I've cancelled my subscription yesterday, conveniently it was about to renew at the end of the week, so I have a few days to migrate from Proton, here's what I'm thinking of, but I'd love to hear what other people are switching to

top 98 comments

sorted by: hot top controversial new old
[–] 76 points 3 days ago (13 children)

I've been using KeePassXC with Syncthing for years and it's been great as a password manager for myself. But I don't need to share those credentials with anyone.

  • source
  • hideshow 13 child comments
  • [–] 12 points 3 days ago (5 children)
  • [–] 3 points 3 days ago (2 children)

    I'm strongly considering getting a hardware key. Is Yubikey the best choice or are the other options also worth considering?

  • source
  • parent
  • hideshow 2 child comments
  • I bought my yubikey at least 7-8 years ago and then stopped keeping up on comparisons. I honestly have no idea which is the best, because there are varying use cases and standards available. Yubikey works for my use case and threat model, but I have no idea what would be best for yours. I wish I could be more specific for you but also don't want to give you misleading info.

  • source
  • parent
  • [–] 0 points 1 day ago

    Solokey and Nitrokey are strong alternatives, and the two I’ve been recommended by people who would know.

    Solokey is good if Fido is the only thing needed.

    Nitrokey has Fido and more. I keep meaning to try the other features, but haven’t gotten around to it.

  • source
  • parent
  • [–] 3 points 3 days ago (4 children)

    Does keepass have a reputable browser extension or is the application itself all that's used? I think that's what moved me off Keepass initially after using it for like six years and then moving to BitWarden a few years ago

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 3 days ago (2 children)

    I assume the point of the extension is to have support for autofill, if that is the case, you should be aware that it is generally a bad idea to give your browser access to that info directly since they are the definition of internet connected apps. What I do instead of autofill with keepassxc is open the vault and press the copy to clipboard buttons which works essentially the same way as autofill just with a couple more clicks.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 3 days ago*

    But I don't need to share those credentials with anyone.

    Yeah, I like BitWarden because it makes sharing passwords very easy. My wife and I have a few shared accounts, and have a family vault set up. So anything we want to share just gets transferred into the family vault, and we can both easily access it. And since it even supports TOTP, we can have those directly on the shared accounts without needing to bug each other with the β€œhey I’m trying to log into {x}, send me your Google Authenticator code” song and dance.

  • source
  • parent
  • [–] 1 point 3 days ago

    I’ve tried that exact setup but Syncthing kept not detecting changes or creating conflicts… So I’m still stuck with Proton Pass :/ (it’s a good password manager, but Andy Yen is being too much of a loser)

  • source
  • parent
  • [–] 59 points 3 days ago (1 child)
  • [–] 116 points 3 days ago (32 children)

    Bitwarden is pivoting towards the same enshittification path as everything else, so that’s not gonna be a good long term for a password manager. They hired a new ceo whose only noteworthy experience is prepping companies for mergers and acquisitions, and briefly removed messaging on their website about always having a free tier which they reinstated after backlash. All signs point to a sinking ship, imo.

    I don’t have the answer for what to use instead since I’m still a paid subscriber with them, but I’m looking around. Probably keepassxc but I don’t know enough to host and sync my own.

  • source
  • hideshow 32 child comments
  • [–] 18 points 3 days ago (3 children)

    KeepassDX on android. Any keepass .kdbx file opener on every OS. .kdbx file saved on a local network shared folder on an always on raspberry pi. Access the folder on all devices, open the file with keepass app.

    No sync, no extra sync software, no dangling copies, changes are immediate, decryption happens on device not over the network. Step up to network share over sftp. Tailscale tunnel to access when away from home.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 22 points 3 days ago (20 children)

    Vaultwarden is a great alternative.

  • source
  • parent
  • hideshow 20 child comments
  • [–] 22 points 3 days ago (19 children)

    However, Vaultwarden only implements the webvault, the client apps are still only supplied by Bitwarden, which they could make incompatible with Vaultwarden at some point.

  • source
  • parent
  • hideshow 19 child comments
  • [–] 8 points 3 days ago (16 children)

    the client apps are still only supplied by Bitwarden

    Not true. You could also use Keyguard.

  • source
  • parent
  • hideshow 16 child comments
  • [–] 5 points 3 days ago* (15 children)
  • [–] -1 points 2 days ago (14 children)

    Their github page is public and you can review the code if you want to. What are you talking about?

  • source
  • parent
  • hideshow 14 child comments
  • [–] 7 points 2 days ago (9 children)

    I'm talking about the license. It is proprietary.

  • source
  • parent
  • hideshow 9 child comments
  • [–] -1 points 2 days ago (8 children)

    What is it exactly that you want to do but can't? Anyone can audit the code, you could see if they were doing something sketchy. Sounds lile you just want to complain.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 3 points 2 days ago (3 children)

    Open Source is not just about the source code availability. Keyguard is proprietary and I try to avoid proprietary software.

  • source
  • parent
  • hideshow 3 child comments
  • [–] -5 points 2 days ago (2 children)

    So no real reason then. Gotcha.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 2 days ago (1 child)

    Just because someone's constraints don't apply to you doesn't mean they aren't "real", maybe try to not be so dismissive of other people's needs?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 2 days ago (3 children)

    We're here discussing the possibility that BW enshittifies, and you suggest an alternative that has everything ready from its day1 to enshittify. Just saying.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 day ago (2 children)

    Uhm, no? I was talking about BW only as a client for Vaultwarden and mentioned thar Keyguard is an alternative client. There's nothing "enshitified" about it. What exactly is the issue about it only being source available?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 day ago (1 child)

    I didn't write it was enshittified. I'm saying it bears just as much risk of enshittification as BW clients, even worse here since you can't fork it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 day ago

    Literally anything can "enshittify". A project being open source does not ensure that won't happen.

    you can’t fork it.

    Well, technically you can, there's nothing stopping you. There are 121 forks already. Not sure you can distribute it though.

    Regardless of all of this, it's just like any app or service. You can use it while it meets your needs and drop it when it doesn't. In this particular case, you can at least see the source code and actually make sure that there's nothing bad in there.

  • source
  • parent
  • [–] 1 point 2 days ago (3 children)

    Source available does not mean the same thing as Open Source.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 1 day ago* (2 children)

    Re-read my comment. Did I say "open source"? Also, I reiterate my question, what does it being source available entail for you? Is there anything more insecure? Is there something you can't do? This sounds more like a pet peeve than an actual problem.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 3 days ago

    the community already made a custom server that's compatible with Bitwarden, I imagine if Bitwarden cut them off then they could make a custom client for it as well.

    in fact I believe there are community made Bitwarden apps already for Linux desktops, although I never tried them because I just use the browser extension.

  • source
  • parent
  • [–] 1 point 3 days ago

    Indeed, and I do not like that I have to have another repository just for the bitwarden app.

    I am not really worried though. If they completely fuck up, a fork of the app will be a matter of seconds.

  • source
  • parent
  • [–] 6 points 3 days ago

    AFAIK the concept behind keepassxc is that it's an encrypted .kdbx file that you sync yourself among your devices by any means you can. There are official apps for Windows/Linux/Mac, browser extensions for Firefox/Chrome/Chromium/Vivaldi, there's integration with ssh-agent, and 3rd-party apps for Android and iOS.

  • source
  • parent
  • [–] 5 points 3 days ago

    I don't think Keepass does syncing. I just leave the database in my Nextcloud sync folder on my desktop, and I can always pull the latest version to my phone. It'd be a bit more annoying if I routinely added new entries from my phone since Android won't let the NC app maintain bidirectional sync, but I pretty much always do it from my desktop, so the workflow is fine for me personally. If you do it on your phone, you can upload the changed version, but I think you'd have to do it manually, so not a great flow, but if it's a rarity, not too big a deal to me.

  • source
  • parent
  • [–] 4 points 3 days ago (1 child)

    write a bash script that rsyncs your keepass database to your other devices and run it once in a while. i have seen way too many online password vaults get hacked to ever bother with them.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 44 points 3 days ago (4 children)
  • [–] 11 points 3 days ago (2 children)

    It is. I just made the switch last year and spent forever making hide-my-e-mail adresses for every service , web page and online store I had subscribed to. My Proton subscription just renewed so I guess I’ll wait another 11 months to see how this pans out before I make a decision.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 3 days ago*

    Hide-my-emails keep working after you leave proton if you have your own domain. I left proton last year and the alias I created there still point to my email address. But you have to have it point to a custom domain email address

  • source
  • parent
  • [–] 19 points 1 day ago (1 child)

    Obsidian is proprietary. It can go fuck itself.

  • source
  • hideshow 1 child comment
  • [–] 19 points 3 days ago

    I don't know if I'd still suggest Bitwarden with the dual-licensing drama from not too long ago and the new CEO.

    https://blog.ppb1701.com/the-quiet-renovation-at-bitwarden

  • source
  • [–] 69 points 3 days ago (8 children)

    I wouldn't trust Bitwarden anymore. I don't believe they've done anything bad just yet, but they recently sold out to a private equity firm and quite literally removed "transparency" from their company values. KeePassXC is your friend.

  • source
  • hideshow 8 child comments
  • [–] [S] 12 points 3 days ago (2 children)

    Ahh too bad then I'll switch to Keepass yeah

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 3 days ago (1 child)

    quite literally removed β€œtransparency” from their company values

    No they didnt. Why do people keep making up this bullshit?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 34 points 3 days ago (18 children)

    IVPN is a well-established private VPN provider, with a strong track record.

    Windscribe is also of note, being part of the cross-promotional circle of agreements with other established and trusted services such as Tuta, and Addy.io

    Obscura is also worth a look for the especially privacy minded approach they take to running a VPN, essentially severing the entry and exit points of your network traffic across providers so that even if Obscura or their partners were to fail a user's privacy, there wouldn't be anything lost.

    Mullvad is also a longstanding and respected VPN but I believe there's been pretty severe controversy around them recently, and that should be looked into before considering them. They were essentially the gold-standard up until recently.

    All of these providers have a variety of anonymous payment methods, to varying degrees of convinience and anonimity.

  • source
  • hideshow 18 child comments
  • [–] [S] 6 points 3 days ago (3 children)

    wow thanks for all those details!!

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 3 days ago (2 children)

    Felt like giving a little list off the top of my head instead of just going 'use what I use!'

    If you want any assistance, I'm always open to help out :)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 3 days ago (5 children)

    How is IVPN when it comes to p2p file sharing?

  • source
  • parent
  • hideshow 5 child comments
  • [–] 6 points 3 days ago (3 children)

    Ivpn doesn't support port forwarding so it probably won't work well for filesharing. Private internet access has support for it, although I'm not thrilled with its jurisdiction atm, but that being said they have been subpoenaed before & were unable to produce logs so they probably aren't bsing their no log policy.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 2 days ago

    Pia is owned by kape technologies, a company founded by former Israeli intelligence officers that buys up VPNs.

    I tend to recommend airvpn for cheap port forwarding but bear in mind you may recognize the need for a separate normal service because of airs unique position in the marketplace.

  • source
  • parent
  • [–] 3 points 3 days ago* (4 children)

    I've known someone who uses both Proton's VPN and the Mullvad one. From what I saw when I tested theirs, the Proton one manages to get through and works with frontends, whereas Mullvad doesn't always, but it's got more finetuning.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 19 points 3 days ago* (3 children)

    Mullvad's co-founder funds the Swedish alt-right

  • source
  • parent
  • hideshow 3 child comments
  • [–] 10 points 3 days ago* (1 child)

    That's the part that confuses me. Mullvad has distanced itself from his stance. As for the party..:

    My analysisThe party he supports has been claimed to be Marxist, and elements of that can be seen in it favouring a 30-hour workweek, strong secularism, making public transit free of charge, as well expanding social housing.

    However, it (falsely) aligns workers with the business class, thus showing elements of favouring the bourgeoise rather than the proletariat; it also is nationalist in character, rather than internationalist, and wishes to deport fellow labourers. Moreover, it disfavours green energy and is thus a tool of the global capitalist coal and petrol companies. It also opposes liberating the worker from gender-based negative discrimination, because it wants to abolish quotas.

    Since their policies don't support inherent change of power structures, nor liberate the worker from discrimination, I would label them as revisionist marxists due to their alliance with the oligarchs.

    Proton on the other hand, has confirmed donations that tend to be for organisations which I'd label as broadly progressive, but generally towards the centre-left. However, their CEO is obsessed by AI and has supported a statement of Trump. So it's really crazy.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 31 points 3 days ago (12 children)

    Bitwarden's gone private equity. I'd hold off on switching to them; maybe try to live with KeePass if you're not on a family plan.

  • source
  • hideshow 12 child comments
  • [–] 15 points 3 days ago (7 children)

    I switched over to vaultwarden. I am stuck on an iPhone for the time being and I don't care for all the Keepass ios apps.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 7 points 3 days ago (6 children)

    Completely valid. I myself am still on Bitwarden, waiting for the other shoe to drop, but my family is already entrenched in it.

    I think if I have to move them again, I might seriously consider forking keepass, adding the features I use in bitwarden.

    I do not look forward to dealing with IOS tho.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 4 points 3 days ago* (last edited 2 days ago) (5 children)

    Vaultwarden is completely Bitwarden-compatible. You can export all data from Bitwarden server/service, import it into Vaultwarden server, and your family will not notice the change at all, except you'll ask them to change address in their already installed Bitwarden app.

    They don't need to change anything else. To them, it will still be the same Bitwarden.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 2 days ago (4 children)

    and your family will not notice the change at all

    Here lie dragons: for as long as the private equity firm that owns Bitwarden chooses to let us use their clients.

    There are non-Bitwarden Android clients around, but they lack Chrome extensions and IOS.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 2 days ago (3 children)

    True, this is a possibility. But, in years of Vaultwarden's existence, this never happened.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 2 days ago (2 children)

    100% but for years of Vaultwarden's existence, they haven't been owned by private equity.

    Just keep your eyes open and know that it could come for us. I've stopped counting on how many services went private->enshitify bad enough for me to bail.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 day ago* (last edited 1 day ago) (1 child)

    Fair enough. In case we do need to move, here's a quick tip: KeepassXC and many other password managers are able to read Bitwarden export files, so you can seamlessly move credentials there, should the need arise.

    Also, Vaultwarden has a web interface, which can do as a temporary or full substitute. I used it for a while, it's totally doable.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 day ago

    able to read Bitwarden export files,

    Oddly, i knew that to be the case deep down, and if someone had asked me if that worked, i'd have gone yeah absolutely, but I didn't even think about it as a backup strategy, that's 100% my plan going forward now :)

  • source
  • parent
  • [–] 3 points 3 days ago* (2 children)

    I would switch to KeePass if its sync method was more sane than "big binary file + Syncthing", it seems like all the password manager options kindof suck in some way

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 days ago

    Yeah, there are a bunch of ways to tackle that. Chunk-Based Content-Addressable Block Storage (that weird thing where they put a folder of 0-A the folders under that with hex-based naming and small chunks of data wouldn't be horrible keeping update sizes managable. The real problem there is dealing with Syncthing conflict files. The monobinary is either new or old. Maybe a local-only CBC with deltas delivered by syncthing so they can overwrite each other and a rollback/history option.

    P2P anything is complicated. Something as damning and imporant as password management makes it so much worse.

  • source
  • parent
  • [–] 1 point 2 days ago

    there's still vaultwarden. i just self-host that and use the official bitwarden clients (android app + firefox extension). even if bitwarden itself shits the bed and takes their clients down with it, i don't doubt there will be alternatives up and running relatively quick.

  • source
  • parent
  • load more comments
    view more: next β€Ί