I don't store my passwords online anymore
With the recent price hike and "controversy" around Bitwarden, I decided to change password manager. Don't get me wrong. I happily bought the premium membership for 7 years straight, not for the premium features, but to support Bitwarden. At first I thought, I move to Proton Pass, but its premium is more expensive than the premium at Bitwarden. I signed up anyway and tried to use the free version, but the constant nagging to buy premium or use another service from them, like Mail or Storage, I just gave up. With this somehow I lost faith in storing my password online. Beside this, the possibility that the service will be unavailable sometime in the future is non-zero. It is unlikely, but not impossible. I looked around, what kind of offline-first possibilities I have and found Keepass after many-many years again. The only problem with Keepass that the database needs to be synced to other devices to have the same functionality (available on multiple devices), with the possibility of merging issues or conflicts.
Because I was determined, I had to to answer the following questions:
- How do I solve the syncing?
- How do I deal with the occasional conflicts?
- How do I recover from a disaster if one, two or all my devices break? - Yes, this is really important!
Sync all the things
I think the main pain point is, how to sync the password database on multiple devices. With an online service this is not a problem and I could access that even on a computer in a library, or on a friends phone. It is not advisable, because I do not control the device and who know what kind of programs running in the background that can steal logins. So I searched for a syncing solution, that can keep the traffic strictly inside my local network, or if I really need to push an update to all of the devices from the "outside", I can access my network with a VPN. This is where I found Syncthing. Setting up Syncthing on my desktop wasn't that complicated, and adding folders to watch and share with other devices was simple too.
Dealing with conflicts
With the syncing out of the way, I had to deal with conflicts if I try to update the database on multiple devices - not the same time, but before the devices could sync to a stable state. Syncthing defaults to a 1 hour rescan for changes. I could set this to a more frequent interval, but the syncing only work if the Syncthing client is started. I had to see this problem from another point of view. How about instead trying to find a solution for adding new or updating, deleting existing entries on all possible devices, why not just do the management on one dedicated device, like only on the desktop? Do I really need to sign-up / register for a service on my phone or notebook while I am on vacation, or driving, or hanging out? How often do I need to edit current entries when I am not at home? Knowing these, I decided to have a main device and multiple receiver devices. I just configure that the shared folder on the desktop to be send only, and the folder on the other devices to be receiving only. On top of that I can set an option on the Keepass database that it sets it to read only mode. If I make some changes on the master database I can just start the Syncthing client on all the other devices and wait for the database to be pushed out.
Disaster recovery
Now that I have solved the syncing and dealt with the conflict, how can I deal with a situation when all of my devices break. The chance is slim, but not zero. I need some kind of an external backup. This is where I bought two flash drives. To one I have immediate access at home. I just copy the database (and update a simple note file, when was it updated) and put back to the safe location. The another drive is off-site and I have to walk/drive to get it. I just rotate them as frequently as I update the database, so they always have the most up to date backup. Is it an overkill? Maybe, but with this setup I can be sure even if something disastrous happen at home, I always have a copy from all of my passwords. I could add an extra option to store the database somewhere online, but I am not sure in that.
So this is it. In a short time I've found a solution that works for me to keep my passwords safe, and yes my TOTP configuration too, and have them at hand anytime when I need to use them. On top of that I do not have to pay for it. Yes, I still "pay" for it with my time and effort, but I have the needed technical knowledge to handle things and I don't mind walking a little.
Please keep in mind: this is not the best solution to a problem and not the best solution for everyone. Everybody should store and handle their passwords/secrets, exactly how they are comfortable with. This just works for me.