Switching to KeePass and Syncthing for password management

I have wanted to become more secure with how I have handled my password management for a while now. Before now, I had been using Firefox Lockwise, which is an amazing free service, by a similarly amazing company dedicated to OSS... That being said, I wanted a solution that I owned, where my passwords are only ever stored on my devices.

When it comes to password security and open source. KeePass tends to be the name you hear, and so I decided on that. Using KeePass means that I own the db. It also means that I had to find a way of syncing that db between devices...

My requirements:

• Wholly self owned solution to sync my KeePass db file between multiple machines
• Sync/Recieve from anywhere
• Little to no maintenance
• Secure

Research/Thought Process:

• A quick online search recommends using a service like Dropbox, or Google Drive.
  • I dismissed this, because it was a centralized service out of my control. If I was ok with that I might as well have stayed with Firefox Lockwise.
• I thought about a cron based rsync solution...
  • I dismissed this pretty quickly as there were too many logistical dependencies, and I couldn't find a way to make it work with a locked Android device.
• I considered setting up my own NextCloud (or similar) service...
  • I dismissed this because it was too much work from a security/maintenance standpoint, and would cost money to deploy
• Decided on Syncthing!

Syncthing

I found Syncthing while searching for Nextcloud/alternatives and initially dismissed it, but came back to it after dissatisfaction with NextCloud/alternatives.

Syncthing in a nutshell

• Encrypts all traffic by default
• Monitors folders registered to Syncthing
• Notifies relay when changes occur
• Registers remote devices by device-id
• Assigns devices to folders
• Detects changes via relay
• Connects directly to devices via a relay
• Uploads or downloads directly to remote devices

Installation on Fedora

sudo dnf install syncthing

Start the Fedora Instance

systemctl --user enable syncthing
systemctl --user start syncthing

Installation Android

• Install via the Google Play Store, link available here.

Get your Device IDs

Android

1. Open the app
2. Click on the ≡ and click Show Device ID record the ID

Fedora

1. Open localhost:8384 in your browser
2. Click Actions, then Show ID, record the ID

Configure Devices

Android

1. From the main screen click on the Devices tab, then on the ＋ in the top right
2. Input the Fedora system's Device ID and add a Name, tap ✔ to save

Fedora

1. Click the Add Remote Device button under the Remote Devices heading.
2. Input the Android Device ID and add a Name, then click Save

Adding Shared Folders

Android

1. From the main screen click on the Folders tab, then on the ＋ in the top right
2. Fill in the 🏷️ Folder Label, 🔑 Folder ID, and 📁 Directory. Remember your 🔑 Folder ID.
3. Tap to enable the slider for your Fedora device name.
4. Tap ✔ to save

Fedora

1. Under the Folders section, select Add Folder
2. Fill in Folder Label, Folder ID, and Folder Path, where Folder ID is the same as the 🔑 Folder ID on Android.
3. Click the Sharing tab, and add a ✔ to your Android device name.
4. Click Save

Once both devices configurations have been saved, I placed my kdb file in the Folder Path on my Fedora installation, and watched it synced to the opposite device within short order.

Notable Issues

• The .stfolder directory on my phone tends to be be deleted on restart causing an error. Creating an empty .stfolder in your sync directory seems to fix this.
• Modifying the same file from two different devices at the same time will result in conflicts. Conflicts result in a loss of the oldest of the two changes. ( the conflicting version still exists but is not automatically merged )

Conclusion

By switching to Keepass, and Syncthing I am able to securely sync my password database between my devices without ever storing it on a third-party server. If I could just figure out the issue with the .stfolder on android mysteriously disappearing I would be completely satisfied.

Please feel free to leave any questions or concerns in the comments!