News for hackers. Stuff that matters.
Re:KeePassXC 2.5.2 by dmos62 on Sunday January 05, 2020 @05:20AM (#21960608)
I use git to version my Keepass database files. It's not great, because if you store binary files inside the Keepass database, the git repo's size grows very fast. I do it because I don't trust the apps I use to not corrupt the file. Does anyone have alternative solutions?

Something like pass lends itself ideally to version control, but all my entries' metadata (names, dates) are visible, which is a problem for me. I want to be able to store my secret database even on untrusted infrastructure.

Currently, I'm pondering storing big or often updated binary data separately from the passphrases and similar low-footprint data.

Re:KeePassXC 2.5.2 by novirium on Sunday January 05, 2020 @05:27AM (#21960618)
I've been using SyncThing for years with my KeePassXC database without issues (including Android for use with Keepass2Android).

On the odd occasion it's been modified on two devices without a sync and SyncThing produces a sync-conflict file, a simple "Merge from database..." within KeePassXC happily pulls in the newer data from both databases to merge them again.

I use the Staggered File Versioning feature on at least one device + a separate backup mechanism to satisfy my paranoia about losing the database.

Re:KeePassXC 2.5.2 by bavell on Sunday January 05, 2020 @11:35AM (#21962030)
Love it! I just recently started using Syncthing and may implement what you've outlined here.

As a fellow paranoid, what mechanism are you using for the separate backup?

Re:KeePassXC 2.5.2 by neumann on Sunday January 05, 2020 @08:44PM (#21965748)
Likewise. SyncThing and suitable file based databases allow so many instant 'cloud' solutions! KeePassXC across 5 devices with instant updates!
Re:KeePassXC 2.5.2 by iszomer on Sunday January 05, 2020 @11:26PM (#21966441)
This is what I do too. I also configured it to only sync with a specific WAP.
Re:KeePassXC 2.5.2 by phasor on Sunday January 05, 2020 @11:06AM (#21961851)
I store my keepass database on a private Seafile server hosted on a cheap cloud VPS. What I like about this solution is: 1) the file is stored in an encrypted seafile library with client side encryption so that a potential hacker could not access the file even with access to the server. 2) delta sync for my other large files. Disclaimer: I am in no way associated with seafile, just a happy user for many years.
Re:KeePassXC 2.5.2 by benhurmarcel on Sunday January 05, 2020 @06:47AM (#21960855)
I just have it backed up regularly, along with all my other files. My backup system keeps versions, so I can roll back in case I need it.
Re:KeePassXC 2.5.2 by Iolaum on Sunday January 05, 2020 @03:01PM (#21963633)
I just branch my kdbx file every ~4 months to withstand dB corruption. Appending -$date suffix on the filename. I also sync the database (using nextcloudpi) between mobile (keepassdx) and desktop.
Re:KeePassXC 2.5.2 by fractalf on Sunday January 05, 2020 @06:48AM (#21960861)
I keep the db + image file in a selfhosted (gitea) private repo. The repo contains 100s of files and I named the keepass files very general to hide in the open if my server is hacked.
Re:KeePassXC 2.5.2 by bavell on Sunday January 05, 2020 @10:20AM (#21961579)
Hmmm... I haven't taken a look at what the raw DB file looks like but I imagine it wouldn't be too hard to differentiate from the other files if looking at the bytes on disk. Food for thought...
Re:KeePassXC 2.5.2 by fractalf on Sunday January 05, 2020 @10:40AM (#21961699)
Yes its possible, but needs finding out. There is also another file among the 100s that needs to be used with a strong password tough. All these layers make me feel it's safe enough
Re:KeePassXC 2.5.2 by bavell on Sunday January 05, 2020 @11:31AM (#21962003)
For my own ultra-secure (offline) storage, I use a strong password for a KeepassX DB stored on a LUKS-encrypted USB drive that's only plugged in when needed. Layers are the way to go ;)
Re:KeePassXC 2.5.2 by fractalf on Sunday January 05, 2020 @01:20PM (#21962864)
Right on :)
Re:KeePassXC 2.5.2 by dmos62 on Sunday January 05, 2020 @10:01AM (#21961494)
What do you mean by db + image file?
Re:KeePassXC 2.5.2 by fractalf on Sunday January 05, 2020 @10:41AM (#21961710)
Strike image. I just happen to use an image. KeePass db can be locked using a password AND a file
Re:KeePassXC 2.5.2 by mackrevinack on Sunday January 05, 2020 @05:50AM (#21960677)
ive never got around to trying pass, just read a few things about it. I remember something called tomb that works with pass to hide all the file names
Re:KeePassXC 2.5.2 by dmos62 on Sunday January 05, 2020 @09:59AM (#21961489)
Unfortunately tomb isn't very portable.