JamesLeonis 8mo ago
  I sync the database to my phone, and a couple of other devices too with syncthing. I need it on my phone anyway to log into accounts while I'm out and about.
  - soupfordummies 8mo ago
    What clients are you using ? Trying syncthing with synctrayzor with my windows boxes and Synctrain on my iPhone and it’s mostly alright but still a little spotty.
    - JamesLeonis 8mo ago
      I'm also using Synctrayzor on my Windows 10 machine. I'm on Android using the official Syncthing app there as well as on Linux. It sometimes takes a while for them to discover each other, and it of course works better when all the devices are on my home network. The only real problem I've encountered is when filenames have special characters another OS doesn't like.
      - soupfordummies 8mo ago
        Hey thanks for the quick reply! Yeah, I've noticed the discoverability is a lot more consistent when I just foreground the app on both devices and let it sit for 10-15 seconds. So used to instant gratification in this age :\
LoganDark 8mo ago
KeePassXC can even still be online, too; example: https://logandark.net/passwords.kdbx https://logandark.net/passwords.kdbx It's not centralized, of course; you still have to download the entire database, and then potentially upload the entire database again for any changes; but it doesn't have these vulnerabilities.
- wps 8mo ago
  Haha this was a powermove. It is genuinely great that since it’s just a file you can host it anywhere you want. S3, WebDAV, your own site. I personally use copyparty and WireGuard for my kdbx file. I find it better than syncthing because there’s an obvious master copy (edited in place), and there’s no good way to keep syncthing running all the time on iOS, which can lead to sync conflicts.
  - roughE 8mo ago
    Just how do you use copyparty and wireguard for this if you kindly elaborate on that please
    - wps 8mo ago
      Hello. I use copyparty on my LAN hosting the kdbx file. It is exposed via webdav for my phone's client (keepassium). It is always available for KeePassXC (you can use rclone or just webdav in the file explorer). This is backed up to b2 every hour. I use WireGuard to access the LAN when I am not home. My phone autoconnects to WireGuard as soon as it is on any network that is not my home network.
  - dizhn 8mo ago
    I sometimes casually include tokens in my comments (changing a few characters here and there) to make people gasp but parent is taking it to a different level.
  - baal80spam 8mo ago
    Yeah, some people even upload their KDBX files to github (in public repos, no less).
wps 8mo ago
I mostly agree! However, I plan on posting an article on HN soon discussing some of the issues with the .kdbx file format that KeePass and derivatives use within the next couple of days. KeePass has such great potential, but falls short compared to some of its (local) competitors.
- arunc 8mo ago
  Looking forward to
- delichon 8mo ago
  Which local competitors do you recommend? Is a text file one of them?
  - wps 8mo ago
    I don’t recommend any of them. Some of them have critical metadata leakage issues (Pass and derivatives, which leak the number of accounts & their names) and most others are not open source—an immediate disqualification for a local password manager. KeePassXC is my choice on desktop. Keepassium on iOS.
Someone1234 8mo ago
One of the things the article touches on is encouraging these vendors to migrate their customers to more secure/modern security standards. How is this handled with KeePass with it being, by its very nature, decoupled?
- JamesLeonis 8mo ago
  Not the parent, but a heavy user of Keepass. When you unlock your database, you can re-key it with several options for encryption algorithm, key derivation, and the transform rounds. I also have it set up with my Yubikeys as a kinda-sorta two factor for an added layer of security. To keep the encryption modern regular updates are made to the program, and any migration would happen when re-encrypting the database. Checking my earliest entry, I've used it for 15 years without a hiccup.

That's why KeePass is still the king. Offline vault > online vault.

spacebuffer 8mo ago

What to do if my house catches on fire, including my computer where the passwords are stored?

judofyr 8mo ago
It’s just an encrypted file on disk. You’d depend on whatever backup solution you already have in place.
deleted 8mo ago
[deleted]
wps 8mo ago
Well, the same issue exists for your BitWarden recovery keys or 2fa method. You need to have proper and redundant off site backups for anything valuable.
- fullstop 8mo ago
  Not exactly. I need to have those offsite, but they are not modified at the same frequency as passwords.
  - Telaneo 8mo ago
    How often do your change your passwords? Assuming they are decently long and all that, why would you change them at all other than when a site gets breached? The only reason my Keepass database changes is because I make new accounts on sites every now and then, and that's a fairly rare thing these days. And if I get so ungodly unlucky that my house burns down before my off-site database is updated to have that new account listed, I'll still have access to the email that account is associated with, so I can still recover the account either way.
    - fullstop 8mo ago
      Every time I add an account, for one. And there's still plenty of (dumb) sites which force me to change my password and sometimes username periodically. Keeping an offsite database in sync is tedious, especially if it's delivered via sneakernet.
      - Telaneo 8mo ago
        I add an account to that database maybe twice a year, probably less. Do you make a lot more accounts than that? The off-site solution I have updates a lot more often than that, although that's only because only the really important stuff is backed up in that way; the stuff I truly need to survive my house burning down.
        fullstop 8mo ago
        I take it that you don't have children? I'm almost done with that aspect of my life now, but every school year it feels like there's a new slate of apps, parent communication portals, etc. I need to manage these as well. It's way more often than twice a year for me. And it's accelerating.
        Telaneo 8mo ago
        I don't, and now I have yet another reason not to.
  - wps 8mo ago
    Fair enough, but it’s genuinely super easy to have a regular copy of your password manager saved in the cloud. You can also have a less frequently updated version stored somewhere physical that isn’t your house. My house burning down has never been a concern for me, as I’ve taken the proper precautions for my data.
Telaneo 8mo ago
Off-site backup.
eblume 8mo ago
I recently orchestrated this, although in my case I've chosen to use 1password's cloud based store as my primary secret store, so I'm accepting some exposure right off the bat that you might not be comfortable with. I've documented the recovery process here: https://docs.eblu.me/how-to/operations/restore-1password-backup https://docs.eblu.me/how-to/operations/restore-1password-bac... Basically, I have a borg backup job which runs every day, in a 3-2-1 replication strategy with the backups being sent both to a locally encrypted NAS (backups themselves have an additional layer of encryption via borg) as well as off-site with BorgBase. Those backups scoop up an export of 1password that I have a reminder to kick off manually about once a month via this script: https://github.com/eblume/blumeops/blob/main/mise-tasks/op-backup https://github.com/eblume/blumeops/blob/main/mise-tasks/op-b... The password that decrypts the key (along with the password that decrypts the backup) is stored on a piece of paper in a fireproof safe in my house. I've got a reminder to practice the entire DR process every six months, although I've only done it once so far as this is all pretty new. It was fun to build!
- Krutonium 8mo ago
  Just a heads up, Fireproof Safes are not failure proof, you should have that key securely stored somewhere else as well.
  - eblume 8mo ago
    Thanks, it's also available via my 1password cloud account, so it'd have to be a joint fire at my home and the 1password data center (and my phone, for that matter). Pretty bad day I feel. Unrelated note: this was the first time I've linked to my static generated docs for this project and it was really fun watching the grafana dash of my fly.io nginx proxy pick up all the scraping traffic. Thanks for warming my cache :) I work with this tech all the time at my day job but this is the first time I've hosted something from my home, it's genuinely made my afternoon to see it light up.
JamesLeonis 8mo ago
I sync the database to my phone, and a couple of other devices too with syncthing. I need it on my phone anyway to log into accounts while I'm out and about.
- soupfordummies 8mo ago
  What clients are you using ? Trying syncthing with synctrayzor with my windows boxes and Synctrain on my iPhone and it’s mostly alright but still a little spotty.
  - JamesLeonis 8mo ago
    I'm also using Synctrayzor on my Windows 10 machine. I'm on Android using the official Syncthing app there as well as on Linux. It sometimes takes a while for them to discover each other, and it of course works better when all the devices are on my home network. The only real problem I've encountered is when filenames have special characters another OS doesn't like.
    - soupfordummies 8mo ago
      Hey thanks for the quick reply! Yeah, I've noticed the discoverability is a lot more consistent when I just foreground the app on both devices and let it sit for 10-15 seconds. So used to instant gratification in this age :\

LoganDark 8mo ago

KeePassXC can even still be online, too; example: https://logandark.net/passwords.kdbx https://logandark.net/passwords.kdbx It's not centralized, of course; you still have to download the entire database, and then potentially upload the entire database again for any changes; but it doesn't have these vulnerabilities.

wps 8mo ago
Haha this was a powermove. It is genuinely great that since it’s just a file you can host it anywhere you want. S3, WebDAV, your own site. I personally use copyparty and WireGuard for my kdbx file. I find it better than syncthing because there’s an obvious master copy (edited in place), and there’s no good way to keep syncthing running all the time on iOS, which can lead to sync conflicts.
- roughE 8mo ago
  Just how do you use copyparty and wireguard for this if you kindly elaborate on that please
  - wps 8mo ago
    Hello. I use copyparty on my LAN hosting the kdbx file. It is exposed via webdav for my phone's client (keepassium). It is always available for KeePassXC (you can use rclone or just webdav in the file explorer). This is backed up to b2 every hour. I use WireGuard to access the LAN when I am not home. My phone autoconnects to WireGuard as soon as it is on any network that is not my home network.
- dizhn 8mo ago
  I sometimes casually include tokens in my comments (changing a few characters here and there) to make people gasp but parent is taking it to a different level.
- baal80spam 8mo ago
  Yeah, some people even upload their KDBX files to github (in public repos, no less).

wps 8mo ago

I mostly agree! However, I plan on posting an article on HN soon discussing some of the issues with the .kdbx file format that KeePass and derivatives use within the next couple of days. KeePass has such great potential, but falls short compared to some of its (local) competitors.

arunc 8mo ago
Looking forward to
delichon 8mo ago
Which local competitors do you recommend? Is a text file one of them?
- wps 8mo ago
  I don’t recommend any of them. Some of them have critical metadata leakage issues (Pass and derivatives, which leak the number of accounts & their names) and most others are not open source—an immediate disqualification for a local password manager. KeePassXC is my choice on desktop. Keepassium on iOS.

Someone1234 8mo ago

One of the things the article touches on is encouraging these vendors to migrate their customers to more secure/modern security standards. How is this handled with KeePass with it being, by its very nature, decoupled?

JamesLeonis 8mo ago
Not the parent, but a heavy user of Keepass. When you unlock your database, you can re-key it with several options for encryption algorithm, key derivation, and the transform rounds. I also have it set up with my Yubikeys as a kinda-sorta two factor for an added layer of security. To keep the encryption modern regular updates are made to the program, and any migration would happen when re-encrypting the database. Checking my earliest entry, I've used it for 15 years without a hiccup.