Hacker News Reader

Comment by dmos62 | Hacker News Reader

I use git to version my Keepass database files. It's not great, because if you store binary files inside the Keepass database, the git repo's size grows very fast. I do it because I don't trust the apps I use to not corrupt the file. Does anyone have alternative solutions?

Something like pass lends itself ideally to version control, but all my entries' metadata (names, dates) are visible, which is a problem for me. I want to be able to store my secret database even on untrusted infrastructure.

Currently, I'm pondering storing big or often updated binary data separately from the passphrases and similar low-footprint data.

View on HN

I've been using SyncThing for years with my KeePassXC database without issues (including Android for use with Keepass2Android).

On the odd occasion it's been modified on two devices without a sync and SyncThing produces a sync-conflict file, a simple "Merge from database..." within KeePassXC happily pulls in the newer data from both databases to merge them again.

I use the Staggered File Versioning feature on at least one device + a separate backup mechanism to satisfy my paranoia about losing the database.

Love it! I just recently started using Syncthing and may implement what you've outlined here.

As a fellow paranoid, what mechanism are you using for the separate backup?

Likewise. SyncThing and suitable file based databases allow so many instant 'cloud' solutions! KeePassXC across 5 devices with instant updates!

This is what I do too. I also configured it to only sync with a specific WAP.

I store my keepass database on a private Seafile server hosted on a cheap cloud VPS. What I like about this solution is: 1) the file is stored in an encrypted seafile library with client side encryption so that a potential hacker could not access the file even with access to the server. 2) delta sync for my other large files. Disclaimer: I am in no way associated with seafile, just a happy user for many years.

I just have it backed up regularly, along with all my other files. My backup system keeps versions, so I can roll back in case I need it.

I just branch my kdbx file every ~4 months to withstand dB corruption. Appending -$date suffix on the filename. I also sync the database (using nextcloudpi) between mobile (keepassdx) and desktop.

I keep the db + image file in a selfhosted (gitea) private repo. The repo contains 100s of files and I named the keepass files very general to hide in the open if my server is hacked.

What do you mean by db + image file?

Strike image. I just happen to use an image. KeePass db can be locked using a password AND a file

Hmmm... I haven't taken a look at what the raw DB file looks like but I imagine it wouldn't be too hard to differentiate from the other files if looking at the bytes on disk. Food for thought...

Yes its possible, but needs finding out. There is also another file among the 100s that needs to be used with a strong password tough. All these layers make me feel it's safe enough

For my own ultra-secure (offline) storage, I use a strong password for a KeepassX DB stored on a LUKS-encrypted USB drive that's only plugged in when needed. Layers are the way to go ;)

Right on :)

ive never got around to trying pass, just read a few things about it. I remember something called tomb that works with pass to hide all the file names

Unfortunately tomb isn't very portable.

Reply on news.ycombinator.com