972
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 15 May 2026
972 points (100.0% liked)
Selfhosted
59343 readers
739 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
KeePass isn't going anywhere. They're also dragging their feet on passkey support, so you might go with KeepassXC.
@slate
Wasn't there some commotion a few weeks about KeepassXC and vibe coding?
@RonnyZittledong
Yeah, there was. It was forked because of that, actually: https://codeberg.org/ChiPass
Link gives 404
https://chipass.org/
I edited the comment. It ended with a period before, I assume your client thought it was a part of the link. Does it work now?
404
I edited the comment, see my reply to @wiccan2@thelemmy.club.
Yep works now.
Their AI policy looks very reasonable, and they certainly aren't vibe coding. Everything is rigorously reviewed and tested by a handful of experienced, competent humans.
They also don't effectively allow collaboration though, which is my cheif reason for using a cloud hosted password manager.
What is "collaboration" in this context?
Sharing passwords between groups of people so everyone always has the up to date version. Not breaking the world if two people try to modify the same entry as some file syncing solutions do.
Hmm, interesting, though isn't that a fault of the organization not having an account-linking system so that each person could have their own credentials but can still access the unified content? This workaround seems... flimsy, unless I'm not picturing a legit scenario in which no other method is as good, or something.
Sometimes it just makes sense to have a single team login.
Licensing for instance where each user costs money and not all users need a dedicated account to look at something of which only 1% is of importance to them.
Fair. I've clearly not worked at a place like this before!
It's the fault of my family organization or every company we use that my parent's bank, Google, phone, laptop, etc don't allow more than one set of credentials to access the same thing?
It's not just that we need to be able to share credentials the once a blue moon I need to help them by logging into their account?
Parallel creating, reading, updating, deleting password entries by multiple users.
Whoa, thanks. I had no idea this was a thing...
KeePass isn't meant to be used that way. It's a personal password manager. Always has been.
Valid. But it's also valid that it now doesn't work for me or anyone who also helps manage other people's lives or works on a team ¯_(ツ)_/¯
Gotta use the right tool for the job. Sorry KeePass doesn't work for you. It really is a fantastic piece of software.
Yeah I really wish there was a usable workflow to collaborate with it.
Sure they do. Multiple people can have a file open at the same time. I use it for exactly this every day at work.
With KeePassXC, that is. I don't know if other flavors have different support. I use XC primarily for the browser extension.
And you can both modify the same things without causing horrible conflict issues? And you can share only parts of your vault with someone rather than having entirely different vaults you have to switch between? I'm assuming you mean putting the file somewhere like Google Drive, and you can access it offline even if you can't edit it offline? For feature parity with Bitwarden, obviously ideally one could edit any time and it would resolve problems when it came back online if there were any but Bitwarden doesn't allow this.
Yes, no conflicts. I don't know if you can only share part of vault; I just created a separate one for a separate team.
I wouldn't put it in Google Drive or anything like that. The separate sync logic will definitely cause conflicts.
I'm not worried about having access if I'm offline, because if I'm offline I'm not going to be able to log into anything anyway.
I guess a laptop, server, IoT device, or WiFi connection when your main device doesn't have internet is out of scope for you?
Like fixing my laptop and not wanting to type the new password into my phone instead of copy/paste, sync when online?
And how are you sharing a file, to multiple people anywhere in the world realtime ish, without a cloud service you or someone else hosts? Doesn't that necessitate some syncronization logic?
It's hosted on a local network share, so we don't need Internet access.
If can't copy paste, I just type it out.
We use a VPN to the office.
As... they... should, forever.
Two articles behind a paywall, one that won’t load, and another article that says the big problem with passkeys is…people are unfamiliar with them.
If anyone tells you that Passkeys are bad, they’re a liar. Way more safe than passwords, full stop.
Just don’t let Microsoft or Apple tie them to your device. You don’t have to do that.
Are you calling me a liar? That's pretty weird; it's not like I'm telling you to stick to passwords while I move to passkeys. With that said, though, get Bypass Paywalls Clean (Mozilla-only, as far as I know) and you'll never see another paywall again. I forgot about having that.
The problem is that this is where it's eventually going to lead to.
At the very least you're misguided or don't know what you're talking about. Passkeys are not vendor locked in and of themselves.
You can make the same argument against password managers because most iPhone users that use them, use Apple's one.
They will almost certainly lead to vendor lock in. Why do you think they won't? Apple's password manager is definitely an example of vendor lock in. Many others have a simple to use export feature to CSV or something that others can understand
Edit: it could be that you don't know what the WebAuthn/FIDO2 specification says or we understand it differently? Do you know how the attestation mechanism works? That ties the key to a device or software authenticator (the software authenticator is likely going to tie it to the device somehow, possibly even via a TEE).
Not really, Vaultwarden/bitwa4den offer passkey support. When I log into a service a popup shows on my extension, I click it and I'm in. It's not gonna lead to device locking if you don't want to...
except when the wide populace starts accepting it being device locked, and your opinion does not matter anymore to those making the decisions
No one of the people I know that use passkeys use it from the phone, either they use a password manager, they have passwords on a physical note, on an excel file in the desktop, a physical yubikey, or bitwarden like me. That's everyone I physically know including every family member, friends and work people.
I know it's anecdotal, but you present your "wide populace" fact without giving sources too, and since I know no one that uses phone based passkeys, even if my experience is anecdotal, I say sus. Check your bias.
my statement is not that many people are using passkeys today. but that if there comes a time when many people will use passkeys, they will be as careless and convenient as they are with everything else today, accepting any restrictions, because "why would anyone not use Google Passkeys? It's the most convenient thing!".
and not only that. I was talking about device locking but that's only part of the problem. isn't it that passkey receiving services can identify the client software, and decide they will only accept passkeys from x and y clients?
There is no full stop there... A password that is sufficiently long will never be cracked no matter the hashing algorithm in use. Passwords are easily transferrable and can be communicated to a third party in the event of an emergency. They also provide tunable security, where you can trade off security for convenience if you want.
Some (not all, I know) passkeys are tied to a device. Stolen device means stolen passkey, and it's potentially very difficult to recover from that. Passkeys are also locked to a certain standard, passwords have no such restrictions.
Tbh I don't understand the move for passkeys replacing passwords. They should become the second factor when a user wants additional security. They're perfect for that niche.
Passkeys provide a secure way to authenticate while also being convenient. With the tradeoffs you mentioned.
I don’t like the push for only allowing some vendors to issue keys and to not allowing exporting and backups. And password should still be an option.
Password can also very easily be stolen during phishing, while passkeys are phishing resistant.
And while a hardware passkeys can be stole and used, those who steal them will still need the pin to use them, and the two major hardware passkeys options now (Yubico and Token2) both have some pin brute force protection in their firmware to slow someone down long enough for an account to be secured another way.
As for passkeys on phones, they require the pin or biometric used to unlock the phones to be used.
"Difficult to recover from" was referencing setting all of your accounts back up. I should have also included "lost" and "broken" to make that more obvious. Many hardware (most? all?) passkeys do not allow for backup and restore.
But I do see an issue with stolen hardware passkeys being used for access too if they're a primary factor. With the mitigations you mentioned hopefully holding up.