Hacker News new | ask | show | jobs
by drnick1 116 days ago
> cloud-based password managers.

Enough said. This kind of stuff should be offline only. If you need to access your password database on multiple devices, set up a LAN and/or a Wireguard tunnel for remote access.

5 comments

At least a KeePass file via Cloud Storage seems like a somewhat sane tradeoff between security and convenience.

What you're proposing where you're adding a backdoor to your home network (via Wireguard) that needs to be maintained/hardened, and then still needing a LAN hosting solution for the actual database running 24-hour, is neither convenient nor secure (least of all because of layer 1 / fire / theft).

This is a fragile solution which isn't solving any particular problem; but certainly introducing multiple new exciting potential problems.

> What you're proposing where you're adding a backdoor to your home network (via Wireguard) that needs to be maintained/hardened

I have been doing this for years, and it is both convenient and secure. No maintenance or hardening is required, as Wireguard was intentionally designed not to require any tinkering. The setup is literally one config file with the public keys of the devices allowed to access the network. I run this directly on my firewall, which happens to be an x86 PC, but you could run easily run this on a router with OpenWrt. It's hard to imagine a more secure setup than this, since you manage your own keys and no third party is involved.

Hard agree, but Average Joes have no idea what any of those words mean let alone the means to do it.
Storing encrypted files is the best use case for the cloud. There's absolutely zero reason to set up your own wire guard tunnel if the file is encrypted. You can even throw it on Google drive, if you want.
You can use your KeePass off of a mobile device like a thumb drive. I have my USB stick attached to my keys (house, bike etc.) which allows me to access my passwords from everywhere. Cloud based is always a risk.
It’s more likely that I’ll drop my phone into a river than that Bitwarden will get compromised.