71–80 of 131 posts
At my current work, we have a lot of credentials to test environments shared on one single keepass file and I am wondering if I could securely use it as a network accessible (VPN only) vault and ideally something I could programmatically fetch those credentials for CI.
Is there something that would allow a keepass db file to be shared through a REST API? At my current work, we have a lot of credentials to test environments shared on one single keepass file and I am wondering if I could securely use it as a network accessible (VPN only) vault and ideally something I could programmatically fetch those credentials for CI.
In a way this is a nice example of why 1Password or BitWarden are doing well. This might work out okay for a technical person, but the average user isn't going to look at the KeyPass downloads page [1] and feel confident about what to download -- even assuming they're using Windows, you need a phone app and sync for meaningful password management these days... and that's very worrying in their presentation. Whereas 1…
> phone app and sync for meaningful password management these days Idk. I very intentionally decided to not have 98% of my passwords on my phone. (The remaining few rarely change and I put them in my phone by hand without sync.) This decision was less because of security consider but more because I don't want to be able to access the services through my phone. If then anyone (especially I myself) wants to pressure me…
But work gets its own separate password manager that only lives on the work computer and nowhere else. I’ll get fired before I even think about work outside of work hours let alone on vacation.
Does anyone has a good self hosting sync scheme? Keepass is awesome... But hadn't managed the sync to work smoothly yet
I just use keepassxc and have a cron job that zips and encrypts the password vault and then uploads it to Amazon S3 once a day, simple and pretty much foolproof, probably costs me $0.12 a year for storage.
you can improve fool proving by watching the db file for change and then uploading it
you can further improve it by checking if the uploaded file is the one which was there when you did download it last and only then upload your changed version
but yes, for many people that simple approach would be good enough by far I mean how often do you add new passwords?
trained myself and my siblings back in 2013-15. that time was VERY difficult for them because i kept pestering them to remember every account login, every piece of important information on it to a point it became a stupid chore. years later, its wonderful. they have EVERYTHING there and on their phones. they they dont need to keep the data synced at two places since they only use their phone so they keep a live copy…
the secondary improvement is by making it convenient to use and in turn discourage people from putting their passwords on sticky notes
In a way this is a nice example of why 1Password or BitWarden are doing well. This might work out okay for a technical person, but the average user isn't going to look at the KeyPass downloads page [1] and feel confident about what to download -- even assuming they're using Windows, you need a phone app and sync for meaningful password management these days... and that's very worrying in their presentation. Whereas 1…
Plus I feel that once one has experienced the browser integration of 1Pass, BW, LastPass, etc it's hard to go back to manually filling credentials again. That and the seamless sync across devices. It's just too much to handle for non techie folk.
Their importer is powerful... but I had to manually configure it to import from lastpass. Just bake that in ffs.
There is no "generate password" button on the main application screen despite that being the #2 use for a password manager behind autofilling. Instead the main screen has "find", "find entries" and "search" buttons which are all slightly different despite sounding completely redundant.
To get a browser plugin, you have to pick from a disturbingly long list, each with pros and cons, each requiring a few config steps, and none of which work as well as the cloud competition. I had random disconnections from keepass and many autofill failures.
Finally, you get to syncing, and the friction is bigger than you expect. It is not enough to set up a LAN folder; your solution needs to be able to resolve conflicts if you ever use more than one device simultaneously, otherwise you run the risk of losing changes. The most common sync solution is dropbox because that is the only mainstream cloud offering with first party support for linux, which is fine, but can still cause conflicts. The recommended way to handle this is quite convoluted[1]. Just bake that in, FFS!
[1] https://keepass.info/help/kb/trigger_examples.html#dbsync
In a way this is a nice example of why 1Password or BitWarden are doing well. This might work out okay for a technical person, but the average user isn't going to look at the KeyPass downloads page [1] and feel confident about what to download -- even assuming they're using Windows, you need a phone app and sync for meaningful password management these days... and that's very worrying in their presentation. Whereas 1…
> phone app and sync for meaningful password management these days Idk. I very intentionally decided to not have 98% of my passwords on my phone. (The remaining few rarely change and I put them in my phone by hand without sync.) This decision was less because of security consider but more because I don't want to be able to access the services through my phone. If then anyone (especially I myself) wants to pressure me…
Earlier quoted context omitted.
> phone app and sync for meaningful password management these days Idk. I very intentionally decided to not have 98% of my passwords on my phone. (The remaining few rarely change and I put them in my phone by hand without sync.) This decision was less because of security consider but more because I don't want to be able to access the services through my phone. If then anyone (especially I myself) wants to pressure me…
I have all my passwords on my phone too (bitwarden) But work gets its own separate password manager that only lives on the work computer and nowhere else. I’ll get fired before I even think about work outside of work hours let alone on vacation.
the company I'm now working for uses 1password, it's on my work laptop and only there, not on my phone, neither my private PC. Same for slack. Only office mail is also on my phone, so that I can call sick from my phone if necessary (but normal work communication doesn't go through mail at all, so it's fine).
I set up pass (on Linux and Mac, using brew) with two GPG keypairs, a soft keypair and a YubiKey. The YubiKey goes in a physical safe along with instructions for next of kin (and as an ultimate backup for me). YubiKey is protected with PIN.
For daily use, use the soft GPG key and gpg-agent to cache it. PassFF on Firefox (or see github passforios for iOS) or command-line tools (easily can build hooks with dmenu/rofi as well).
pass stores the gpg-encrypted passwords in a Git repository. Set up a private remote repository and push to it for offsite backup. There is some leakage of info as the names of the sites become the filename, e.g., ycombinator.gpg. This can be mitigated with some plugins like tomb, but then PassFF and passforios won't work.
How is KeepassDX? It's on F-Droid.