I rely on Bitwarden (slooowly migrating from… a spreadsheet…) and am thinking of keeping a master backup to be SyncThing-synchronized across all my devices, but I’m not sure of how to secure the SyncThing-synchronized files’ local access if any one of my Windows or Android units got stolen and somehow cracked into or something. I’m curious about how others handle theirs. Thanks in advance for sharing!
keepassxc database synced with syncthing across devices
This is the way OP. Centralised services are just too much a target for bad actors.
You already have syncthing so most of the way there.
Also built in TOTP / 2fa is pretty great.
Bitwarden already stores a local copy on all devices you have it installed. Just make sure you load up those devices from time to time… And guess what, you are probaly already doing that with your phone and laptop (which actually contains generally 2 copies, 1 on your actual client and another for the browser extension. Add a third device for good measure and… Oh, you also have a backup on bitwarden.com, this thing literally backups itself everywhere!
I write them on paper just because I’m very old schooled.
My wife does the same, and I can’t tell you how many times a day I have to help her reset passwords, figure out if something is an “1”, “i”, “l”, or “|”, or decide what needed to be capitalized.
Even though I have Bitwarden installed for her, she just “prefers” paper like some people prefer to stub their toes.
You should try to teach her how to be more careful and clear when writing passwords. It can be hard if she’s living in constant rush but it’s a very useful skill. And btw I just always underline capital letters. Always works
Do you stick them under your keyboard, or to the edge of your monitor?
Nope, I try to store all of them in one physical file
For years I’ve been using KeepassXC on desktop and Keepass2Android on mobile. Rather than sync the kdbx file between my devices, I have each device access it through the network. Either via sftp, smb, or nfs, but regardless I need to connect to my home’s VPN to access it when away from home since I don’t directly expose those things to the outside world.
I used to also keep a second copy of the website-tied passwords in Firefox Sync, but recently tried migrating that to Proton Pass because I thought the PIN feature might help, then ultimately decided to move away from that too and start using the KeepassXC-Browser plugin instead. I considered Bitwarden too but haven’t tried it out yet, was somewhat deterred by seeing people say its UI seems very outdated.
It didn’t look outdated to me, but is kind of weird and hard to get used to, though I eventually did. I don’t know how to make an export from Bitwarden to take into KeePassXC, though… I’ll need to look into this. Perhaps it can’t be done from the browser alone. Anyway, thanks for sharing.
Is syncing the .kbdx files using Syncthing unsafe?
Syncing files that you may open in both (or more) devices at the same time is unsafe with any service, but you can manage to avoid sync conflicts with KeePass if you do not open the same file at the same time or open the Android app in read-only mode. I’ve only had like 3-4 conflict files this year and they weren’t important.
Do the files pass through their servers unprotected? I don’t really understand how Syncthing works under the hood.
Bitwarden. I would like to self host it one day (and keep that backed up) once I learn more about all that junk
Vaultwarden is super easy to set up anywhere (NAS, computer, Pi, etc). It’s as simple as firing a docker yaml, and you’re set.
I know what these words mean:
computer
These are the words I need to learn more about:
NAS pi firing docker yaml
We’ve all been there at some point.
For when you do learn the definition of those terms:
I have a Pi (raspberry pi computer) set up as a NAS (network attached storage) and I have zero clue what a yaml is or how Docker works.
KeePass on my phone and desktop, with the master file sync’d automatically to the server in my basement.
Bitwarden has an import tool. You should be able to convert your spreadsheet into the format they like and import relatively easily.
For backups, you can create encrypted backups through bitwarden. So it shouldn’t matter if synching itself is a secure process as what your syncing is already encrypted.
Bitwarden keeps a local copy of the data that can exported if something ever happened to bitwarden. If you want to keep an encrypted backup you can export the CSV and store it on an encrypted drive as a backup but not big worry about syncing it to all devices
This is the correct answer, every device you use a bitwarden-client regularly on automatically becomes a backup
Reset every time I need to log in
Pass on Linux with a private git repo with search extensions for gnome and Firefox, and android password store on my phone.
I mostly just use Firefox Sync. For critical passwords or non-web passwords and other small keys I store them in pass.
I prefer another tactic if I may share:
- Database in production: let Bitwarden clients sync the native way Bitwarden offers.
- Database in backup: let a dedicated backup service keep your database save.
I dont know if this could be done automatic (just backup the production database) or if this has to be done by export (by hand once in a while).
Doesnt matter from which device the backup originates because the native sync will keep them all the same usually in seconds.
I’m using https://pwsafe.org/ in Linux, then https://play.google.com/store/apps/details?id=com.jefftharris.passwdsafe in android and this app to sync with google drive https://play.google.com/store/apps/details?id=com.jefftharris.passwdsafe.sync&hl=en_US
I have encryption enabled on my devices. If they get stolen, a casual thief isn’t going to be able to break it. At most they’ll wipe it, but they’ll probably just fence it as-is or for parts.
I’ve set up Vaultwarden as I used Bitwarden before that and it made switching very easy. Doesn’t get easier than that, synced passwords across all your devices/browsers.
