this post was submitted on 28 Jul 2024
588 points (98.7% liked)

Technology

60078 readers
3519 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 157 points 4 months ago (8 children)

I guess now is as good a time as any for them to start using a proper password manager.

Personally, I recommend Keepass - it has multiple clients for all platforms, and you can keep the file in sync with a program of your own choosing, like Dropbox, syncthing or whatever you like.

[–] [email protected] 62 points 4 months ago (6 children)

Bitwarden is probably a more pragmatic choice for most users, given that it's free and without having to manage the syncing yourself.

Any password manager is better than the alternative, though.

load more comments (6 replies)
[–] [email protected] 57 points 4 months ago (2 children)

Keepass XC on PC, Keepass DX on Android, Syncthing to sync database

Works flawlessly!

[–] [email protected] 21 points 4 months ago (1 children)

Most amazingly, this setup is also unexpectedly resilient against merge conflicts and can sync even when two copies have changed. You wouldn't expect that from tools relying on 3rd party file syncing.

I still try to avoid it, but every time it accidentally happened, I could just merge the changes automatically without losing data.

[–] [email protected] 11 points 4 months ago (2 children)

How did you enable merge conflict resolution for KeePassXC databases?

[–] [email protected] 2 points 4 months ago* (last edited 4 months ago) (1 children)

Depends a bit on the clients.

  • KeePass: Will ask you if you want to synchronize/overwrite/discard the database when saving.
  • KeePassXC: Will autoreload the database in the background, so merge conflicts shouldn't happen in the first place. Otherwise there's 'Merge database' in the menu.
  • KeePass2Android: So I mixed up the names and this is the client I actually use. This one does all changes to an internal copy of the database that is then synchronized on request.
  • KeePassDX: As far as I can see it also has a mechanism similar too KeePass2Android.

Assuming you only have one desktop and mobile client you should never run into any issues. If you do have multiple KeePassXC clients it's all fine as well assuming Syncthing always has another client it can sync with.

[–] [email protected] 2 points 4 months ago

Ah, I can do it inside the client, thank you!

[–] [email protected] 1 points 4 months ago

By ignoring the conflict files

[–] [email protected] 1 points 4 months ago (1 children)

I store my DB in Dropbox and use KeePass2Android on phone which has built in Dropbox sync.

[–] [email protected] 1 points 4 months ago (1 children)

Yeah but then you have to trust Dropbox

[–] [email protected] 1 points 4 months ago

And I do, have used it for 10+ years I think. Keyfile is also used so even with leaked DB file and password, it should be inaccessible.

[–] [email protected] 34 points 4 months ago (2 children)
[–] [email protected] 17 points 4 months ago (2 children)

Exactly! Self hosted FTW. Chances of a data breach.... Typically pretty minor if you are smart.

[–] [email protected] 19 points 4 months ago (6 children)

Chances of losing the data is higher with selfhosting too. Unless you’re doing some sort of multizone replication, or course.

[–] [email protected] 10 points 4 months ago

I use syncthing so there's a copy of my password database on each of my devices.

[–] [email protected] 4 points 4 months ago

I would rather lose my passwords than have my password database be accessed by someone else. Most websites have a "forgot password" function, and for passwords that don't have that (e.g. to decrypt my hard drive or log into my computer) I've memorised the passphrase and always type it manually anyway. And for passwords where neither applies, it's probably not a huge loss anyway if I've not prepared for the possibility of losing my password db for that particular password.

[–] [email protected] 4 points 4 months ago

Yeah. Daily and weekly cloud backups solve that for myself for sure.

[–] [email protected] 3 points 4 months ago

I am hosting on Home Assistant which itself gets a backup to my Google drive and my personal machine. So there are two backups, as long as HA doesn't create a corrupted backup 3 weeks in a row I am good.

[–] [email protected] 3 points 4 months ago

Borg backup to borgbase is not very expensive and borg will encrypt the data plus the vault is also encrypted

[–] [email protected] 2 points 4 months ago

As long as you're still signed into BW from any of your devices, you can always export the vault from there.

(But yes, actual backups are always a plus)

[–] [email protected] 2 points 4 months ago (1 children)

Keep vaultwarden behind wireguard for local only access then also use https certs and good master password. Very secure like this

[–] [email protected] 1 points 4 months ago (1 children)

Why https if the traffic is already encrypted by the vpn?

[–] [email protected] 2 points 4 months ago

Security in layers.

All your services should be using https. Vaultwarden in particular won't even run without https unless you bypass a bunch of security measures.

This is how to setup local only and external https, I highly recommend this as a baseline setup for every homelab. It allows you to choose how much security you want on a per app basis and makes adding new apps trivially easy.

https://youtu.be/liV3c9m_OX8?si=TSWXoN_8SJDpAHaW

[–] [email protected] 7 points 4 months ago (1 children)

+1 for a self-hosted Vaultwarden instance. If you’re technically capable and have extra hardware laying around this is the best way to go.

[–] [email protected] 4 points 4 months ago (2 children)

Although a backup is still required or you are gambling on hardware outliving your need for your data.

[–] [email protected] 3 points 4 months ago

Anyone with the knowledge to self host will quickly discover 3-2-1. If they choose to follow it, that's on them but data loss won't be from ignorance

[–] [email protected] 3 points 4 months ago

100%. Make sure to follow the 3-2-1 backup rule with all things you do.

[–] [email protected] 6 points 4 months ago (3 children)

Shoutouts to paper and pen.

Keep the booklet in a safe place.

[–] [email protected] 21 points 4 months ago (5 children)

If you never, ever need your passwords outside of your home, that's great advice - it's as secure as can be against digital theft. Less so against fire though, and backups are out of the question.

[–] [email protected] 13 points 4 months ago

I just store all my passwords in robots.txt on my web server, makes it easy for me to access them anywhere I go...

/s

[–] [email protected] 4 points 4 months ago (1 children)

Backups are easy? Just copy to another piece of paper and store somewhere else.

I'm just being facetious though.

[–] [email protected] 2 points 4 months ago* (last edited 4 months ago)

I'm not being facetious though. Off-site backups of a digital password collection are easy to setup and maintain. But when you change your password or add a new entry, it's going to be a pain in the ass to have to drive over and update a physical copy.

If you can live with those downsides, that's fine. But in my opinion it would be facetious to pretend a physical backup is "just as good/usable" as a digital one.

-edit: whoops, misread that as implying that I was being facetious. As you were sir -

[–] [email protected] 3 points 4 months ago

I have a firesafe at home for important papers, passports and some emergency cash. I keep my passwords there.

[–] [email protected] 2 points 4 months ago

You can have backups of physical books. Just copy the text from one to the other. Yeah it is manual work but so is writing the first one in the first place. You can then store the second copy in a fire resistant safe or at a friends or family members house (maybe inside a safe as well).

[–] [email protected] 1 points 4 months ago

Well you can write a copy and keep it in a shed if it's unlikely to also catch fire.

[–] [email protected] 5 points 4 months ago (2 children)

Typically, the drawer just below the keyboard (in my experience)

[–] [email protected] 2 points 4 months ago

If it's my mother, post it notes stuck to the laptop...

load more comments (1 replies)
[–] [email protected] 4 points 4 months ago (4 children)

This is the first suggestion here that's actually within the technical abilities of most people, even most Lemmy users.

The level of technical knowledge some of people here seem to think the general public has is absurd.

[–] [email protected] 2 points 4 months ago (1 children)

I'm usually the one promoting technical literacy to all but in this case I honestly don't use a password manager.

[–] [email protected] 1 points 4 months ago (1 children)

It's honestly seemed like more trouble than it's worth, there's a few websites where I just reset my password every time.

[–] [email protected] 1 points 4 months ago

The thing that makes it worth it to me is long, randomly generated passwords that I don't have to know.

None of the sites and services I use require me to type out a password thanks to browser integration and auto type (for desktop apps and such), along with autofill service on android.

Then along with that I can even store other things like account recovery codes (for 2fa) or security questions (which also get randomly generated answers)... It's a handy thing to have IMHO

load more comments (3 replies)
load more comments (4 replies)