Given that all password managers have issues, some more severe than others, I've started wondering what a system focused on cross-device sync and family/team sharing would look like if it were agnostic to what data it's storing, such that a password manager could be built as one application of many. Could such a foundation avoid needing any central servers, so nobody has to pay subscription fees that can get redirected to ethically dubious causes, while still being usable for people without a tech background? And how close is SyncThing to being that foundation?
9
Replies
3
Boosts
@jamey i would frickin' love an open-source password manager that works across the major client platforms and syncs peer-to-peer when you're in your home
and isn't a fricking bear for "normies" to operate
@brooke yeah! peer-to-peer is possible across NAT, even, as demonstrated by e.g. SyncThing, Tailscale, and WebRTC. in the worst case you need something like a TURN server. since that doesn't need to store anything or understand any app-specific protocol—it just forwards bytes—I feel like that's a reasonable expectation for baseline infrastructure. I guess those examples also all require a known server to rendezvous at in order to share connection parameters, which again is a much lower bar than needing somebody to reliably store your whole password database. so I feel like small efforts in these areas give us a solid foundation for a lot of things, and then people can focus on, for example, good password manager UX and platform integration
@jamey@toot.cat this may be of interest: https://www.etesync.com/
It's at least usable with my tasks app
@Filene @amy I was not familiar with Ouisync either, thanks for the pointer! I knew if I posted that toot I would learn things. 😁 I especially like that it supports "blind sharing", which allows you to share the encrypted data with people who are willing to store it for you without revealing the contents to them. so if you want to pay somebody a subscription fee to back up your data and make it always available, you have that option, or maybe you have friends who can do that for you, but it's a service many people can offer. on the other hand I don't immediately see how it addresses edit conflicts, which I think is one of the key questions for sync and sharing, though there are ways to layer conflict resolution on top of simple file sharing if necessary
@jamey@toot.cat ooh poo for some reason I thought it was open source. Sorry bout that
@amy it's intriguing, in any case! and they claim to support self-hosting and to have funding from NLnet so I would think it is indeed open source, but I didn't dig that carefully into it. I'm very curious how they're handling edit conflicts; I guess "etebase" is probably the thing I should look at. my only disappointment is that it is architected to require a central server, and if you don't want to pay them a subscription fee your only alternative is to self-host. but based on their FAQ it sounds like they've done more than I expected anybody to do at getting the privacy and security properties right for that configuration—I haven't seen anybody else address trusting a web server to serve you the right JavaScript if you use their web app—so props to them for that. thanks for the pointer!
@Filene @amy looks like it is free software, actually! it's just surprisingly difficult to find the GitHub link on their web site, you have to scroll past all the ways you can give them money first. but the server is AGPLv3, the client libraries are BSD, and the Android app is GPLv3, which all seem like very reasonable choices to me. https://github.com/etesync
