It never made sense to me to put password managers in the cloud. Regards to what you intend it to do, you’re making it accessible to a wider audience than necessary. And yet, I’m using iCloud. It’s time for a change.
I’m thinking of just running a locally hosted password manager on my home server and letting my devices sync with it somehow when I’m at home. I have a VPN into my home network when I’m away that automatically triggers when I leave the house, so even that’s not that big an issue, but I’m really not familiar with what’s gonna cleanly integrate with all my stuff and be easy to use. All I know is I wanna kill the cloud functionality of my setup.
I already have a jellyfish server so I figured I would just throw this onto that. Any suggestions?
You must log in or # to comment.
Bitwarden/vaultwarden is a popular option for selfhosters.
I do this. Plus VPN to have access to passwords when away from home network
Why not use KeepassXC? It’s a completely local encrypted db but it integrates with cloud storage apps like nextcloud for sync. It has plugins for integration with Firefox and KeepassAndroid is pretty smooth on the current Android OS.
Yup this is the way. The resulting .kdbx database file is encrypted so you can even synchronize it over an untrusted provider. Otherwise you can use something like syncthing to keep it strictly peer to peer.
this one, OP. no need to introduce the horror that’s a:
- hosted app (why?!)
- client app is electron crapware
- the client app doesn’t even have full functionality, you have to use the web UI for some tasks
edit: I’m obviously speaking about the bitwarden/vaultwarden horror. keepassXC is none of them things.
KeepassXC is the only thing that makes sense to me.
I don’t want all my passwords stored with some huge target like lastpass or bitwarden.
Encrypted local (and synced) DB is the only way.
Any iOS app?
Shamelessly shilling my OSS project, rook. It provides a secret-server-ish headless tool backed by a KeePass DB.
- Headless server
- Optional and convenient integration with the kernel keyring (on Linux), for locking the server to only provide secrets to the user’s session
- Provides a range of search, list, and get commands
- Minimal dependencies and small code base make rook reasonably auditable
You might be interested in rook if you’re a KeePassXC user. Why might you want this instead of:
- Gnome secret-server, KDEs wallet, or pass? rook uses your (a) KeePass DB, while most other projects store secrets in their own DBs and require (usually manual) sync’ing when passwords change.
- One of the browser secret storage? Those also keep a bespoke DB which needs to be synced, and they’re limited to browser use. Rook supports using secrets in cron jobs or on the command line (e.g. mbsync, vdirsyncer, msmtp, etc, etc).
- KeePassXC? KeePassXC does provide a secret service that mocks Gnome secret-service, but you have to keep KeePassXC (a GUI app) running even if you only rarely use the UI. Rook can also be used on a headless machine.
- The KeePassXC command line tool? That requires entering the password for every request, making it tedious to use and impractical for automated, periodic jobs.
Rook is read-only, and intended to be complementary to KeePassXC. The KeePassXC command line tools are just fine for editing, where providing a password for every action is acceptable, and of course the GUI is quite nice for CRUD.
Damn, that sounds very interesting! The use of a Keepass DB instead of a new one makes it great to have as option. It’s something I hadn’t think about for a long time.
I’ll check it out later and maybe install it after I restore my server, I’m planning to reduce my attack surface too:)
If you do, use the
-koption - it locks access to the rook service to only the user session. Rook works without it, but is more secure with it.
I use KeePass (Keepass2Android, KeePassXC, OG KeePass, and KeePassium) for everything. Been using KeePass in general for 20-ish years.
Recently, I decided to export all of my passwords from Firefox, Chrome, and Edge, import the data into my KeePass database under their own folders, then delete everything from the browsers. That way I can move entries that weren’t already in the database to their respective locations in the database hierarchy, delete duplicates, and change insecure passwords.
The database is hosted on my phones (work and personal), laptop, gaming PC, and a server at home, all synced with Syncthing. My work laptop also has Portable KeePass that accesses the database via WebDAV to my server.
This is what I did. Once Firefox did something and wiped my passwords from sync only way I got them back was I had an old laptop I didn’t use often that was synced to my account. Now I use keepass that’s saved locally and a backup on my nas & flashdrive.
I look at it like this:
- I don’t absolutely trust the security of my server. Sure, it hasn’t had a breach…yet, but that possibility is inevitable, given the amount of bots that keep trying to get in by the minute. It’s secure, yes, but is it secure enough to entrust the keys to my bank account, my business ventures, et al? IF somebody got the key to my Lemmy account, it would be bothersome, but not cataclysmic since all online accounts are silo’d with only a couple that are linked.
- Bitwarden spent a lot of time and money building a large infrastructure that is, imho, far more secure than my little server. Bitwarden has a pretty good track record. They have had some vulnerabilities, even as recent as '23 but these have been remediated.
- Confirmation bias…I’ve been using Bitwarden for untold years now and have never had an issue, other than the recent UI theming schema that was so castigated by users that they offered a way to switch back.
While hosting my own password manager would fit right in with the rest of my selfhosting, I think sometimes it’s better to defer to more secure options when dealing with highly sensitive data.
Bitwarden is absolutely solid,yes.
Local server wise: If OP uses it in a local only setup behind a proper VPN implementation from my point of view the risk is acceptable. It’s not that hard to secure a home server in a way that Vaultwarden is not at risk - and when you’re so compromised that it is, then the attacker can easily use other vectors to gain the same data (RAt,keyloggers, etc.)
KeepassXC + Syncthing. Using for 2+ years no issues. Have separate database files for each device and merge them as needed.
I do the same thing on my laptop and gaming PC. My only beef with KeePassXC is that they refuse to implement WebDAV, despite the OG KeePass having it. Otherwise it’s fantastic.
I switched to Bitwarden after the LastPass stuff a couple years ago, and I just got around to installing Vaultwarden on my TrueNAS system at home. Using a single Cloudflare Tunnel to handle secure external connections for that and other services like Emby easily. Took a little bit to setup following some guides, but has been working flawlessly for me and some friends. You can use the regular Bitwarden apps and extensions since they natively support self hosting.
just have 1 password for everything, problem solved.
Is the data super important to you?
Let someone else host it.
Bitwarden in the cloud.Edit: Bitwarden paying the monthly/yearly fee to BW. I wasn’t implying trying to host it yourself in the cloud.
This. And to add to what other commenters have said, by using Bitwarden and paying for their Premium plan (very cheap, just $10/year), even if you don’t use all their features, you’re supporting a good project. It’s critical infrastructure, I think the price is more than fair.
Either way, you should always make periodic backups from any cloud service you use, encrypted of course.just $10/
monthyearYes! Oh my, I’m silly; that was precisely my point and I managed to mess it up 🙃
Thank you for the correction!
If you’ve been using passkeys, you’ll need to generate new ones when you switch. AFAIK, they aren’t exportable from Google or Apple. Which, among other reasons, is why I’ll just stick to high-entropy passwords. I’ve had some sites like Amazon try to sneakily make me register passcodes, I’ve had to go back and tear them out before they screw me somehow.
try to sneakily make me register passcodes
Can you expand on this? I’m not sure what this means. Is it like instead of a full fledged password, just a four digit PIN or something? Thanks.
For some reason, when I registered my phone number for delivery notifications, it made a passkey and registered it with my account. It never prompted me to save the passkey, so I had no idea where it was supposed to be used. I immediately deleted it because I was concerned I wasn’t going to be able to log in if I logged out without knowing what that passkey was and had it in my password manager.
