Open Source

28952 readers

397 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Posts must be relevant to the open source ideology
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 4 years ago

MODERATORS

[email protected]

How do you handle your passwords? (beehaw.org)

submitted 2 months ago by [email protected] to c/[email protected]

62 comments fedilink hide all child comments

I rely on Bitwarden (slooowly migrating from... a spreadsheet...) and am thinking of keeping a master backup to be SyncThing-synchronized across all my devices, but I'm not sure of how to secure the SyncThing-synchronized files' local access if any one of my Windows or Android units got stolen and somehow cracked into or something. I'm curious about how others handle theirs. Thanks in advance for sharing!

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 7 points 2 months ago (1 children)

For years I've been using KeepassXC on desktop and Keepass2Android on mobile. Rather than sync the kdbx file between my devices, I have each device access it through the network. Either via sftp, smb, or nfs, but regardless I need to connect to my home's VPN to access it when away from home since I don't directly expose those things to the outside world.

I used to also keep a second copy of the website-tied passwords in Firefox Sync, but recently tried migrating that to Proton Pass because I thought the PIN feature might help, then ultimately decided to move away from that too and start using the KeepassXC-Browser plugin instead. I considered Bitwarden too but haven't tried it out yet, was somewhat deterred by seeing people say its UI seems very outdated.

[–] [email protected] 1 points 2 months ago (1 children)

Is syncing the .kbdx files using Syncthing unsafe?

[–] [email protected] 2 points 2 months ago (2 children)

Syncing files that you may open in both (or more) devices at the same time is unsafe with any service, but you can manage to avoid sync conflicts with KeePass if you do not open the same file at the same time or open the Android app in read-only mode. I've only had like 3-4 conflict files this year and they weren't important.

[–] [email protected] 3 points 2 months ago

@not_amm And I think Keepass (XC) has a merge function which can very easily resolve these conflicts.

[–] [email protected] 1 points 2 months ago (1 children)

Do the files pass through their servers unprotected? I don't really understand how Syncthing works under the hood.

[–] [email protected] 1 points 2 months ago

From https://docs.syncthing.net/users/faq.html#what-is-syncthing (bolding mine)

We believe your data is your data alone and you deserve to choose where it is stored. Therefore Syncthing does not upload your data to the cloud but exchanges your data across your machines as soon as they are online at the same time.