Got a burning question about open source or the kernel? Whatever your level, email it to lxf.answers@futurenet.com

Q Secrecy without conflict

I use KeePass on my phone, laptop and desktop. I also use Syncthing to sync the database among the three devices.

Syncthing creates “conflict backup files” of the KeePass database when data is updated on more than one device. I’m looking for a solution, either a way for Syncthing to not generate these files or an alternative method of keeping the same password database on all devices. Is there a tool that will enable me to verify and combine both KeePass database files (since it’s encrypted)?

Jordan Welch

A We went through the same ourselves and tried several solutions. The problem with Syncthing is that it is, by its nature, non-interactive. When faced with a conflict it can’t ask what to do. It either makes a decision (possibly picking the wrong file), or saves both sets of data.

Our first approach was to store the KeePass database on Dropbox, so each application was working with the same file. It doesn’t avoid the problem of two programs writing different versions of the same file, but with KeePass, that only means you may occasionally miss saving some data. Because KeePass is read a lot more often than written, this was a minor inconvenience. Even though the database file is encrypted, we weren’t comfortable leaving it on a remote server, so we switched to using NextCloud (https:// nextcloud.com) to give basically the same effect as using Dropbox, but self-hosted.

However, we then found another password storage solution: Bitwarden (https://bitwarden.com). Bitwarden is like LastPass, but open source. There are browser plugins for Firefox and Chrome as well as desktop and mobile clients. The database is hosted on Bitwarden’s servers by default, but it doesn’t have to be. Bitwarden is open source, you can run the server yourself.

Unlike NextCloud, where you have to have a web server to host it, Bitwarden is available as a Docker image that you can run locally. You just need to open the relevant port on your router if you want to give yourself access from outside. The database contents are protected by a passphrase, but the database itself isn’t accessible from outside. As a bonus, you can import your KeePass database directly, making the transition simple.