this post was submitted on 27 Mar 2026
284 points (96.1% liked)
Technology
88123 readers
2992 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Can someone please help me understand why you would want to have your passwords in the cloud? I've been using Keepass for about the past 15 years. I always just sync the db between computers/mobiles. Its never been an issue. Is having it in the cloud really that big of an advantage?
Not interested in selfhosting and risk a data breach.
It's imple: Who is better equipped to combat a hack? You or Bitwarden?
Definitely me.
False sense of security.
The moment to fuck up certificate issuing and don't use a wildcard certificate, the subdomain is public and will be probed to hell and back. And due to regex, probably by bots specialized to probe password vaults.
Wish you best of luck and security.
But I'll stay here :)
You do realize that a keepass db is simply an encrypted file, right? Its not a web server.
Please point me to where keepass is mentioned
Besides that:
Yes, keepass is only an encrypted database-container but that comes with it's own downsides.
Syncthing can manage the syncing with stun-servers circumventing the port forwarding issue but it's also a burden to manage it.
Btw a geuine question:
How does keepass manage simultanious access by two devices? Is the database write-locked during an editing action?
And how does it combat silent corruption?
When you jump into the middle of a conversation, this is what happens. In fact, I already answered your question. Even though you seem to be acting in bad faith, and you're trying to get a "gotcha" out of me.... I'll elaborate a little
I use a Nextcloud Server (there are other network sync tools as well). I have the Keepass file on the server which syncs with my remote devices. If I make changes to the database, it syncs with the cloud server which pushes the changes to the other devices. I have NEVER had a situation where I needed to make changes to the databases on two or more devices in parallel, nor can I think of a use case. My guess is that in such a situation, whichever file was saved last would be the one last saved by Nextcloud (overwriting the other edit). So your "gotcha" is valid but rare. The other option is to use the web app for Keepass in Nextcloud (not sure if it's still being developed though, it's been a long time since I used that).
Anyway, the point of my question was to understand why people use a cloud service for this when it can be easily done (and be safer) than relying on a 3rd party cloud. From what I can tell it's "convenience".
You need to turn down your suspicions.
Can't ask questions without drawing the wrath of some users here...
Anyway:
I thought about it but in the end went with Bitwarden just because it's convenient and didnt feel like entering the security minefield.
Same was for pictures (kept them on my PC and that was backed up to another drive) and E-Mail.
As my gear improved I started to use Immich.
E-Mail is still outsourced as I can't and don't want to deal with getting put on spam-lists and having to deal with getting of of it (had the pleasure of getting my domain already marked by google safe browsing).
The "gotcha" about conflicting (as you put it and trying to infer further bad faith conversations) was more about edge cases biting you in the ass.
Not fun having to search accounts if you expect them to be securely saved in the vault but not being there.
That's mine and being under the assumption a corp that is specializing and programming a security product is probably better at it than me.
And so far the behavior from Bitwarden after being audited and their current breach-history gives me enough faith for now.
They had some oof-moments like master-password are used to encrypt the vault and weak encryption protocols with weak encryption parameters on top
But they werent enough to start a transition elsewhere.
Do you not see that you are being aggressive? Who are you to tell me I have to turn down anything?
Reread the the thread where you came out swinging about insecure servers and then continued over complicating the solution. It's so condescending from the start:
All Ive been talking about is literately an encrypted file which is synced between various devices (regardless of sync method). You started talking like that before you even knew what you were talking about!
Making yourself some kind of victim will not change that.
This is all I was asking for. thanks for the feedback.
As I have said, I have been using this for about 15 years. There is no adge case. I was not even trying to convince you to switch from whatever password service you were using. I simply was looking to understand why.
I have zero trust in any corporation. I will always take responsibility for my own security as much as I can. Being dependent on corporations, esp., digital tech corporations has led us to where we are today. Keepass is a zero trust solution for me. I don't have to worry too much about where I place it (even Onedrive or Google Drive if needed).
I have no issue with Bitwarden as a project, but I wouldn't trust any server that is tasked with managing my passwords. I will do it myself.
For what it's worth, Keepass has been audited multiple times, including from the EU and I think the EU has (had?) Bug bounties for it. Germany and France definitely audited it.
convenience. its integrated into the browser and easy to get going. I personally use it for "unimportant" logins. Mainly things that are not government or financial or such. My improtant ones I keep on an external drive that I only pull out for when im doing that type of stuff.
Natural disaster -> no longer can access everything you have online, including bank and insurance accounts, at precisely the time you most don’t want to deal with that.
Pretty much this. Cloud storage isn’t perfect, but it sure does make proper 3-2-1 backup hygiene easier. 3 backups, on 2 different mediums, 1 of them off site. Cloud storage accomplishes both the 2 and 1, because it is both a different medium and off site.
The fact that you can automatically sync remotely is a big bonus too, because off-site backups historically have a problem where they fall out of date without active attention. For instance, if you have a tape backup system stored in a warehouse across town, those tapes are only as up-to-date as the last time you took the time to drive across town and update them. But with cloud storage, you can automatically sync your folders to keep things up to date in near real time. Plus, your traditional off-site backup is only as secured from things like natural disasters if you’re willing to travel fairly long distances to make them. Those tapes in a warehouse across town won’t survive if the entire town is hit by a natural disaster like a wildfire or flood.
For instance, maybe I make an update on my laptop, and then want to access it on my phone. Even with SyncThing, my laptop and phone won’t sync with each other unless they’re able to find each other on the same network. If I’m not on a trusted network at the time, (e.g. I’m at work on my employer’s WiFi, or traveling and using hotel WiFi) that makes syncing difficult. But with cloud storage, they can both essentially use that as a relay. My laptop updates the cloud, and then my phone pulls that update. Now both devices are up-to-date without actually needing to discover each other on a trusted network.
I'm currently (for the past 5 or six years) using a nextcloud server (remote) where I store the master. My desktop is typically where I make changes but sometimes on my mobile devices. No mater where I edit the database it gets synced. Knock on wood, but I've never had as issue.
You can have both and keep a local copy via export once in a while. If the cloud goes down the also most likely your bank website. If you're talking about other types of secrets then the first sentence will apply
Personal disaster as well.
If something happens to me and I am incapacitated, or worse, my wife or my brother can request access to my vault and without any action in my side for a week they will have access to my vault. (Emergency access feature in bitwarden)
So it does not add the stress of needing to call ALL the utility companies, bank, school ... To reset passwords or request emergency access.
I saw that first hand with my brother in law who had an accident and went into a coma. We were lucky that his computer wasn't locked and all his password accessible on it.
Meant as a negative to cloud vaults?
In that case: Bitwarden (as an example) can work offline and records can be exported from it.
It's convenient, but not much moreso than keeping the encrypted file in your google drive or whatever and pulling it down once in a while.
I've tried storing encrypted blobs including a keepass database on Google drive and I always end up with hundreds of conflict copies
Put the keepass database in a folder and use syncthing to sync that folder.
I just run syncthing on every device that needs my password and they all always have an up to date copy of the database.
What do you use to encrypt the files to begin with? For apps that don't have an encrypted backup option built in.
Keepass encrypts the database with AES-256 by default so there is already a layer of encryption protecting your passwords.
If you use keepass and want to use a third party service to store your files there's a way to setup an untrusted mirror which will encrypt the files before sending it to that client. That way you still have your files elsewhere (often on a VPS, seedbox or other host) but that host doesn't have the unencrypted sync folder just in case you decide to put non-encrypted files in there too.
That's very helpful information, thank you! I'm using bitwarden but looking into switching.
I mean if you use syncthing.
Syncthing is what has the ability to set untrusted hosts. You set a password and the files are encrypted with that password before sending it to the untrusted computer.
Excellent, thank you! Looking into it.