Because most people need a cloud solution for synchronization across devices. Unless you’re spinning up your own service like Nextcloud or similar for this, relying on a commercial cloud storage service for storing the file is just as dangerous (perhaps more so, as your attack surface is now across two third party services) as relying on someone like Bitwarden or Lastpass.
There’s a big difference. You trust entities like bitwarden/lastpass/etc to properly encrypt the data, protect your master key, and trust their entire architecture behind the scenes.
When you encrypt the keepass DB that’s all done by you locally with a open source client. No one knows your master key, and you get a simple encrypted file. You can hand that file to hackers if you want, will be useless without the key.
I put one of the copies of my keepass on onedrive, and syncs perfectly across all devices.
Except for the part that it’s not a question of trust (being open source), there’s no third-party architecture to trust (it can and should be self-hosted), the data on the server are also encrypted client-side before leaving your device, sure.
Oh, and you also get proper sync, no risk of desync if two devices gets a change while offline without having to go check your in-house sync solution, easy share between user (still with no trust needed in the server), all working perfectly with good user UI integration for almost every systems.
Yeah, I wonder why people bother using that, instead of deploying clunky, single-user solution.
Bitwarden can be fully self hosted, I’m doing it. My Bitwarden server doesn’t (and can’t) talk to them at all as it has no way to access the internet. They know nothing about my deployment except that I signed up for a free license key.
I used to use Keepass and sync thing and would consistently run into conflicts between my desktop and mobile entries. Maybe there’s a better way to do it that I’m missing, but that was very annoying
I use this setup for my personal passwords, using nextcloud as the sync solution. A semi-fix for that was using Keepass2Android (on Android obviously). It integrates with nextcloud directly, keep a local DB of passwords, and would only load the remote one (and merge) on unlock and updates, not keeping it “constantly” sync on every remote change. It works well… most of the time… with only two devices that almost always have connection to the server… and for only one user.
It’s overly clunky though. It’s the big advantage of “service based” password manager against “single file based” ones. They handle sync. We have plans to move to bitwarden at my workplace, and since the client supports multiple accounts on multiple servers, I’ll probably move to that for personal stuff too. The convenience is just there, without downside.
Why would anyone trust any company with their passwords??
Just use keepass and not bother with BS
Because most people need a cloud solution for synchronization across devices. Unless you’re spinning up your own service like Nextcloud or similar for this, relying on a commercial cloud storage service for storing the file is just as dangerous (perhaps more so, as your attack surface is now across two third party services) as relying on someone like Bitwarden or Lastpass.
There’s a big difference. You trust entities like bitwarden/lastpass/etc to properly encrypt the data, protect your master key, and trust their entire architecture behind the scenes.
When you encrypt the keepass DB that’s all done by you locally with a open source client. No one knows your master key, and you get a simple encrypted file. You can hand that file to hackers if you want, will be useless without the key.
I put one of the copies of my keepass on onedrive, and syncs perfectly across all devices.
Companies can enshiffity at a moments notice.
I do not trust bitwarden to encrypt my data anymore than anyone trusts keypass to encrypt my data.
They’re both open source and they both do the encryption locally; you’re plainly mistaken.
Except for the part that it’s not a question of trust (being open source), there’s no third-party architecture to trust (it can and should be self-hosted), the data on the server are also encrypted client-side before leaving your device, sure.
Oh, and you also get proper sync, no risk of desync if two devices gets a change while offline without having to go check your in-house sync solution, easy share between user (still with no trust needed in the server), all working perfectly with good user UI integration for almost every systems.
Yeah, I wonder why people bother using that, instead of deploying clunky, single-user solution.
Bitwarden can be fully self hosted, I’m doing it. My Bitwarden server doesn’t (and can’t) talk to them at all as it has no way to access the internet. They know nothing about my deployment except that I signed up for a free license key.
Are you a software developer ? Because you are way out of touch with what users want.
Well, who did you trust to build your hardware?
I used to use Keepass and sync thing and would consistently run into conflicts between my desktop and mobile entries. Maybe there’s a better way to do it that I’m missing, but that was very annoying
I use this setup for my personal passwords, using nextcloud as the sync solution. A semi-fix for that was using Keepass2Android (on Android obviously). It integrates with nextcloud directly, keep a local DB of passwords, and would only load the remote one (and merge) on unlock and updates, not keeping it “constantly” sync on every remote change. It works well… most of the time… with only two devices that almost always have connection to the server… and for only one user.
It’s overly clunky though. It’s the big advantage of “service based” password manager against “single file based” ones. They handle sync. We have plans to move to bitwarden at my workplace, and since the client supports multiple accounts on multiple servers, I’ll probably move to that for personal stuff too. The convenience is just there, without downside.
cuz being able to log in is handy sometimes