Hacker News Reader

Comment by itake | Hacker News Reader

> why a password manager should be a SaaS

While I fully agree with you, how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering?

While I don't use this feature, but it is common for ppl to share an account. How can I securely share credentials with family members?

View on HN

> how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering?

Syncthing. Set up once, runs reliably forever.

> How can I securely share credentials with family members?

I don't do this either (and don't know anyone who does) but I imagine it'd be easy to just create a different shared database for the family for that? With password store, it's also possible to set multiple different gpg keys for a specific directory. I don't think the last option is doable for most people though.

Syncthing doesn't work for iOS https://forum.syncthing.net/t/syncthing-for-ios/16045

> it's also possible to set multiple different gpg keys for a specific directory. I don't think the last option is doable for most people though.

this seems really complex...

I used syncthing for years and never heard of those features

keepassxc + syncthing this is the way

android: keepassdx off f-droid + syncthing

Of course it doesn't work on ios. The issue you linked explains that a syncthing ios implementation would be useless because the background process can't run and the way filesystem access is managed makes the whole thing more or less pointless. It's available on all better operating systems though: Windows, macos, gnu/linux, android/linux, I think even chromebooks can run it?

> this seems really complex...

Like I said, it's probably not a solution for many. A second database with shared secret is very straightforward and transparent way that anyone can grasp I think. It would definitely pass the family test for me.

that's on Apple, not on Syncthing. Guess what, when you lock down your devices so much they can't perform many useful functions. Next time, just get a phone you can actually own.

Yes, purchasing a phone from an advertising company hellbent on gathering as much as they can from you sounds much more positive.

You can erase Google's OS on the Pixel phone fairly easily and replace it with your favorite ROM. In fact one of the reasons I switched to Android is adblocking. I can't stand the amount of ads I had to see on iOS, especially from apps like youtube or even the app store itself.

Syncthing is really key, no need to pay for photo sync services, just send it to your Nas or desktop, no need to pay for password managers, just sync it, no need to pay for notetaking apps or todo apps, just sync Obsidian or Joplin.

Don't. Sharing a Netflix account with your family is easy. Send it in the whatsapp group if you need to change the password or something -- how often are you going to do that in your life? Not enough to justify handing over all of your password to a 3rd party and paying them money for it.

Anything more important than a Netflix account you don't share at all. If they need access, just call them.

> how often are you going to do that in your life?

Small startups use password sharing tools to share passwords with new employees (think db passwords or other saas accounts). This happens at least a once per month in a 10 person organization.

That's the intended use case IMO and it absolutely makes sense. I used to share passwords in Slack before and that made me uneasy, the company investing in a password sharing SaaS absolutely made sense. However, I do not manage 100+ people at home and thus have no need of one.

But what you're really asking is how can you share them conveniently and quickly.

Maybe the answer is, you can't. Write them down, text each other, call each other and read it over the phone.

Making a spare key for my parents to get in my house isn't "click a button easy," I have to go to the hardware store -- and maybe THAT'S the appropriate level of difficulty.

I'd rather just pay for the subscription, honestly. Especially in a bigger family or team / company context. To each their own.

I'd advise against it.

Again, what many of us are saying is third party password managers are always a bad idea for fundamental reasons. Before, it was just the account owners and the site. Now there's a third party that has some kind of access, and that third party is a juicy target.

Under what guarantee then? Why believe they are safe, especially since time has shown that many are not.

It's dumb, and I will continue to maintain that it's dumb right up until one of these companies offers indemnifcation or some other serious grown-up guarantee.

I will pay for your service if and only if you pay me if/when you mess up.

The modicum of security these companies offer are better than the nonexistent security practices at the places I've worked for, lol. I trust them way more than the average user or small business.

ya got me there. but still, we can do better :)

we can, but the average user not!

if you are tech savvy, like to keep up to date on security and are ok with the hassle of setting up a NAS, sync stuff and know how to keep it secure, perhaps. If you had to pay me to do it for you, a few dollars service fee might be much cheaper...

> how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering?

With 1Password 7 I did this with their built-in local syncing feature. I don’t want my passwords in the cloud. I’m happy to manually sync them once a month (or probably less these days). But they removed it in version 8 and forced users into a subscription so I’m not upgrading. Eventually I’ll move to something else, but it’s still working for now.

You can use a keepass file synchronised with syncthing or a similar peer-to-peer sync system. To securely share credentials, you can share a separate password file with a unique password. There might be issue with file conflicts, but I find these can usually be managed manually; You might also be able to use a crontab.

Syncing? Just load it onto some cloud storage provider you already have. That’s what 1Password used for years before they decided to go the subscription route. It worked great.

I use Firefox's built in password manager and it syncs across all my devices pretty well. The UX is not great because on mobile I have to navigate to Firefox, go to Logins, type in my phone's passcode, then search for and copy the right password, but it's secure and works well enough.

I keep a Keepass compatible password database file in my iCloud folder so I can access it from my computer and my phone with appropriate apps.

So it's still SaaS, except you're using it for storage and sync and doing the password stuff yourself.

My passwords are encrypted without a SaaS, they way I want to sync them is using a SaaS, but a different, one of my choosing.

With Bitwarden you can sync on the free plan.

Reply on news.ycombinator.com