Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

For non-tech-savvy people - https://www.amazon.ca/Password-Book-Alphabetical-Colorful-Le...

For tech-savvy people - https://www.passwordstore.org/

The rest doesn't work unfortunately, proven over and over.



Self-hosted instance of Bitwarden works pretty well, and you can make it accessible behind a VPN to your local network only (plus there are multiple implementations of its back-end). Less-automated solutions make impractical concessions in usability.

Reference impl. in C#: https://github.com/bitwarden/server

Self-host friendly impl. in Rust: https://github.com/dani-garcia/vaultwarden

p.s.: reference implementation is by far one of the better examples of how to do microservice-based C# solution of high code quality right.


I always found running 12 containers for hosting a password repository a bit overkill.

https://bitwarden.com/help/install-on-premise-linux/


Have you checked the second link? (emphasis on "self-hosted friendly impl.").

The first one is obviously not designed to serve as a primary self-hosted option but rather to scale for large number of users.


Oh, I'm sure Vaultwarden is much more resource-friendly, but even then:

a user's password list is arguably the most important thing on the device.

And I'm not sure you need a "web interface" to something that in the end is nothing more than an encrypted text file, which is why I always recommend pass[0] or using the browser's built-in pw manager for people that don't know ssh and git.

[0] passwordstore.org


For whatever it's worth, I think people should be a little careful about using Pass. From their website:

> With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password.

This is the exact problem that LastPass just got hit with (okay, one of multiple problems) -- the vault doesn't encrypt the URLs of the sites you visit. Pass is really elegant, but it leaks a ton of metadata in pursuit of that elegance. Tracking password changes unencrypted in Git really seems like it's just asking for trouble.

Yeah, the actual passwords are encrypted and stay encrypted, and that's great -- but we've just seen with LastPass that it kind of matters that the entire vault be encrypted. I personally think there are better ways to get a CLI interface than exposing the site list.


Yep, I agree, valid criticism. There are things like git-crypt, pass-tomb etc, but those can get messy real fast.

However, git repo != GitHub. Putting the repo on a home server in the LAN has served me well over the years


Debian (or any GNU/Linux) terminal:

    head -c 256 /dev/random| openssl sha384 -binary | base64 | sed 's/[=\/\\+]//g' | cut -b1-22
where "22" is the desired length of password.


Happy user of passwordstore reporting in




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: