Gross. Looks like I’m canceling my subscription.
Fucking tools. Was gonna use Bitwarden but fuck that noise
I’m using heylogin. It’s a German company with members or former members of the CCC (Chaos Computer Club) with servers in Germany.
Came across this the other day and considered setting it up to replace Vaultwarden. Definitely need to sit down and do that now, a vibe coded password manager sounds like an absolute fucking nightmare.
Thanks for the suggestion. That looks like a pretty cool option.
Read the guidelines posted there, using it as an autocomplete and a helper for docs is NOT vibe coding.
Seriously can it stop. I just switched to BW.
Faaaaackkkkkkk
Would recommend VaultWarden
Ugh I really didn’t want to migrate password managers again 🤦♀️
Goddam it wtf
Really?
This is literally where LLMs have probably the most advantageous use with practically no downsides. Their devs aren’t idiots that are suddenly vibe coding. Using an LLM can be an invaluable tool.
Linux already has merged code that had some form of LLM input years ago.
It’s not about whether or not you’re using an LLM as part of your work process, its more about whether or not you’re submitting shitty code.
Even if you want an alternative for this reason, I can probably bet you that several PRs in Vaultwarden were probably looked over by someone’s Claude chat while they were writing and testing it, or straight up took generated code and edited to their needs.
Hell I’d even bet Lemmy has PRs that have been touched by LLMs.
But muh purity!
I wish I could upvote this twice.
Bloody hell
ew
Vaultwarden + keyguard
I was looking into vault warden, an open source bit warden compatible system
Its weird seeing so many people in a place literally called “Fuck AI” defending AI.
SyncThing + KeePass, I’ve been using this setup for a long time. Requires setup and isn’t automagically done for you, but you control everything about it + it’s decentralized and local. I unfortunately don’t have any good guides off-hand, but I can try to give some pointers if you’re interested to know more about it.
On Linux, the only downside is you can’t use the auto-type feature in Wayland, but there are browser plugins to make it less of an issue.
Alternatively, if you are a self-hoster, you can still use the BitWarden local clients with an open source backend server that you control: https://github.com/dani-garcia/vaultwarden
I can’t find anything regarding KeePass’s stance on AI submissions.
Vaultwarden’s maintainer doesn’t seem to be averse to LLM contributions based on this, right?
At least getting Copilot to review stuff makes sense if it catches something that people miss, or just to catch more-obvious stuff before having a final review by the project owner.
You might be right on Vaultwarden, I don’t use it and was only making a suggestion that gets you something similar to BitWarden, but under your control, if that is a system you wanted to replicate.
There are several forks of KeePass, they each have their own philosophies. It’s kinda like FireFox vs LibreWolf vs any other fork.
KeyPass had a breach that exposed people’s master passwords to attackers.
It’s worse than Bitwarden
KeePass is an open source application, and that was patched as soon as it was found. Nothing will be 100% resistant to attacks, and you don’t have to make your kdbx available online at all which mitigates that attack entirely. What matters is how the maintainers react.
Calling a local FOSS app worse than a privately owned and centralized SaaS is hilarious.
As a regular user they allowed my master pass to be leaked. So i started using another password manager that didn’t do that.
Regular users don’t host their own password manager apps usually.
You don’t host anything with KeePass, it’s an application that you install. People use this type of software literally every single day. I’m not sure where you get your information from. There was no “leak”, it was an attack that someone could execute if they had access to your physical machine and only used a master password without a keyfile. If someone didn’t have that, they don’t have your master password, because it doesn’t go to the cloud at all. It’s all entirely local. Stop handing out misinformation like candy.
edit: the actual CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32784
Vulnerabilities happen, end of story. Like I said, what matters is the maintainers’ reaction and how open they are about the details. If you rely on other people/developers to handle your OpSec for you, then you shouldn’t be using computers at all and are putting yourself at risk no matter what software you use.
And if this is your litmus test, then holy shit do I have some bad news for you about iOS/Android/Linux/Windows/macOS/literally any web browser… and I guarantee that whatever you use now for your password manager has it’s own share of issues regarding security, which again points back to taking care of your own OpSec instead of relying on others.
Expect shit to hit the fan, and you’ll always be prepared when it does.
Hm, neat. Thanks for the cve ref. Seems KeePassXC was unaffected.
Issue was residue of typed characters left in memory (managed by .NET). This means the attacker needs to be able to dump memory and search it. If they can do that on your machine, you have other problems. They could probably just keylog you to the same effect with that level of access (on x11 anyways).
Explain to me how someone ‘allows’ leaking a password that is used locally on the user’s machine in an app that only connects to the web to download website icons.
The way password managers work is you sign up and use their app to store passwords.
Explain to me how a regular user signing up for this service is jumping through the hoops of self hosting.
KeePass is a local app, dummy. It doesn’t use any ‘service’.
I have bad news for you https://www.malwarebytes.com/blog/news/2025/08/clickjack-attack-steals-password-managers-secrets
Yeah password managers are just insecure
So you switching again?
That’s alarming.
