That's why KeePass is still the king. Offline vault > online vault.
What to do if my house catches on fire, including my computer where the passwords are stored?
Password managers less secure than promised
21–30 of 87 posts
Re: Password managers less secure than promised
#22What a sane idea to store all your secrets in one place.... for attackers to get ahold of them in one move.
Re: Password managers less secure than promised
#23Re: Password managers less secure than promised
#24That's why KeePass is still the king. Offline vault > online vault.
KeePassXC can even still be online, too; example: https://logandark.net/passwords.kdbx It's not centralized, of course; you still have to download the entire database, and then potentially upload the entire database again for any changes; but it doesn't have these vulnerabilities.
Haha this was a powermove. It is genuinely great that since it’s just a file you can host it anywhere you want. S3, WebDAV, your own site. I personally use copyparty and WireGuard for my kdbx file. I find it better than syncthing because there’s an obvious master copy (edited in place), and there’s no good way to keep syncthing running all the time on iOS, which can lead to sync conflicts.
Re: Password managers less secure than promised
#25Re: Password managers less secure than promised
#26That's why KeePass is still the king. Offline vault > online vault.
I mostly agree! However, I plan on posting an article on HN soon discussing some of the issues with the .kdbx file format that KeePass and derivatives use within the next couple of days. KeePass has such great potential, but falls short compared to some of its (local) competitors.
Which local competitors do you recommend? Is a text file one of them?
Re: Password managers less secure than promised
#27The article is nearly useless for users of the software who want to know how their data may have been affected. The researchers' website is more descriptive, especilly wrt specific findings.
Re: Password managers less secure than promised
#28That's why KeePass is still the king. Offline vault > online vault.
What to do if my house catches on fire, including my computer where the passwords are stored?
Well, the same issue exists for your BitWarden recovery keys or 2fa method. You need to have proper and redundant off site backups for anything valuable.
Re: Password managers less secure than promised
#29That's why KeePass is still the king. Offline vault > online vault.
One of the things the article touches on is encouraging these vendors to migrate their customers to more secure/modern security standards. How is this handled with KeePass with it being, by its very nature, decoupled?
Re: Password managers less secure than promised
#30>cloud-based password managers The main issue with these managers. I use an encrypted text file and Emacs, nothing on the cloud for me.
That doesn’t fit all use cases though. For example, how to fill passwords in mobile apps on the go, or how to share a subset of your passwords with your family (including syncing password changes with them).