Does anyone know of a good SELF-HOSTED Password Manager, preferably open source, that works acro...

[G+_Darryl Gibbs]

Does anyone know of a good SELF-HOSTED Password Manager, preferably open source, that works across Android, Windows and Linux? I know that no piece of software is infallible, but I see that even some of the popular services (like 1Password and LastPass) have vulnerabilities, and I would prefer to keep control over all my info.

 

Does such a utopia exist?

[G+_Ben Reese]

I use and love KeePass. Everything is stored in a vault that you hold and you're responsible for syncing that across devices. I believe it uses AES encryption and you can set the number of hashes (defaults to 5,000, I think).

 

I've used the apps on Android, iPhone, and Windows. Auto fill isn't near as convenient on Android as what LastPass offers, but it's better than either can do on iPhone. On Windows (probably Linux and Mac too) it uses an auto-type, so not susceptible to clipboard vulnerability.

 

Probably the best option I know of at this time.

[G+_Darryl Gibbs]

Ben Reese? I take it you have 2FA over and above this?

[G+_Jared Twomey]

There is a self hosted version of Keepass called KeeWeb. I haven't tried it yet, but it looks interesting.

[G+_Darryl Gibbs]

Sounds good!

[G+_Ben Reese]

I honestly use LastPass for most stuff. It makes it a lot easier to share logins with my wife.

 

Yes, I use 2FA where possible. I'm not worried about anyone hacking my KeePass because they would first need to get hold of the database then they'd have to take a few million years to brute force the password.

 

I'm kinda curious about the "KeeWeb". Seems like it would be a nice addition to a home "cloud" server.

[G+_Darryl Gibbs]

Ben Reese? sounds good. Guess I need to jack up my password strength on my overall Last pass password.

 

KeeWeb looks good, although after a quick browse I couldn't find a way to use it on mobile, which is less necessary, but still a nice to have.

[G+_Darryl Gibbs]

Ben Reese? different topic, but what spec is your home server? And how does it perform with your home Internet connection?

[G+_Pat Hacker]

Nice

[G+_Ben Reese]

Darryl Gibbs When I think of a home server, I don't usually think of very high specs. A Synology NAS is usually more than plenty for most.

 

Mine is a 9 year old Core 2 Quad with 7 GB RAM (I've just added RAM as I could find it). Storage is currently a shameful mess with old laptop drives hanging by power cables ?.

 

We have 200×20 Mbps service from Time Warner/Spectrum, so that's sufficient for most of my needs. I wouldn't invite strangers to hit my home servers, but sending a family member or friend a link to something on ownCloud or streaming Plex remotely is just fine.

[G+_Geoff Galley]

Perhaps Steve gibbson could shed some light on this. GRC dot com

[G+_Golden Retriever]

If you acknowledge that password managers have some limited vulnerabilities then the next thing to look at is who is more responsive to tackling those vulnerabilities when identified.

 

For me the answer is LastPass but I will be looking strongly at squirrel when Steve Gibson is done with it

[G+_Ben Tyger]

I do this all the time. Here's my setup.

 

I use Keepass 2 for my password manager. I store my kdbx file on my owncloud instance. Any cloud based file storage that supports WebDav works well. The main reason I use Keepass 2 is because of these reason: great concurrent edit support, secure file storage, good cross-platform support, and possible browser integration via plugins.

 

Then I protect the kbdx file with both a password and a key file. The kdbx file stays on the cloud storage for easy synchronization. The key file is NEVER put in the cloud storage. It is transferred to trusted devices via some other method. SCP for example. This way, even if the cloud storage is compromised, at attacker wouldn't have the key file.

[G+_Scott Dible]

I'm using Enpass. It's free for desktop and a one time purchase for mobile. You can try it for free with limited access to passwords on mobile.

 

It's not open source, but the encryption is. You store your password file encrypted on any number of services, and Enpass automatically syncs it across platforms.

 

For me, it strikes a good balance security and ease of use.