Shared password manager for families?
34 points by icefox
34 points by icefox
Long story short, I need to have a bunch of shared accounts with family for finance and insurance and stuff, mostly for the sake of family members who are getting old and need help keeping things organized. So the requirements are:
I would just use 1Password, but recent events have demonstrated them as not exactly competent. I could always use KeepassXC and keep the file in a Google Drive folder, or maybe teach my siblings to use Syncthing, but that feels like extra steps we could do without. Anyone have any recommendations for how to do this well?
If you can selfhost I'd recommend looking at Vaultwarden. They support sharing credentials in groups and emergency access conditions, which have proved useful to me and my family in the past. The apps/integrations (Android, iOS, Browsers, Desktop, CLI) are provided by Bitwarden and they are available cross platform.
That's what I'm using right now, and it's great. I'm not switching away yet, but Bitwarden's recent license changes for their clients have made the hairs on the back of my neck stand up.
So far, it's not a pressing concern for me, but it's made me slightly less eager to recommend my setup to others. I hope they maintain the status quo.
Here's the license change details for those who, like me, missed it: https://community.bitwarden.com/t/published-version-update-in-app-stores/102750/7
Same boat here. So far I'm still happy with my setup but it feels like it's on borrowed time. There may be a point where a community fork is inevitable.
I have my hopes high with things like rbw already out there.
Ooh. rbw wasn't on my radar. I've never liked the official bitwarden cli, and that has stopped me from automating some things that I might otherwise do. I'm definitely going to try that one out, as it looks like it fixes my complaints about the official one.
I second vaultwarden, the bitwarden modules are useful & easy to understand (tested on android & firefox).
I'm using this,. The clients are open source but will need to be forked because the company who runs bitwarden have been acquired by a profit-seeking something or other.
I would just use 1Password, but recent events have demonstrated them as not exactly competent.
?
1password didn't fix clickjacking attack vulnerability (reported in April last year) over 4 months before disclosure (August last year) and it still wasn't fixed in January this year. I didn't take time to check whether it's still the case
That doesn’t seem like a big deal to me.
I'd say any known attack for a password manager is big HUGE, no matter the prerequisites
They also made a blog post boasting about how they would rewrite their core services using AI. This does not really inspire confidence tbh https://1password.com/blog/what-we-learned-using-ai-agents-to-refactor-a-monolith
If you are working with non technical family members, use 1password.
If you look for security perfection you will end up with a system nobody uses. Accept imperfect security because it will still be 1000x better than whatever their current system is today.
If you self host, what will happen when the server crashes while you are overseas and mum needs insurance details asap?
They also accidentally bundled prism.js and injected it into every web page. It was reported from their beta, but they only fixed it after a month or so.
Would simply Apple Passwords work? The sharing feature is great
I accepted to migrate my phone/laptop to Apple in order to simplify this type of situation around Apple tools for family, subscriptions and passwords sharing. The last part I am not convinced is regarding mail management. For now, everyone keeps their but I would like to have a shared set-up in the future.
I use KeepassXC with Syncthing for personal and team databases, the only downside of it is merge conflicts, but I'm not really worried about it as it doesn't happen often and syncthing keeps the conflict so i wont lose the data
Same. In case of a conflict it's usually even possible to import one of the conflicted databases into the other - duplicates get discarded, and then you have all entries in one.
Currently trying out ChiPass (a less vibey excuse me, consultant-written fork of XC). At least before XC finally made the switch to Qt6, Chi was even nicer to use, with fewer UI glitches on my system.
bitwarden
But the bigger challenge is sharing the second factor ( email token, phone token, passkey , 2fa ). And every app now has a unique process that is constantly changing. You can’t plan ahead of time
If you pay for Bitwarden, you can store TOTP codes in it, at least. If the email credentials are in the vault you can get email tokens too. SMS is the only one that would be troublesome.
You can but I have a few issues . One, it's a poor experience. Slow, hard to search , unpolished. Second, it's incomplete. And with authentication, the long tail is the most sensitive. A lock that works 85% of the time is still no good.
Bitwarden supports passkeys and 2fa codes, although I'm not sure what the sharing story looks like for those. That said, I've had trouble getting passkeys to work properly and consistently across browsers and operating systems - on Android and MacOS, the system key management system tends to want to take over, which means resorting back to TOTP.
(I'm not sure which features are free and which are paid for Bitwarden, but passkeys definitely seem to be free, and I think TOTP is as well these days. Plus there's always Vaultwarden which does it all for free if you self host.)
Another KeePass[DX|XC]+Syncthing user here, though I acknowledge the initial setup can be clunky and it could be a pain if you have a lot of people accessing the same database. You'd want Syncthing-Fork from F-Droid for your Android users and I'm less familiar with the iOS side. Nevertheless, it's worked great for my wife and me.
The side benefit is that Syncthing makes it so easy to sync and backup anything. Once you have it installed for one thing (like a password database) you'll find yourself using it for so much more. It's so easy to have multiple copies of your important data across devices without needing a central server or cloud account (but you can also easily have it running on a home machine as a central repository).
I'm happy with Proton Pass and it should check all your boxes, but it does require that everyone gets a Proton account
https://www.404media.co/manifestos-fear-and-loser-thinking-inside-protons-ai-reckoning/
Dunno about trusting that long term
If you use KeePass, make sure to use the remote storage integrations for it, that'll make sure that you get useful sync/merge behavior.
KeePass isn't just XC, there's also apps for both Android and iOS that have autofill integration, and that'll connect to a Google Drive or SFTP folder and do intelligent merging, as long as you use an integration so it knows that it's a remote folder, and not just a local folder that happens to be sync'd.
I can attest that I'm using KeePass (via Keepass2Android and OneKeyPass) for my partner and I, and it's working nicely against an SFTP folder, and my partner basically only had to switch from using 1password to using the KeePass apps.
If you use KeePass, make sure to use the remote storage integrations for it, that'll make sure that you get useful sync/merge behavior.
What I do is just stick it in Nextcloud and as long machines you're not using have the DB locked, it's pretty Just Works, as it syncs the files elsewhere. The remote stuff requires all the clients have the same specific protocols supported.
I mean, the main thing is to make sure that the vault is being merged by a keepass process, rather than one that can't see inside it, IMO
Enpass works great. Not open source but you can sync files via network, icloud etc, so no dependency on their servers
My family uses 1Password. Honestly, it's reduced a source of friction that I didn't even know was there before we moved to it.
Being able to change passwords without letting everyone know and being able to say "hey, can you share Utility Provider X in 1Password?" when someone forgets just makes things so easy. Not having to admin it myself is a key feature; If I get hit by a bus, I don't want our important info in a system that only I know how it's setup.
I know not many crustaceans use Apple’s password syncing, but it directly supports sharing passwords with other members of a family account, and I’ve never had a problem with it.
Shared Gmail account with Google Authenticator for 2FA with Chrome's native password manager.
I use Zoho vault which is included in my zoho basic subscription. It works on Linux, and macos, and android without issues for me. The UI is decent.
Keeping an eye on this one. I'm also using 1Password for a similar reason - a family with young members - but also have been meaning to investigate the self-hosted space.
If it was me doing this, I’d choose 1Password and try to avoid the hubris that I can do better (my background is infosec and so I’m well aware what I can do with self hosting it. I just don’t want to be the single bus factor on it)
Luckily, my reverse dependencies (aka parents) are relatively technical and they have their own password manager setup.
Evaluate what you want to spend time on.
1Password may misstep - I wouldn’t judge it as a pattern.