Hacker News Reader

Comment by avoutthere | Hacker News Reader

Putting one's keyfile in the cloud just seems to me to be asking for it. You're essentially trusting a 3rd party with the keys to your kingdom.

View on HN

* Compared to completely cloud-based password manager like LastPass and 1Password, it's no worse.

* The database in encrypted with your master password.

* You can optionally also encrypt it with static "Key File" that are on all your devices but not in Dropbox.

1Password seems to put saving to their cloud front and center but you can still choose to not save your passwords on their servers and use your own methods. My 1Password vaults are encrypted with my master password and synced between devices using Dropbox, I think there's also an option for directly syncing between smartphones and computers.

A) You should presumably still have a good passphrase.

B) You choose which 3rd Party to trust. There are many options with different security/trust/threat models.

(Example: lately I've been using an encrypted share in Resilio Sync where the "cloud" option for me is a dumb VPS that can share the folder torrent but does not have decryption keys into the contents.)

No. You're trusting the encryption of the password manager. No self-hosted password manager that I know of keeps your passwords in a clear text file.

KeePass is a fully self-hosted solution. The grandparent suggests using Dropbox et al for convenience (the vault is always encrypted, so it's not "giving away the keys"). However, you don't have to do that; I just use SFTP to copy the file off of my workstation when I need a fresh copy on my phone/laptop.

I don't trust dropbox, but I do trust the encryption of my password manager. Depending on how you measure, my key is somewhere between 100-150 bits, and even if that was feasible to brute force, I am not that important.

Personally, i do the same, but on Syncthing. Works very well, to need to trust in the availability of Dropbox etc.

Reply on news.ycombinator.com