Instead of Dropbox you can also use https://spideroak.com/ They have a really handy program which let you control a lot of things and they are a "zero knowledge" cloud provider, all your data is encrypted. Snowden recommends them: http://www.theguardian.com/technology/2014/jul/17/edward-sno... For $12 dollar a month you get 1 TB, which you can use as a safe off-site backup location.
Which itself _is_ open source: https://github.com/SpiderOak/Encryptr
When are exporting and offline access coming?
Also, for the database file encryption I'm using AES256 with 10 million encryption rounds (configurable in the application), which hopefully slows down any brute force attempts even in case of a data breach.
Of course, all bets are off if your device itself is compromised, but that would be the case with any solution.
Applying AES multiple times/rounds doesn't yield anything. AES is not adaptive (like BCrypt) so the cost of brute-forcing doesn't increase incrementally with the number of rounds.
Anyway, the slowdown is noticeable on my devices with these applications (it's about one second on my laptop), but then again these obviously are not custom-built AES decrypters. This will have to do now.
http://www.pcworld.com/article/2845072/ubuntu-owncloud-and-a...
Part of the value of a service like LastPass (not a fan personally, but for argument sake I think ths still holds for this issue) is that someone is (should be) always on duty to monitor the service for suspicious activity and be ready to respond to security issues in the code base. While you're in class or a meeting or a movie or asleep, they can already be locking ish down and implementing patches / fixes.
These are always a bit of a balancing act on what's good use of third-party services and what's worth handling yourself. Services hopefully have a competent team behind it monitoring it (not guaranteed though!), but at the same time provide a much more lucrative attack target. And in my case at least, in a completely different jurisdiction. Monthly feels, service continuity, learning aspect... There are lots of different points influencing the choices.
I have tried KeePass, but it's just too painful to keep running..especially as a Mac user.
1Password + Dropbox with 2FA makes me sleep a lot better than when I used LastPass.
The browser integration looks near-native and performs all interactions inside its dropdown menu. LastPass opens separate tabs to accept your master password or your 2FA token (at least in Safari), and things like editing a site or copying a password frequently takes you away from the tab of the site itself.
Another huge advantage is that unlike LastPass, form field autofill actually works. It will even submit the login form by default, if there are no other fields that need to be filled out.
When it was bought by Twitter they open-sourced it with bits missing. Some have added the missing bits to run it in Docker, but there may be dragons:
https://github.com/servomac/mitro
(comes with browser extensions, server, etc etc)
My home server keeps a copy available via SFTP, which is accessible using the KeePass2Android app. That saves me the manual process of updating on my phone, allowing me to avoid using Syncthing, there, which would crush the battery.
Just keep the passwords on your phone (in a password manager) and type them by hand on your computer. It works well enough since you always keep your phone with you (at least I do).