I guess now is as good a time as any for them to start using a proper password manager.
Personally, I recommend Keepass - it has multiple clients for all platforms, and you can keep the file in sync with a program of your own choosing, like Dropbox, syncthing or whatever you like.
Never trust your credentials to yourself, you can be bought out by beer, poor decisions, and tripping over the cables connected to your home server you cobbled together.
I’m not sure what you’re comparing it to. Keepass is free too, in fact it’s open source. In my opinion, local software and database that is under your control is always superior to cloud.
Keepass over Bitwarden offers a lot of plugins and integrations, again, if you want more customization or automation.
But, I would say you can use any online password manager as long as it’s end to end encrypted, so Bitwarden is a good choice.
Should have say: self-hosting is always superior to cloud hosting.
That statement still comes with a pretty damn big caveat though - you need to have the know-how, the time to invest and the hardware (i.e money) to actually set something like this up.
If all of those are true, then self-hosting can definitely be an attractive option for you.
It’s only true for a vanishingly small fraction of the population, though.
Hence, Bitwarden is a pragmatic solution that will be superior for the vast majority of the population.
I think your bias may be showing. The average computer user doesn’t even think about using a password manager. It just exists and works in their browser.
If getting a Dropbox account is too difficult for them, I seriously wonder why they’d be subscribed here, or reading articles about password management in browsers.
If you never, ever need your passwords outside of your home, that’s great advice - it’s as secure as can be against digital theft. Less so against fire though, and backups are out of the question.
I’m not being facetious though. Off-site backups of a digital password collection are easy to setup and maintain. But when you change your password or add a new entry, it’s going to be a pain in the ass to have to drive over and update a physical copy.
If you can live with those downsides, that’s fine. But in my opinion it would be facetious to pretend a physical backup is “just as good/usable” as a digital one.
-edit: whoops, misread that as implying that I was being facetious. As you were sir -
All your services should be using https. Vaultwarden in particular won’t even run without https unless you bypass a bunch of security measures.
This is how to setup local only and external https, I highly recommend this as a baseline setup for every homelab. It allows you to choose how much security you want on a per app basis and makes adding new apps trivially easy.
Most amazingly, this setup is also unexpectedly resilient against merge conflicts and can sync even when two copies have changed. You wouldn’t expect that from tools relying on 3rd party file syncing.
I still try to avoid it, but every time it accidentally happened, I could just merge the changes automatically without losing data.
KeePass: Will ask you if you want to synchronize/overwrite/discard the database when saving.
KeePassXC: Will autoreload the database in the background, so merge conflicts shouldn’t happen in the first place. Otherwise there’s ‘Merge database’ in the menu.
KeePass2Android: So I mixed up the names and this is the client I actually use. This one does all changes to an internal copy of the database that is then synchronized on request.
KeePassDX: As far as I can see it also has a mechanism similar too KeePass2Android.
Assuming you only have one desktop and mobile client you should never run into any issues. If you do have multiple KeePassXC clients it’s all fine as well assuming Syncthing always has another client it can sync with.
I guess now is as good a time as any for them to start using a proper password manager.
Personally, I recommend Keepass - it has multiple clients for all platforms, and you can keep the file in sync with a program of your own choosing, like Dropbox, syncthing or whatever you like.
Never trust your credentials to a private company, they could be bought out by state actors.
Never trust your credentials to yourself, you can be bought out by beer, poor decisions, and tripping over the cables connected to your home server you cobbled together.
The xz compromise having demonstrated that FOSS projects are totally immune to interference from state actors…
Bitwarden is probably a more pragmatic choice for most users, given that it’s free and without having to manage the syncing yourself.
Any password manager is better than the alternative, though.
I’m not sure what you’re comparing it to. Keepass is free too, in fact it’s open source. In my opinion, local software and database that is under your control is always superior to cloud.
Keepass over Bitwarden offers a lot of plugins and integrations, again, if you want more customization or automation.
But, I would say you can use any online password manager as long as it’s end to end encrypted, so Bitwarden is a good choice.
Now there’s an unfounded blanket statement if I ever saw one.
Statement related to previous cloud hacks i assume.
Should have say: self-hosting is always superior to cloud hosting.
Bitwarden (the client) + Vaultwarden (the self-hosted server) is a good combo if you have some knowledge on how to setup it.
That statement still comes with a pretty damn big caveat though - you need to have the know-how, the time to invest and the hardware (i.e money) to actually set something like this up.
If all of those are true, then self-hosting can definitely be an attractive option for you.
It’s only true for a vanishingly small fraction of the population, though.
Hence, Bitwarden is a pragmatic solution that will be superior for the vast majority of the population.
I think your bias may be showing. The average computer user doesn’t even think about using a password manager. It just exists and works in their browser.
No dislike for Keepass here, but I prefer Bitwarden. It’s also super easy to self host with Vaultwarden.
Shoutouts to paper and pen.
Keep the booklet in a safe place.
This is the first suggestion here that’s actually within the technical abilities of most people, even most Lemmy users.
The level of technical knowledge some of people here seem to think the general public has is absurd.
If getting a Dropbox account is too difficult for them, I seriously wonder why they’d be subscribed here, or reading articles about password management in browsers.
We’re lost
I’m usually the one promoting technical literacy to all but in this case I honestly don’t use a password manager.
It’s honestly seemed like more trouble than it’s worth, there’s a few websites where I just reset my password every time.
Typically, the drawer just below the keyboard (in my experience)
If you never, ever need your passwords outside of your home, that’s great advice - it’s as secure as can be against digital theft. Less so against fire though, and backups are out of the question.
Backups are easy? Just copy to another piece of paper and store somewhere else.
I’m just being facetious though.
I’m not being facetious though. Off-site backups of a digital password collection are easy to setup and maintain. But when you change your password or add a new entry, it’s going to be a pain in the ass to have to drive over and update a physical copy.
If you can live with those downsides, that’s fine. But in my opinion it would be facetious to pretend a physical backup is “just as good/usable” as a digital one.
-edit: whoops, misread that as implying that I was being facetious. As you were sir -
Vaultwarden ftw
+1 for a self-hosted Vaultwarden instance. If you’re technically capable and have extra hardware laying around this is the best way to go.
Although a backup is still required or you are gambling on hardware outliving your need for your data.
Anyone with the knowledge to self host will quickly discover 3-2-1. If they choose to follow it, that’s on them but data loss won’t be from ignorance
100%. Make sure to follow the 3-2-1 backup rule with all things you do.
Exactly! Self hosted FTW. Chances of a data breach… Typically pretty minor if you are smart.
Keep vaultwarden behind wireguard for local only access then also use https certs and good master password. Very secure like this
Why https if the traffic is already encrypted by the vpn?
Security in layers.
All your services should be using https. Vaultwarden in particular won’t even run without https unless you bypass a bunch of security measures.
This is how to setup local only and external https, I highly recommend this as a baseline setup for every homelab. It allows you to choose how much security you want on a per app basis and makes adding new apps trivially easy.
https://youtu.be/liV3c9m_OX8?si=TSWXoN_8SJDpAHaW
Keepass XC on PC, Keepass DX on Android, Syncthing to sync database
Works flawlessly!
I store my DB in Dropbox and use KeePass2Android on phone which has built in Dropbox sync.
Yeah but then you have to trust Dropbox
Most amazingly, this setup is also unexpectedly resilient against merge conflicts and can sync even when two copies have changed. You wouldn’t expect that from tools relying on 3rd party file syncing.
I still try to avoid it, but every time it accidentally happened, I could just merge the changes automatically without losing data.
How did you enable merge conflict resolution for KeePassXC databases?
Depends a bit on the clients.
Assuming you only have one desktop and mobile client you should never run into any issues. If you do have multiple KeePassXC clients it’s all fine as well assuming Syncthing always has another client it can sync with.
Ah, I can do it inside the client, thank you!