Stored encrypted using gpg, in a git repo which is synced using syncthing: https://www.passwordstore.org/
FYI, gpg is soon considered insecure, even now.
What would you recommend, NaCl? Signify?
Ask HN: How do you manage your passwords in 2023?
131–140 of 179 posts
Re: Ask HN: How do you manage your passwords in 2023?
#132I'm all in on Bitwarden at this point. It's the place where I keep all my credit cards, secure notes and about a 500 logins. A vast majority of these logins have passwords generated by Bitwarden itself. I'm confident even if BW goes down I can still recover my data since the vault works offline too. While the browser extension could use some UX work the mobile apps have been top-notch and sharing passwords with my sp…
Sounds like you're very happy with Bitwarden, and confident that if they go down you wouldn't lose access to your secrets. Can I ask why the desire to switch to Vaultwarden? I assume if a significant slice of the userbase did this, the project would suffer—so I'm asking this question genuinely as an avid Bitwarden supporter myself. I hope they don't have to rely solely on VC funding, seems that VCs motives would be p…
I run Vaultwarden and still buy a license. I wish they’d offer an optional self-hosted license specifically for those who want to support the project while hosting their own server.
Re: Ask HN: How do you manage your passwords in 2023?
#133Bitwarden
Re: Ask HN: How do you manage your passwords in 2023?
#134Earlier quoted context omitted.
> the idea of putting both factors in one place is odd This is AKA "one factor", right?
If your password is compromised they still don't have access to your OTP, so 2 factor. If your password manager is compromised then they have both, 1 factor. I'm no math wiz but pretty sure that makes it a 1.5 factor
Right, presumably with a password manager you’re using a totally random string as your password too, coupled with different passwords for each site. so there are a combination of factors that make it still much more secure than just “both factors in one place” since neither factors can easily be guessed.
The main threat vector would be, as you mentioned, compromise of the actual password manager.
As far as I can tell, 1Password’s end to end encrypted architecture makes this less probable.
That would reduce the main risks to our actual devices.
Re: Ask HN: How do you manage your passwords in 2023?
#135It seems like there are basically two camps: Trusting/convenience-oriented people use BitWarden, while more careful people prefer KeePass-based solutions.
Personally, I think Enpass is the best of both worlds. The ecosystem isn't open source by default, but there are open source tools that get technical assistance from Enpass folks. And the experience is quite good, usually slightly less polished than BitWarden or 1Password, but sometimes slightly more polished (TOTP is a lot easier on Enpass than with 1Password). Lastly, it's local-first and offers a lifetime purchase for about $90.
Re: Ask HN: How do you manage your passwords in 2023?
#1361Password. Has all the features I want, really like the UI, and available everywhere I need it.
I just made the switch this week after reading the news about the most recent hack from LastPass. The UX for 1password was so refreshing after using LastPass for so long. The switching process was very simple. The only issue I had was getting dupes from the shared folders from the family account.
Re: Ask HN: How do you manage your passwords in 2023?
#137So all these people are posting with likely their normal accounts and announcing their security posture to the world… feels insecure ironically. I miss having a solution that was locally synced across multi platform.
At least you found a way to feel superior
Haha, wasn’t trying to do that at all. More just “does knowing that X person uses a particular password manager make them more vulnerable”. I’m not in cybersecurity and I know they discourage security by Obfuscation so perhaps not sharing password manager deets falls under that dubious practice and I worry for nothing.
Re: Ask HN: How do you manage your passwords in 2023?
#138I use keepassxc to store my password. The Android app syncs with a file stored on my home server via SSH. No need to sync it manually, the Android app automatically checks for remote changes and copies the file over when you make changes on the app.
The password file on my server resides in a folder that's synced across all my computers using syncthing. My home server also runs an OpenVPN server so all my devices can talk to each other.
Everything is self hosted and runs on open source software. I'm pretty happy with my setup.
Re: Ask HN: How do you manage your passwords in 2023?
#139I use 1Password. It isn't perfect, but it's quite good. My big goal now is to come up with a better solution for 2FA that works for me and my wife's shared accounts.
I use 1password OTP for everything that I don't care about that people can't do real damage (YNAB, LinkedIn, etc). But anything important like my email account or bank accounts I keep on my phone using Raivo.
Re: Ask HN: How do you manage your passwords in 2023?
#140I use KeepassXC distributed via NextCloud.
Would recommend Syncthing (with e.g. simple file backups) instead to not have to rely on a central server. Even allows fully encrypted nodes.