Really?
This is literally where LLMs have probably the most advantageous use with practically no downsides. Their devs aren’t idiots that are suddenly vibe coding. Using an LLM can be an invaluable tool.
Linux already has merged code that had some form of LLM input years ago.
It’s not about whether or not you’re using an LLM as part of your work process, its more about whether or not you’re submitting shitty code.
Even if you want an alternative for this reason, I can probably bet you that several PRs in Vaultwarden were probably looked over by someone’s Claude chat while they were writing and testing it, or straight up took generated code and edited to their needs.
Hell I’d even bet Lemmy has PRs that have been touched by LLMs.
But muh purity!
keepassxc
Would recommend VaultWarden
You’re going to have to stop using all software in the next five years or so if you want to keep up the LLM boycott.
Hopefully people who care will start (and for those that already are, continue) to contribute to open software projects that don’t include this shit.
Seriously can it stop. I just switched to BW.
Faaaaackkkkkkk
Ugh I really didn’t want to migrate password managers again 🤦♀️
Goddam it wtf
I was looking into vault warden, an open source bit warden compatible system
SyncThing + KeePass, I’ve been using this setup for a long time. Requires setup and isn’t automagically done for you, but you control everything about it + it’s decentralized and local. I unfortunately don’t have any good guides off-hand, but I can try to give some pointers if you’re interested to know more about it.
On Linux, the only downside is you can’t use the auto-type feature in Wayland, but there are browser plugins to make it less of an issue.
Alternatively, if you are a self-hoster, you can still use the BitWarden local clients with an open source backend server that you control: https://github.com/dani-garcia/vaultwarden
KeyPass had a breach that exposed people’s master passwords to attackers.
It’s worse than Bitwarden
KeePass is an open source application, and that was patched as soon as it was found. Nothing will be 100% resistant to attacks, and you don’t have to make your kdbx available online at all which mitigates that attack entirely. What matters is how the maintainers react.
Calling a local FOSS app worse than a privately owned and centralized SaaS is hilarious.
As a regular user they allowed my master pass to be leaked. So i started using another password manager that didn’t do that.
Regular users don’t host their own password manager apps usually.
Explain to me how someone ‘allows’ leaking a password that is used locally on the user’s machine in an app that only connects to the web to download website icons.
The way password managers work is you sign up and use their app to store passwords.
Explain to me how a regular user signing up for this service is jumping through the hoops of self hosting.
KeePass is a local app, dummy. It doesn’t use any ‘service’.
I have bad news for you https://www.malwarebytes.com/blog/news/2025/08/clickjack-attack-steals-password-managers-secrets
Yeah password managers are just insecure
You don’t host anything with KeePass, it’s an application that you install. People use this type of software literally every single day. I’m not sure where you get your information from. There was no “leak”, it was an attack that someone could execute if they had access to your physical machine and only used a master password without a keyfile. If someone didn’t have that, they don’t have your master password, because it doesn’t go to the cloud at all. It’s all entirely local. Stop handing out misinformation like candy.
edit: the actual CVE: https://nvd.nist.gov/vuln/detail/CVE-2023-32784
Vulnerabilities happen, end of story. Like I said, what matters is the maintainers’ reaction and how open they are about the details. If you rely on other people/developers to handle your OpSec for you, then you shouldn’t be using computers at all and are putting yourself at risk no matter what software you use.
And if this is your litmus test, then holy shit do I have some bad news for you about iOS/Android/Linux/Windows/macOS/literally any web browser… and I guarantee that whatever you use now for your password manager has it’s own share of issues regarding security, which again points back to taking care of your own OpSec instead of relying on others.
Expect shit to hit the fan, and you’ll always be prepared when it does.
Hm, neat. Thanks for the cve ref. Seems KeePassXC was unaffected.
Issue was residue of typed characters left in memory (managed by .NET). This means the attacker needs to be able to dump memory and search it. If they can do that on your machine, you have other problems. They could probably just keylog you to the same effect with that level of access (on x11 anyways).
I can’t find anything regarding KeePass’s stance on AI submissions.
Vaultwarden’s maintainer doesn’t seem to be averse to LLM contributions based on this, right?
At least getting Copilot to review stuff makes sense if it catches something that people miss, or just to catch more-obvious stuff before having a final review by the project owner.
Fucking tools. Was gonna use Bitwarden but fuck that noise
Came across this the other day and considered setting it up to replace Vaultwarden. Definitely need to sit down and do that now, a vibe coded password manager sounds like an absolute fucking nightmare.
