Realistically, I only see 3 risks using Keeper: my device has malware which lets them grab my passwords from my clipboard as I copy them, malware that lets them take control of my device after I’ve unlocked my password manager, or if the cloud storage is completely wiped out in some freak accident.

1 and 2 are risks for anyone using any password manager. And 3 is extremely unlikely since they use AWS for storage wirh multi-zone and multi-region redundancy, and certainly much more reliable than self hosting.

The risk of actually having your passwords cracked, even if the cloud data is leaked, is practically 0 as long as you have a decent complexity and length master password and 2FA enabled. And the risk is just as low with a MITM attack or other network based interceptors because of the ZK architecture (as you mentioned) and high encryption used.

Anyone promoting other password managers as more secure either aren’t considering the risks to data loss due to self hosting or are buying too much into their password manager’s marketing. I think it’s totally reasonable to prefer other options due to feature support or subscription price though. A couple of features that Keeper had that made me choose it were:

• Ability to create Records which allows me to store anything including files. This allows me to upload sensitive records like tax returns or other documents you’d traditionally keep in a safe or filing cabinet.
• Family plan that makes it easy for me to share passwords with people on my plan (great for things like streaming services). This brought the price to a reasonable level.

There might be other password managers now that support these features, as I haven’t kept up with them. I subscribed to Keeper about 6 years ago and haven’t had a reason to switch. I’m open to suggestions if people know of other managers with better features.

Bitwarden offer the option to set up an emergency contact.

You choose someone to be an emergency contact, it means that if they want they can request access to view your passwords.

When they send a request you receive several emails to warn you and after X (you can choose the amount) days if you don’t do anything they get access to your account.

Using let’s encrypt is a lot easier to deal with on the client side than modifying CAs, although the initial set up of the server can be a pain in the ass if you’re new to it.

“But, thinking about it now, I doubt it will actually affect the feature”

It will not

We don’t need to import a custom CA authority here just to insatll a client cert

It’s encrypted at rest with a passphrase. Syncthing encrypts it at transit with a random key.

There is a huge difference on the security of those.

DNS-01 challenge allows for domain ownership verification without open ports and instead looks for a txt record. Using a tool like lego[1] with the respective dns provider’s API automatically creates and deletes the txt record after generating a certificate.

Because ownership is verified by dns txt entry, the (sub-)domain doesn’t have to point to a publicly routable host. This allows for using any IP, so I’m using a local ip only available through wireguard or my local network (E.g. bitwarden.example.com points to 192.168.1.123).

The disadvantage is that the provider has to be supported and you have to store an API key for your domain on the server.

[1] https://github.com/go-acme/lego

Not the one who wrote initially, but i have the same setup (mostly).
I went with a self signed certificate. So the server is running with a certificate i have signed with my own certification authority certificate (ca-cert) .
That means I have to install the ca-cert on all devices to get vaultwarden to accept it.

The alternative is a let’s encrypt cerrtificate, which are free, but you need to open port 80 (and another one if I remember correctly) for it to work (at least every 3 months)

I memorize the random generated ones, you type it in enough it becomes muscle memory.

It is just how I prefer to do my computing. I tend to live on the command line and pipe programs together to get complex behavior. If you don’t like that, then my approach is not for you and that’s fine. As for your analogy, I see it more as “instead of driving down the road in a car, I like to put my own car together using prefabs”.

I have a set up like this (age, passage, & git). Bitwarden’s browser integration works just fine, for the most part. The thing is, some of my passwords are not browser-based, and I spend large amounts of time in the terminal. Using a CLI-tool in this case lets me save a bit of time