Brain-based management is getting too exhausting, and isn’t even fully possible with a larger quantity of online accounts.
Bitwarden
pass: the standard unix password manager for tech-savvy people. It’s dead simple: just a directory of GPG-encrypted files that you can sync across devices using git or other means. It has a CLI interface, an Android app, and a Firefox extension.
With gnupg, git, and a hardware security token. Also known as “pass”.
Bitwarden
To further this, if you actually move over to any password manager please regenerate all of your duplicate passwords with something 20+ characters. It’s almost pointless to have a PW Manager if you’re using the same weak password everywhere.
Make a new strong password for your master password too; I’d recommend a phrase of four moderately long words like “BattleshipMonitorPaintingPrinter” and perhaps a little postit note doodle drawing to remember it until it’s hammered home.
Alternatively, writing down the master password somewhere secure, like in a safe, would also be good if you have to pass on important accounts to descendants.
That’s my reason for wanting to switch to a password manager. Everything gets some long random string that would be insane to type anyway. Or using passkeys, if supported, though I’ll have to research how that works.
My biggest problem is backups. I like the method of Aegis authenticator. It just stores some number of past (encrypted) databases. Each change is a new file. This way rsync takes care of both backups and version control. If I accidentally rsync a corrupted file, it doesn’t matter much. And I can verify them with Rhash, just like all files that don’t change (like photos).
I’m fairly sure you can self host Bitwarden, so it might be possible to have backups in a similar way
Proton Pass for me since I use their VPN.
Vaultwarden for selfhosting.
Piece of paper.
My dumbass reading through these comments: “keep ass… ehehehehe”
Same one on every site. But don’t worry it’s 10 characters instead of 8. And I tossed a bang at the end to throw off attackers.
BitWarden and a self hosted VaultWarden
Fun part of that sollution is that you only need one app.
You also need a secondary service on your server if you want to keep them in sync.
keepassxc
Vaultwarden - self hosted bitwarden server that any bitwarden clients can connect to.
I don’t particularly trust any password manager. If it can be breached, possibly, has been or a chance to be breached, then I don’t trust it. I have a document of passwords locked behind a VeraCrypt container hosted locally. I trust nothing in the cloud or some remote program.
That’s fair, but you’ve lost the ability to log access attempts for individual services, timeout sessions etc.
There are completely selfhost options for this
Keepass2
Have this as my backup just in case bitwarden goes somewhere. I tried to run it as my daily but, it just doesn’t feel nice for some reason.
A few years ago I set up KeepassXC using Syncthing temporarily to sync the database across all my devices. I fully expected to have to move to Nextcloud for database file management.
The KeepassXC / Syncthing combination has worked so well that I have no reason to change it. The databases are seamlessly synced across all devices (including my phone) without requiring any attention from me. Database issues due to multiple device use are almost nonexistent.
One note: For me Syncthing works much better with multiple devices using a star topology. When I initially set up a mesh configuration I had regular file sync issues. With a star topology they are very rare.
What do you use on a phone?
Syncthing-fork from Fdroid.
There were some repository ownership questions a few months back that were ironed out. In addition, Fdroid vets apps far better than Google ever has so I’m comfortable with the app’s security.
Oh, sorry, I meant the password manager. There’s multiple KDBX compatible apps.
KeePass2Android. Recommended by KeypassXC.
1Password family account with spouse, kids, and my parents. Vault management, ease of sharing, and remote management for my parents is nice, along with multiplatform for everything important, and the price feels quite reasonable at $1/user/month. No major security incidents ever, and I was pleased by their core service design whitepaper that I read many years ago. But as they’ve become increasingly corporate over the past several years I’ve felt like they care less and less about individual users, and the CEO’s recent pledge to Omarchy really pissed me off. So it’s been a great service for me but I don’t recommend it for new users unless they like nazis. I pay for a year at a time so I haven’t scrambled to migrate my family to a new solution quickly, but it sounds like Vaultwarden is most likely the way to go next.
