31–40 of 87 posts
What a sane idea to store all your secrets in one place.... for attackers to get ahold of them in one move.
Earlier quoted context omitted.
I mostly agree! However, I plan on posting an article on HN soon discussing some of the issues with the .kdbx file format that KeePass and derivatives use within the next couple of days. KeePass has such great potential, but falls short compared to some of its (local) competitors.
Which local competitors do you recommend? Is a text file one of them?
> cloud-based password managers. Enough said. This kind of stuff should be offline only. If you need to access your password database on multiple devices, set up a LAN and/or a Wireguard tunnel for remote access.
What you're proposing where you're adding a backdoor to your home network (via Wireguard) that needs to be maintained/hardened, and then still needing a LAN hosting solution for the actual database running 24-hour, is neither convenient nor secure (least of all because of layer 1 / fire / theft).
This is a fragile solution which isn't solving any particular problem; but certainly introducing multiple new exciting potential problems.
Earlier quoted context omitted.
What to do if my house catches on fire, including my computer where the passwords are stored?
Well, the same issue exists for your BitWarden recovery keys or 2fa method. You need to have proper and redundant off site backups for anything valuable.
The article is nearly useless for users of the software who want to know how their data may have been affected. The researchers' website is more descriptive, especilly wrt specific findings. https://zkae.io/
Earlier quoted context omitted.
Well, the same issue exists for your BitWarden recovery keys or 2fa method. You need to have proper and redundant off site backups for anything valuable.
Not exactly. I need to have those offsite, but they are not modified at the same frequency as passwords.
The only reason my Keepass database changes is because I make new accounts on sites every now and then, and that's a fairly rare thing these days. And if I get so ungodly unlucky that my house burns down before my off-site database is updated to have that new account listed, I'll still have access to the email that account is associated with, so I can still recover the account either way.
Earlier quoted context omitted.
KeePassXC can even still be online, too; example: https://logandark.net/passwords.kdbx It's not centralized, of course; you still have to download the entire database, and then potentially upload the entire database again for any changes; but it doesn't have these vulnerabilities.
Haha this was a powermove. It is genuinely great that since it’s just a file you can host it anywhere you want. S3, WebDAV, your own site. I personally use copyparty and WireGuard for my kdbx file. I find it better than syncthing because there’s an obvious master copy (edited in place), and there’s no good way to keep syncthing running all the time on iOS, which can lead to sync conflicts.
Earlier quoted context omitted.
Well, the same issue exists for your BitWarden recovery keys or 2fa method. You need to have proper and redundant off site backups for anything valuable.
Not exactly. I need to have those offsite, but they are not modified at the same frequency as passwords.
Has there been a similar evaluation of 1Password?