Oh my mistake. Not sure why I thought that.

So just get it from your repo.

What do you do? Use one password for everything?

No shit?

Yes and no. You can store them in a free cloud account, provided you have local copies; there's a risk your access to the cloud storage could be denied. A security risk is that they could harvest these databases, and decrypt them later.

I think your best bet, if you were to use free services, is to delete old databases from the cloud. Encrypt the new databases with the updated password manager and a new master password.

Keepass + Syncthing for cloudless sync between devices. Dreamteam.

My comment was to answer the question of: "Why is this relevant?" (Its been asked a lot). It's relevant because Bitwarden is claiming that the they "cannot see your passwords".

That would be an understatement since all services claim your data is safe even in that case which is not true.

I didn't think you were making the post to defend Bitwarden or something. I was just adding the details of one of the exploits the paper found that directly contradicted their claim.

At the point someone pulls off a valid MIM attack - which is basically a requirement here unless the whole BW/Vaultwarden server gets compromised- that is the least of someones problems.
MIMs are incredibily hard these days.

Just adding: Passkeys do migitate a lot of these issues as well.

Personal recommendation:
Start with a selfhosting support software like Casa, Yuno or (my recommendation) Cloudron.
Start hosting the app there with frequent backups and occasionally export into regular Bitwarden as a failsafe.

And when you are comfortable switch over to properly self hosted Vaultwarden.

Repos can get / have been hacked/malicious code injected.

And if the client software itself is compromised then all that is meaningless.

This is it. The most boomer-ass comment of 2026 so far.

Take this moment in, folks.

What a headline

So I chose the worst pick, eh?

These password managers claim your passwords are secure, even if their servers get compromised, which is what is expected from a security standpoint. But that is apparently not the case.

Web interface and secure are two things.

That's not very typical

Rain notifies you about being wet in making you wet. A compromised password store rarely notifies you about being compromised.

Why would you do that? Just sync thr database with Syncthing and keep it locally on your devices. I'd never put my pw dB in a publicly available cloud online, even though it's encrypted.

For backup.

So all of my hard drives and devices are in the same house, if I was sleeping and and house caught on fire and I couldn't even get my phone in time (just a worst case example), then I lose all my passwords.

Cloud is my "offsite backup". Cuz where else would I put stuff?

Also: I though you could just safely upload encrypted files to Google Drive, why not a password database? It's just another encrypted file.

Regarding a malicious server acting under Bitwarden's fleet:
As I see it, the most vulnerable target would be an organization's self-hosted Bitwarden server.

Additional vendor responses by Bitwarden to put the remediations and threat models into perspective:

Bitwarden blog post

Bitwarden cryptography report

It wasn’t designed for the front to fall off, that’s for sure!

JFC this headline. BREAKING NEWS: Healthy people die off an old age.

Probably?

So can anything. The article was about people getring compromised copies from malicious websites. The answer to that is to get it from a legirimate source, so if your comeback is the legirimate source can get compromised, the only answer is to not use the fucking internet. What the fuck do you want to hear?

I got it from my system package manager. I didn't download it from the web or anything. Sudo apt-get install keepassxc. I also use keepassDX on my phone, pulled from the fdroid repository.

Things you should know: Your car won't drive after it's broken down.

Well if they store an encrypted blob they can't see them.

Well if you decrypt the blob on the server they can see it.

Oh i thought something was weird lol

I see. For this scenario, I have another Syncthing server, which is on 24/7, responsible for offsite backups.

Ad encrypted files: true, but why expose them to a potential adversary? If there should be a flaw in the encryption (now or future) the other party already has access to the file.

I don't think it should be disappointing. Bitwarden welcomes third party security testing, especially given it is open source. The tests done were just tests, and the issues were already fixed.

Yeah, after seeing their response I'm quite satisfied. They're one of the good guys and I hope it stays that way.

There's something nice about the phrase "decrypt the blob."

I just write down password hints on a scrap of paper.

And glosses over what it claims are the two that dominate market (combined market share of 55%) which negates their headline, since it's likely the reader is using one of those two password managers.

Source

I'll be honest, password managers are like the holy grail of desirable to breech. If you're using one it will be constantly under attack. It being breeched or vulnerable shouldn't be a surprise. There isn't really a secure way to store large amounts of passwords that doesn't have some vulnerability issues.

If you don't have to use your passwords from multiple locations, your hints are intelligible only to you, and you don't leave the paper anywhere too obvious, this isn't a bad solution.

No. Because the very nature of passwords and password managers make you immeasurably safer than not using one at all. Password managers in almost all markets detect password compromises and alert you to change them. Doing so is trivial and as long as you catch it in time, you're much safer and harder to target than almost any other user.

Passwords are like physical locks. Its not about being unpickable or indestructible. Its mostly about raising the barrier of entry high enough that you are an unappealing target. Why would I spend days/weeks/months trying to crack the account of someone using a random string of 14 characters unique to every service and that can change their password within hours or days--when I could instead gain remote access to hundreds of other users that keep a 'passwords.doc' file in ~/documents with open permissions? They likely use passwords like 'Snoopdog2004$' so they're easy to brute force, they won't notice incursions, and can't easily change passwords that are shared between multiple services.

This is terrible advice, even if I assume you are also using a key-file on a removable usb. An attacker can brute force decrypt your db. There is no rate limiting when you literally have the database file, they could replicate it across thousands of servers each with dozens of cores, each core trying a dozen keyphrases per second. That's assuming a motivated attacker like a government or crypto scammers, but why open yourself to that possibility?

Password managers are supposed to be designed to resist a situation where they're compromised, and are only ever supposed to see a mysterious blob of encrypted data without ever having access to any information that would help decrypt it. The headline's more like M1 Abrams Tanks Vulnerable to Small Arms Fire - it'd be totally expected that most things die when shot with bullets, but the point of a tank is that it doesn't, so it's a big deal if it does.

That's why I liked password store, no servers, just my encrypted password files on my own computer, that I sync over to my other devices.

Apparently it's dying soon through, so I need an alternative.

This is about to go belly up IIRC. openPGP is infighting, splitting into two projects, password-store hasn't been updated in a decade. It'll lose compatibility.

But currently all my passwords are in password store. Looking into alternatives. I like the idea of keepass because it's still local. But I also pay for proton, so might use theirs. They weren't susceptible in the recent attacks

i use keepassxc for the offline database part, and syncthing to sync it (among other things) between all my devices

Well, what sort of standards are these tools built to?