Which password manager to use?
Which password manager to use?
I currently use KeepassXC that is synced through NextCloud. The sync isn't very elegant, especially on my phone. So I'm looking for a new password manager, which has a native server sync support that I can self host. What do y'all recommend? I need at least a phone app and a browser integration that can autofill.
Hackers have increased their focus on cracking password managers by extracting data from RAM and registry, compromising local and cloud storage. 25% is a threefold increase compared to the previous year's figures.
I use KeepassXC on desktop, KeepassDX on my phone and keep it all synced with Syncthing. Works great
Yea I was just saying that. Well said
If you can't self host --> KeePass If you can self host --> Vaultwarden
Is VW audited in the same way that BW is?
I'm not completely sure, but doesn't Bitwarden encrypt all data before it reaches the server? That means the server implementation is a bit less important. I guess you probably don't want to be leaking even encrypted databases though since there is a chance they could be cracked.
Really I don't know, surely a bit less but in my opinion, not that much
I hear good thing about Vaultwarden, but the web UI is horrible.
Vaultwarden's web UI is very confusing, especially the search feature. And it's difficult to move items between folders/collection. The desktop app is available as DEB/RPM package but without auto-update, which isn't great.
Fon now I'm sticking to KeepassXC because the desktop app for my Linux distribution has a package for it and allows auto-update. The UI works well, and it has decent browser integration. Syncing isn't smooth, but I can live with this.
Bitwarden is excellent and the paid plan is very reasonable unlike with others.
I like to use SyncThing for my keepass vault. Imo it's about as simple and elegant as it can get without involving third party services.
I know you're asking for an integrated sync but this has been flawless for me and only rarely notice a delay between machines including android, linux, and windows (less that 30s in any case)
Bitwarden
Never looked back.
For native sync, the two good and reputable alternatives are Bitwarden and Proton Pass
2nding the Bitwarden, absolutely love it. I moved from LastPass years ago and never looked back.
3rded moving from LastPass to Bitwarden and never looking back. I got out when LogMeIn got in.
Bitwarden.
My recommendation: Don't use Vaultwarden (self hostable server side of bitwarden. Really easy to run and use). Why? You're not a security personal, and securing your vault isn't your job. You might do a slight mistake that'll lead to the compromise of your vault.
The people at Bitwarden have their work dedicated to securing the vaults and all they do is security. And they'll probably do it better then you. When it comes to serious matter, I prefer to trust the professionals.
VW isn’t the self hostable version of BW. It’s a complete rewrite. I don’t know if it is audited in the same way as BW, so I wouldn’t recommend it until you check that. BW can be self hosted as it is. VW is a rewrite with all the premium features unlocked for free
Ignoring the security aspect of it Bitwarden is responsible for hosting a fault tolerant, highly available web app.
They have redundant networking, redundant servers, load balancers, redundant databases.
While you could host this yourself to these tolerances it's work and it's not free.
If you're using your password manager to the fullest you have a different password for every resource out there. It's more than a minor inconvenience if you get locked out of your passwords.
Their service is dirt cheap and it's absolutely worth every penny.
Just to play devils advocate. Bitwarden.com is a much more valuable target. My instance is behind a VPN. I think its actually far more likely Bitwarden will have a breach similar to LastPass then I will. But I agree with you mostly.
Doesn't the server just hold an encrypted vault? What could go wrong when the server is compromised? Just thinking out loud I don't know the answer
Security is also about backups. 3 Replicas 2 Formats 1 Offsite location
I just don't want any unauthorized persons anywhere near my vaults in general. I also see my vault as a critical service that requires high availability, and I know enough about system administration to know that my network and I are not qualified to provide that.
Yep, that's right. In theory you could share the encrypted DB with the public and not degrade security. (Still don't do that though...)
I haven't seen it mentioned here so I'll throw it out there - 1Password. It's just a very smooth experience that I really appreciate.
Got a free family subscription through my work. Before that I was paying for it.
1Password is just great. Wonderful Linux support (desktop app, cli client, identity agent for SSH).
The major update to version 8 was rolled out to Linux first, actually.
One of the few pieces of software where you feel that the developers care about their product.
I also use Unix pass and self host a git repo over Tailscale to keep it synced across devices. Works like a charm so long as I remember to push whenever I edit a password somewhere.
Vaultwarden works really well for me.
Good thing the KeepassXC can be used as a 2nd factor authenticator, though it has TOTP only, doesn't offer HOTP.
Proton pass if general UX and speed are important to you. Bitwarden if amount of features is important to you
Keepass2android should be able to handle nextcloud sync from within the app so that might work better than on device sync. If your done with keepass bitwarden or proton pass are common alternatives
If you're on Android I had seen a better UX for synching with the client Keepass2droid than with KeepassXC or KeepassDX.
On iOS maybe try Keepassium.
I do the exact same thing as OP with KeepassDX at work and works pretty nice so far, since I gave KeepassDX the right acces rights on the nextxloud directory.
What diferences have you figured out so far with Keepass2android in comparison ?
Easier to setup sync for noobs, however this was years ago maybe it has changed since on DX