163
Why self host a password manager?
(programming.dev)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 08 Oct 2024
163 points (96.6% liked)
Selfhosted
40707 readers
396 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
I use a KeePassXC database on a syncthing share and haven't had any issues. You get synchronization and offline access, and even if there are sync conflicts, the app can merge the two files.
One benefit to hosted password vaults over files is that they can use 2FA - you can't exactly do TOTP with a static file.
(As an aside, I wish more "self hosted" apps were instead "local file and sync friendly" apps instead, exactly because of offline access)
You can do 2FA with Keepass, just not TOTP. Add a key file or a hardware key on top of your master password and you pass "something that you have and something that you know" test
KeepassXC handles TOTP.
It can generate TOTP codes, but I'm saying that the vault itself can't be secured with TOTP.
Then the difference is really that someone else is handing the security, right? At the end of the day, there's an encrypted file somewhere, and a TOTP only protects a particular connection by network.
Sure, but there's a big difference between a vault copied and synced on all of my mobile devices that I could easily lose versus only on a server behind locked doors.