this post was submitted on 28 Sep 2023
79 points (98.8% liked)

Selfhosted

40349 readers
550 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
79
PasswordManagement: which one of these options would you choose? (lemmy.wtf)
submitted 1 year ago by [email protected] to c/[email protected]
107 comments fedilink hide all child comments
 

Objective: Secure & private password management, prevent anyone from stealing your passwords.

Option 1: Store Keepass PW file in personal cloud service like OneDrive/GoogleDrive/etc , download file, use KeepassXC to Open

Option 2: Use ProtonPass or similar solution like Bitwarden

Option 3: Host a solution like Vaultwarden

Which would do you choose? Are there more options ? Assume strong masterpassword and strong technical skills

(page 2) 50 comments
sorted by: hot top controversial new old
[–] [email protected] 3 points 1 year ago* (last edited 1 year ago)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

Fewer Letters More Letters
DNS Domain Name Service/System
Git Popular version control system, primarily for code
IP Internet Protocol
NAS Network-Attached Storage
SSH Secure Shell for remote terminal access
VPN Virtual Private Network
VPS Virtual Private Server (opposed to shared hosting)

7 acronyms in this thread; the most compressed thread commented on today has 4 acronyms.

[Thread #173 for this sub, first seen 28th Sep 2023, 18:45] [FAQ] [Full list] [Contact] [Source code]

[–] [email protected] 3 points 1 year ago

Option 1, with manual copying to mobile. I tried syncthing in the past but had problems with corrupted files

[–] [email protected] 3 points 1 year ago

I've been using option 1 for many many years. It lets me keep control of the encryption, and it's accessible just about anywhere.

[–] [email protected] 3 points 1 year ago

To improve security of option 1 you could use a keyfile, that is either only transferred manually to devices or stored at a second cloud provider.

[–] [email protected] 3 points 1 year ago

Why not Keepass on a webdav server? Both Keepass on the computer and Keepass2Android can open the file directly. If you save it on one it will merge the changes in any other copies you have open.

[–] [email protected] 2 points 1 year ago (1 children)

I do 3 and have encrypted backups to Dropbox so I can easy restore/spin up a cloud server if I need to

[–] [email protected] 1 points 1 year ago

Yep but use Microsoft.

[–] [email protected] 2 points 1 year ago

Been using option 3 but with Bitwarden for almost 5 years at this point. First started out on a VM in a cloud provider. Now it's in a VM on unraid behind a local HAProxy or Cloudflare tunnel for remote access.

Bitwardens full docker stack provides great daily backups which I've had to restore on occasion or go back to one from months ago to dig out a password for my wife.

Been testing and hoping to move to the unified-container from them soon, assuming I can replicate encrypted backups like their solution.

[–] [email protected] 2 points 1 year ago

I switched to proton pass after using bitwarden for a couple years

[–] [email protected] 1 points 1 year ago (1 children)

Lastpass /s

load more comments (1 replies)
[–] [email protected] 1 points 1 year ago

Option 2, because once you start thinking about the ways your stuff could be stolen ("threat modelling") you'll see that realistically it's the easiest option.

[–] [email protected] 1 points 1 year ago

I like LessPass, essentially you choose one password and then it generates secure passwords for each website, since it uses a predefined generation algorithm it's completely offline and doesn't need syncing it's very secure. However it has the inconvenience of needing to remember the way you spelled the website, but if you stick to something like all lowercase it's fine.

[–] [email protected] 1 points 1 year ago (1 children)

I like Enpass. $25 lifetime sub via Stack social. Does the trick. If they ever pull the rug out on lifetime folks, I would go to Bitwarden.

[–] [email protected] 2 points 1 year ago (2 children)

I ended up scoring a free lifetime membership years ago, but is their stuff open source? I never fully trusted it, so I didn't end up using it for anything

[–] [email protected] 1 points 1 year ago

Enpass uses the open source library sqlcipher (which is an sqlite fork with encryption). So while Enpass as a whole is not fully open source, you can still exfiltrate your passwords with open source tools, should they ever vanish or radically change their business model. You can then use for example enpass-cli.

That gives me enough confidence to trust in Enpass, since they can't easily hold my data hostage.

[–] [email protected] 1 points 1 year ago

It's not open source, so that's an easy deal breaker for some. Considering the vaults are encrypted and Enpass itself stores nothing on their servers, I've been okay with it. The vaults just exist on my phone and wherever I've chosen to back it up (OneDrive, GDrive, Nextcloud, NAS, etc).

[–] [email protected] 1 points 1 year ago

I did option 1 for a number of years but now I'm doing option 3 off a proxmox container and some cloud scripted backup. So far so good.

We just started doing option 3 at work and just keep it behind the firewall. It is going well so far.

load more comments
view more: ‹ prev next ›