Reevaluating my password management
from muusemuuse@sh.itjust.works to selfhosted@lemmy.world on 29 Jun 02:05
https://sh.itjust.works/post/41176411

It never made sense to me to put password managers in the cloud. Regards to what you intend it to do, you’re making it accessible to a wider audience than necessary. And yet, I’m using iCloud. It’s time for a change.

I’m thinking of just running a locally hosted password manager on my home server and letting my devices sync with it somehow when I’m at home. I have a VPN into my home network when I’m away that automatically triggers when I leave the house, so even that’s not that big an issue, but I’m really not familiar with what’s gonna cleanly integrate with all my stuff and be easy to use. All I know is I wanna kill the cloud functionality of my setup.

I already have a jellyfish server so I figured I would just throw this onto that. Any suggestions?

#selfhosted

threaded - newest

Ebby@lemmy.ssba.com on 29 Jun 02:11 next collapse

Bitwarden/vaultwarden is a popular option for selfhosters.

dis_honestfamiliar@lemmy.sdf.org on 29 Jun 03:58 collapse

I do this. Plus VPN to have access to passwords when away from home network

kebab@endlesstalk.org on 02 Jul 01:37 collapse

What’s the issue of exposing this one to the internet? Even if the database gets leaked somehow, your passwords are still protected by a hopefully strong master password + strong encryption

the_abecedarian@piefed.social on 29 Jun 02:33 next collapse

Seafile or nextcloud

Takahe@lemmy.nz on 29 Jun 02:44 next collapse

I use keepass (KeepassXC on desktop, KeepassDX on Android but I’m sure there is an IOS client too) I sync the database between all my devices and my server (hub and spoke) with Syncthing

GreatBlueHeron@piefed.ca on 29 Jun 03:25 next collapse

I've been using various versions of keepass for ever. Until recently I had the database on Google drive. It's now local and sync'd with syncthing. It's a bit "different", but once you get used to it, it works very well.

Takios@discuss.tchncs.de on 29 Jun 05:50 next collapse

Been usingthe same setup for years as well and Im happy with it, never had any issues with it

alienscience@programming.dev on 29 Jun 06:23 collapse

I also use KeepassXC and Synthing together and I am very happy with this combination.

One tip that I have, if you are worried about the security of the database file being shared, is to get 2 Yubikeys and use these, along with a strong passphrase, to protect the database file.

Witziger_Waschbaer@feddit.org on 29 Jun 07:32 next collapse

Same boat for me, works great! I got the NFC Yubikeys which work fine with Android.

4k93n2@lemmy.zip on 29 Jun 15:27 collapse

theres also the option of using a “key file” with Keepass, which can be any file, an mp3, an ebook or whatever, and then you select that file when youre entering your password. so as well as someone trying to brute force your password they also have to guess what key file youre using, which would be next to impossible if you had a folder full of hundreds of files

mbirth@lemmy.ml on 29 Jun 02:47 next collapse

If you’re happy with how Apple Password works for you, I can recommend StrongBox. It keeps all data in a KeePass2 database and integrates into Apple’s AutoFill API. That means it feels almost native when using it. No browser plugin needed. (At least not for Safari.) And you can decide how you sync the database file.

AtariDump@lemmy.world on 29 Jun 03:13 next collapse

Is the data super important to you?

Let someone else host it.

Bitwarden in the cloud.

Edit: Bitwarden paying the monthly/yearly fee to BW. I wasn’t implying trying to host it yourself in the cloud.

prettygorgeous@aussie.zone on 29 Jun 03:41 next collapse

This is how I view password managers too, even though I have my home server backing up

Engywuck@lemmy.zip on 29 Jun 04:14 next collapse

Agreed. Unless your setup and security practices is flawless, I think passwords are better managed by specialists paid for it.

Lv_InSaNe_vL@lemmy.world on 30 Jun 19:20 collapse

Your security will never be flawless. Human nature is to slip up every once and a while, and security is an ever evolving game of cat and mouse and even the professionals who spend their entire careers defending infrastructure are constantly playing catch-up.

I would never host my passwords locally because I know my security at home is nowhere near the security of a professional platform, especially one as trusted as Bitwarden. My dumb family photos and personal git repo? Sure. But Bitwarden holds passwords to my bank, government websites, work stuff, my credit cards, etc.

Waaay too much risk for me, and if anyone is looking at this i would recommend that you seriously consider what kind of liability you are really bringing on.

WQMan@lemmy.ml on 29 Jun 06:05 next collapse

+1 to this; Time spent on your setup is an important factor too.

The more important your data is, the more time you are going to need to spend maintaining your system to ensure security, backups and fail-overs. Not everyone has luxurious amount of time to spend on their home-lab everyday.

IsoKiero@sopuli.xyz on 29 Jun 07:58 collapse

I did self-host bitwarden and it’s not that bad to keep updated and running after initial setup (including backups obviously) but it still requires some time and effort to keep it running. And as I was the only user for the service it just wasn’t worth the time spent for me (YMMV) so I switched to their EU servers and I’ve been a happy user ever since.

What I should do is to improve local backps on that, currently I just export my data every now and then manually to a secured storage, but doing it manually means that there’s often too long time between exports.

tmpod@lemmy.pt on 29 Jun 15:13 next collapse

This. And to add to what other commenters have said, by using Bitwarden and paying for their Premium plan (very cheap, just $10/year), even if you don’t use all their features, you’re supporting a good project. It’s critical infrastructure, I think the price is more than fair.
Either way, you should always make periodic backups from any cloud service you use, encrypted of course.

Waryle@jlai.lu on 29 Jun 22:41 collapse

just $10/month year

tmpod@lemmy.pt on 30 Jun 00:35 collapse

Yes! Oh my, I’m silly; that was precisely my point and I managed to mess it up 🙃

Thank you for the correction!

wise_pancake@lemmy.ca on 30 Jun 12:14 collapse

Passwords are one I happily pay for someone else to worry about

That’s about my most valuable digital data

ohwhatfollyisman@lemmy.world on 29 Jun 03:16 next collapse

i have keepass on only one device. i don’t mind looking up individual passwords and typing them in manually when on other devices.

on the device which hosts keepass, the app is hidden and hoops must be jumped to reach it.

i back up the encrypted password database once a month to a cloud service as insurance against me losing that one device.

it’s not the most convenient setup but i sleep so much easier for it.

4k93n2@lemmy.zip on 29 Jun 15:35 collapse

using passphrases instead of passwords can make this a lot easier as well. a lot of times i just glance at a passphrase on my phone and then type the whole thing in one go into my laptop

metaStatic@kbin.earth on 29 Jun 03:53 next collapse

just have 1 password for everything, problem solved.

WQMan@lemmy.ml on 29 Jun 06:02 collapse

Well, not wrong that it solves the problem, but with data breaches happening frequently, I wouldn’t want to repeat 1 single password for all services lol.

Even if companies hash passwords, it’s still a gamble whether they are using an up-to-date hash algorithm (or if they do even hash it, lol). Plus, generally best to avoid exposing passwords, hashed or not, in the first place.

alienscience@programming.dev on 29 Jun 06:30 next collapse

I do this for sites where I don’t care at all about security. One minor tip, that will protect against automated attacks if the password is cracked, is to add part of the website name into the password (e.g “mystrongp4ss!lemworld”) .

A human could easily crack it, but automated systems that replay the password on different sites would probably not bother to calculate the pattern.

fluckx@lemmy.world on 29 Jun 08:28 collapse

If just one or those passwords gets leaked you might find a lot of other ones get cracked as well.

It may not be sites that you care about. But using a password manager is a lot less effort and a lot safer than whatever technique the average Joe will come up with.

Any password that leaks which could indicate a potential system ( e.g.: sitename in lower/upper/leetspeak) makes the whole thing even more vulnerable.

Just use something. Bitwarden, vault warden, keepassxc, …

Knowing my social circle I’d recommend bitwarden. Even paying for it costs a measly 10$/year, while the free version is very usable in itself. And generating passphrases or 32char passwords will be a lot safer than whatever the hell they can come up with.

Just avoid the default browser ones, big tech and LastPass.

Lv_InSaNe_vL@lemmy.world on 30 Jun 19:22 collapse

just use something

This! I am an IT admin and inam constantly begging my coworkers to use a password manager, any password manager. My company will pay for you to use Bitwarden but if you don’t want to do that at least use the password manager built into chrome/edge. Please, I am begging you to use secure passwords and save them in a password manager.

(Obviously not you fellow Lemmy users I’m sure y’all have too notch security practices. Just venting lol)

metaStatic@kbin.earth on 29 Jun 07:08 collapse

I was being facetious. Every site has multiple special requirements to make your password stronger weaker, the odds of being able to use a single one are slim even if you where dumb enough to try.

4am@lemmy.zip on 29 Jun 04:03 next collapse

Self hosting a password manager is great, but be sure to read up on keeping it secure, and don’t store anything important in it until you have working, tested backup solution. And re-test it frequently in a non-destructive way.

If you lose your password storage to a disk failure or something, you’re gonna be hurting for a while.

kowcop@aussie.zone on 29 Jun 04:11 next collapse

I don’t really see the problem with having the password manager in the cloud if it is protected by 2FA. I tried vaultwarden (self hosted) about a year ago and the showstopper was that I couldn’t store a new password when off LAN or without first connecting the VPN. I am sure there are on demand vpn type services, but it was clunky. It would have been great it if would work locally on the phone then sync the password to the vault when it came back online

aksdb@lemmy.world on 29 Jun 05:35 next collapse

If you don’t have a hard requirement of it being fully (!) OpenSource, then I would recommend Enpass. Relatively pleasing UI that runs native on Win, Mac, Linux, Android and iOS. It has browser plugins for Chrome and Firefox that talk directly to the running fat client (so no multiple authentication with different browsers necessary).

The password db is completely local, but it offeres several sync mechanisms like WebDAV or Dropbox or also iCloud; basically whatever can store files. If it’s a NAS in your home, it simply will sync once you are back home.

It also offers “WiFi Sync”, in which case you designate one machine running Enpass as the server and link other clients to it, then you don’t even need to run a separate hosting for it (but that machine needs to be on and running Enpass when you want to sync, obviously).

It’s basically a less open but much more convenient and beautiful KeePass(XC).

glitching@lemmy.ml on 29 Jun 06:29 collapse

I used enpass for years and was a happy user. one day it prompted me for some re-authentication bullshit security theater. although in that instant it was an easy task, took me all of 10 seconds, it demonstrated a scary amount of power they had as I couldn’t bypass it and access my data. from that point on, its days were numbered.

the second issue is the export functionality that was seriously lacking and I had to resort to 3rd party converter tools to convert it to keepassXC; no way that flew by their QC, it had to be intentional.

aksdb@lemmy.world on 29 Jun 09:10 collapse

On mobile I indeed also had that issue once. However I made sure they can’t lock me out completely. The db is stored using the opensource sqlcipher, so one can open it and extract everything manually, if absolutely necessary. As long as they don’t change this, I am fine. In the worst case that would still be a lot of effort for me, but not impossible.

The export has also improved a lot. You can now also export to JSON which includes all the data one could need.

dr-robot@fedia.io on 29 Jun 06:05 next collapse

Why not use KeepassXC? It's a completely local encrypted db but it integrates with cloud storage apps like nextcloud for sync. It has plugins for integration with Firefox and KeepassAndroid is pretty smooth on the current Android OS.

glitching@lemmy.ml on 29 Jun 06:32 next collapse

this one, OP. no need to introduce the horror that’s a:

  • hosted app (why?!)
  • client app is electron crapware
  • the client app doesn’t even have full functionality, you have to use the web UI for some tasks

edit: I’m obviously speaking about the bitwarden/vaultwarden horror. keepassXC is none of them things.

null_dot@lemmy.dbzer0.com on 29 Jun 09:43 collapse

KeepassXC is the only thing that makes sense to me.

I don’t want all my passwords stored with some huge target like lastpass or bitwarden.

Encrypted local (and synced) DB is the only way.

unexposedhazard@discuss.tchncs.de on 29 Jun 07:45 next collapse

Yup this is the way. The resulting .kdbx database file is encrypted so you can even synchronize it over an untrusted provider. Otherwise you can use something like syncthing to keep it strictly peer to peer.

sxan@midwest.social on 29 Jun 11:56 next collapse

Shamelessly shilling my OSS project, rook. It provides a secret-server-ish headless tool backed by a KeePass DB.

  • Headless server
  • Optional and convenient integration with the kernel keyring (on Linux), for locking the server to only provide secrets to the user’s session
  • Provides a range of search, list, and get commands
  • Minimal dependencies and small code base make rook reasonably auditable

You might be interested in rook if you’re a KeePassXC user. Why might you want this instead of:

  • Gnome secret-server, KDEs wallet, or pass? rook uses your (a) KeePass DB, while most other projects store secrets in their own DBs and require (usually manual) sync’ing when passwords change.
  • One of the browser secret storage? Those also keep a bespoke DB which needs to be synced, and they’re limited to browser use. Rook supports using secrets in cron jobs or on the command line (e.g. mbsync, vdirsyncer, msmtp, etc, etc).
  • KeePassXC? KeePassXC does provide a secret service that mocks Gnome secret-service, but you have to keep KeePassXC (a GUI app) running even if you only rarely use the UI. Rook can also be used on a headless machine.
  • The KeePassXC command line tool? That requires entering the password for every request, making it tedious to use and impractical for automated, periodic jobs.

Rook is read-only, and intended to be complementary to KeePassXC. The KeePassXC command line tools are just fine for editing, where providing a password for every action is acceptable, and of course the GUI is quite nice for CRUD.

not_amm@lemmy.ml on 29 Jun 17:42 collapse

Damn, that sounds very interesting! The use of a Keepass DB instead of a new one makes it great to have as option. It’s something I hadn’t think about for a long time.

I’ll check it out later and maybe install it after I restore my server, I’m planning to reduce my attack surface too:)

sxan@midwest.social on 01 Jul 11:56 collapse

If you do, use the -k option - it locks access to the rook service to only the user session. Rook works without it, but is more secure with it.

oyzmo@lemmy.world on 01 Jul 05:03 collapse

Any iOS app?

Nibodhika@lemmy.world on 29 Jun 06:14 next collapse

It’s strange how I never see this mentioned anywhere, but there’s a way to get unique secure passwords for every site/app without needing to store them anywhere. It’s called LessPass, and essentially generates passwords based on 3 fields (site, username, master password) and works relatively well, because the advantages are quite obvious I’ll list the potential downsides:

  • If one password is compromised or needs changing for whatever reason you need to increase a counter and need to remember which counter for which site (this is less problematic than it sounds, except in places that have a password policy that forces you to change your password periodically)
  • Android can store the master password and use fingerprint to input it, but in PC you always have to type your master password which can get annoying.
  • You need to change your passwords to this new format, which can take a while, and years down the line you’re trying to login somewhere and don’t remember if you’ve already migrated it or not.
MimicJar@lemmy.world on 29 Jun 07:17 collapse

You also have to keep track the site and how you spell it. For example is it “Microsoft” or “microsoft”?

And keep track of the current name of the site vs the old name. For example am I signing into Microsoft or Live.com or Xbox?

And keep track of my username. Is it my email? Which email? Which username?

I understand the concept but I think if falls apart fast.

Nibodhika@lemmy.world on 29 Jun 07:48 collapse

Yup, but most of that is easily solvable by being consistent, e.g. always use lowercase and your email (even if it’s not the login for that site). But yes, you need to know to be consistent so it’s a good point to make.

thelittleblackbird@lemmy.world on 29 Jun 12:17 next collapse

I have more than 120 electronic identities, impossible to track the counter or to remember the tld of all websites I visit.

The concepts is only useful in a very small and defined scenario.

Nibodhika@lemmy.world on 29 Jun 13:18 collapse

My point is that of those 120 probably 110 have never been compromised nor forced you to change the password due to expiration policies. The remaining 10 are the ones that require some mental gymnastics, so while the problem exists it’s not as serious as it sounds. I probably have more than 120 identities using this method since I’ve been using it for years, and I don’t think I ever had to use the counter, it’s a matter of being consistent in how you think about websites, for example if you know how you refer to a site slugify it and use that for the field, so you would use spotify, netflix, amazon-prime.

Onomatopoeia@lemmy.cafe on 29 Jun 13:14 collapse

Hahaha, that’s the point of a password manager. If remembering worked, we wouldn’t need any of this.

Also, I have 300+ unique logins.

radar@programming.dev on 29 Jun 12:26 next collapse

I use GNU pass synced through an internal Gitea. Have wireguard to sync remotely. Works pretty good, I would recommend not setting an expiration on the key, the git history keeps the old encryption anyways.

user8N2elyIDTP3L@lemm.ee on 29 Jun 15:07 collapse

This is the way to go… though I’ve moved from pass to go pass which is basically the same thing but written in go and looks to be better maintained… also moved from gitea to forgejo since I think gitea has had some maintainer changes over the last couple of years that may not have been in the spirit of remaining fully FOSS

irmadlad@lemmy.world on 29 Jun 14:35 next collapse

I look at it like this:

  • I don’t absolutely trust the security of my server. Sure, it hasn’t had a breach…yet, but that possibility is inevitable, given the amount of bots that keep trying to get in by the minute. It’s secure, yes, but is it secure enough to entrust the keys to my bank account, my business ventures, et al? IF somebody got the key to my Lemmy account, it would be bothersome, but not cataclysmic since all online accounts are silo’d with only a couple that are linked.
  • Bitwarden spent a lot of time and money building a large infrastructure that is, imho, far more secure than my little server. Bitwarden has a pretty good track record. They have had some vulnerabilities, even as recent as '23 but these have been remediated.
  • Confirmation bias…I’ve been using Bitwarden for untold years now and have never had an issue, other than the recent UI theming schema that was so castigated by users that they offered a way to switch back.

While hosting my own password manager would fit right in with the rest of my selfhosting, I think sometimes it’s better to defer to more secure options when dealing with highly sensitive data.

philpo@feddit.org on 30 Jun 06:17 collapse

Bitwarden is absolutely solid,yes.

Local server wise: If OP uses it in a local only setup behind a proper VPN implementation from my point of view the risk is acceptable. It’s not that hard to secure a home server in a way that Vaultwarden is not at risk - and when you’re so compromised that it is, then the attacker can easily use other vectors to gain the same data (RAt,keyloggers, etc.)

SanndyTheManndy@lemmy.world on 29 Jun 15:13 next collapse

KeepassXC + Syncthing. Using for 2+ years no issues. Have separate database files for each device and merge them as needed.

lka1988@sh.itjust.works on 29 Jun 21:10 collapse

I do the same thing on my laptop and gaming PC. My only beef with KeePassXC is that they refuse to implement WebDAV, despite the OG KeePass having it. Otherwise it’s fantastic.

halcyoncmdr@lemmy.world on 29 Jun 16:10 next collapse

I switched to Bitwarden after the LastPass stuff a couple years ago, and I just got around to installing Vaultwarden on my TrueNAS system at home. Using a single Cloudflare Tunnel to handle secure external connections for that and other services like Emby easily. Took a little bit to setup following some guides, but has been working flawlessly for me and some friends. You can use the regular Bitwarden apps and extensions since they natively support self hosting.

Tramort@programming.dev on 29 Jun 16:49 next collapse

Sandpass on sandstorm

It’s dated, but phenomenal (and secure)

4k93n2@lemmy.zip on 29 Jun 21:11 next collapse

if you need to share passwords with other people and do that often then that would be the only reason i would recommend a server-client based password manager. otherwise theres too many points of failure for my liking, especially for something that i use on a daily basis.

KeePass on the other hand is just a single file thats stored locally and all you need is an app to read it. you dont need an internet connection or a VPN to access it remotely. your wifi could be down, even your power could be out and you would still have access to your database

being able autofill desktop program logins was the main reason i switched away from bitwarden years ago

KeepassXC on desktop has a feature called “Autotype” which basically simulates keystrokes to fill in your passwords. theres also an option to integrate with the KeepassXC browser extension, but with Autotype your browser has no connection to your database at all. i kind of feel this is a huge elephant in the room that most other password managers just gloss over. sure, you are getting a lot more convenience by having your browser autofill your passwords but its also adding a huge attack surface just for the sake of a few seconds or a few clicks.

that said, Autotype isnt great at guessing all sites you might be trying to log into but there is this browser extension that will change your browsers window title to show the full site url which KeepassXC can then read

one really underrated feature that i dont see any of the others doing is giving you the ability to use multiple vaults at once. you can have one vault for things that are really important, then everything else in another vault and have different strength passwords/passphrases for each one. i have maybe 300 logins but only around 10% of them are important. its kind of a pain if all you want to do is just log into some random forum but you have to type a long secure master password just to open your vault

lka1988@sh.itjust.works on 29 Jun 21:19 next collapse

I use KeePass (Keepass2Android, KeePassXC, OG KeePass, and KeePassium) for everything. Been using KeePass in general for 20-ish years.

Recently, I decided to export all of my passwords from Firefox, Chrome, and Edge, import the data into my KeePass database under their own folders, then delete everything from the browsers. That way I can move entries that weren’t already in the database to their respective locations in the database hierarchy, delete duplicates, and change insecure passwords.

The database is hosted on my phones (work and personal), laptop, gaming PC, and a server at home, all synced with Syncthing. My work laptop also has Portable KeePass that accesses the database via WebDAV to my server.

Cyber@feddit.uk on 29 Jun 21:59 next collapse

This

x10

ClydapusGotwald@lemmy.world on 29 Jun 22:09 collapse

This is what I did. Once Firefox did something and wiped my passwords from sync only way I got them back was I had an old laptop I didn’t use often that was synced to my account. Now I use keepass that’s saved locally and a backup on my nas & flashdrive.

ikidd@lemmy.world on 30 Jun 06:07 collapse

If you’ve been using passkeys, you’ll need to generate new ones when you switch. AFAIK, they aren’t exportable from Google or Apple. Which, among other reasons, is why I’ll just stick to high-entropy passwords. I’ve had some sites like Amazon try to sneakily make me register passcodes, I’ve had to go back and tear them out before they screw me somehow.

yo_scottie_oh@lemmy.ml on 01 Jul 11:16 collapse

try to sneakily make me register passcodes

Can you expand on this? I’m not sure what this means. Is it like instead of a full fledged password, just a four digit PIN or something? Thanks.

ikidd@lemmy.world on 01 Jul 13:14 collapse

For some reason, when I registered my phone number for delivery notifications, it made a passkey and registered it with my account. It never prompted me to save the passkey, so I had no idea where it was supposed to be used. I immediately deleted it because I was concerned I wasn’t going to be able to log in if I logged out without knowing what that passkey was and had it in my password manager.