Putting one's keyfile in the cloud just seems to me to be asking for it. You're essentially trusting a 3rd party with the keys to your kingdom.

* Compared to completely cloud-based password manager like LastPass and 1Password, it's no worse.

* The database in encrypted with your master password.

* You can optionally also encrypt it with static "Key File" that are on all your devices but not in Dropbox.

1Password seems to put saving to their cloud front and center but you can still choose to not save your passwords on their servers and use your own methods. My 1Password vaults are encrypted with my master password and synced between devices using Dropbox, I think there's also an option for directly syncing between smartphones and computers.

A) You should presumably still have a good passphrase.

B) You choose which 3rd Party to trust. There are many options with different security/trust/threat models.

(Example: lately I've been using an encrypted share in Resilio Sync where the "cloud" option for me is a dumb VPS that can share the folder torrent but does not have decryption keys into the contents.)

No. You're trusting the encryption of the password manager. No self-hosted password manager that I know of keeps your passwords in a clear text file.

KeePass is a fully self-hosted solution. The grandparent suggests using Dropbox et al for convenience (the vault is always encrypted, so it's not "giving away the keys"). However, you don't have to do that; I just use SFTP to copy the file off of my workstation when I need a fresh copy on my phone/laptop.

I don't trust dropbox, but I do trust the encryption of my password manager. Depending on how you measure, my key is somewhere between 100-150 bits, and even if that was feasible to brute force, I am not that important.

Personally, i do the same, but on Syncthing. Works very well, to need to trust in the availability of Dropbox etc.

https://keeweb.info/ is also very nice. It has a very convenient Dropbox (& co) integration.

I would like to know this as well. I tried setting up keePass on iOS, but was never able to get it to work so it seamlessly kept things in sync between all my devices (two desktop computers, three laptops, two tablets and an iphone). I then tried LastPass and so far it was worked flawlessly for me across all devices. Now I read this and I'm not sure what to do. Prior to LastPass I used the same six character password for everything. Now many of my passwords are 30+ characters long. That seems more secure, but if someone can just grab my passwords while I'm browsing then maybe it's time to go back to the same 6 character password that I can remember.

https://www.enpass.io/ is better, does the same, you sync the wallet across your machines and devices, also has browser integration. https://www.enpass.io/security/

Looks nice but no sharing options

Would love to hear from someone who has an iPhone and uses Keepass or a derivative. That's my last barrier to using it.

I do. I use the MiniKeePass app, which is free. You can export your KeePass database (.kdbx) from the Dropbox app to MiniKeePass.

Ditto. It doesn't make for a good _write_ experience, since you have to copy back to Dropbox manually, but I find that I almost exclusively _read_ passwords, so it's a non-issue for my use case.

Does this keep things auto synced up between all your devices? I'm constantly switching between different desktops, laptops, tablets, etc. and I'd love a replacement for LastPass that auto syncs just as well and also works on iOS.

As far as I know the system I described is manual only on iPhone. That is, if the database file gets updated on another device/computer, you have to manually re-import it from Dropbox to MiniKeePass to see the update there.

On desktops/laptops, if you're pointing KeePass at a database file in a Dropbox-synced folder, then it's automatic.

I may be misremembering, but I thought this was the method used by at least one other app. 1password comes to mind but I can't check it right now.

I ran into this when checking unexpected files on a client's system.

I tried Keepass but couldn't find a Mac compatible port that supported import from CSV, which kinda kills it because I already have all my passwords elsewhere and there are too many to move manually.

You can also add in KeepassHttp + PassIFox. But I wonder if these might have similar vulnerabilities as they too would be handling decrypted passwords.

True, but there are a slew of security issues (and unknowns) with KeePassHttp: https://github.com/pfn/keepasshttp/issues/258 https://github.com/keepassxreboot/keepassxc/issues/147

I've been looking for a alternative with somewhat parity with lastpass with a better security policy.

Enpass seems to be your (and mine) best choice at the moment. At least it's a standalone Qt application (not a JS-based browser one), with it's separate UI and without any autofills without asking. Bonus points for reasonably good integration with your usual clouds (Dropbox, GoogleDrive, OwnCloud, etc) for synchronization.

Cons: NOT open-source, paid cellphone apps.

That #258 issue is for if you use it remotely - which by default it isn't and I don't. The other issue you raise is based on top of that. So as long as you're using KeepassHttp with localhost then you should be ok.

So a slew is not necessarily accurate. But I take you're point, it's definitely a similar weak point that LastPass has.