Keepassxc: Cloud sync

[zzserg]

Expected Behavior

Need sync with cloud storages, Dropbox, Google Drive, WebDAV, etc.

Current Behavior

none

[RealOrangeOne]

See #242. Likely Duplicate

[phoerious]

You can place your database file in your Dropbox/Google Drive/WebDAV folder. No need for a dedicated sync feature in KeePassXC:

[droidmonkey]

Perhaps this fact needs to be on our website / FAQ?

[louib]

@droidmonkey yep, maybe a new section in the FAQ Why is syncing to cloud storage not implemented?

[phoerious]

Done: https://keepassxc.org/docs#faq

[TheZ3ro]

I think it's good, but we will still receive Issue :smile:

[philledwards]

I've read the FAQ and understand your reasoning about not including cloud storage sync, but I believe the statement that it "can be easily accomplished by simply storing your KeePassXC database inside your shared cloud folder and letting your desktop synchronization client do the rest" is flawed.

That's just fine when you have admin access on your Windows PC, eg when you're at home. But what about when you're at work? In a corporate environment admin access is restricted to the IT team so you can't install any software that updates the registry which means you can't install cloud storage sync apps. That's why Keepass's plugin approach is so good, because it means plugins can do the sync'ing to a portable app version of Keepass .

Is there a way KeepassXC can handle the corporate PC admin issue?

[TheZ3ro]

From https://github.com/keepassxreboot/keepassxc/issues/49#issuecomment-301048723

The matter here is that we prefer not having such network code in the application so if you want to sync a file you need to use another specific client.

[phoerious]

We already have networking code in our application (with the option to compile without), so that's not such a big deal anymore. But it still adds quite a bit of complexity in a very sensitive area of the code.

[philledwards]

Thanks for the info phoerious. So if we download and install the current version it already has this feature? I assumed it wasn't available because of what I read in the FAQ,

[phoerious]

No. We do have networking code for KeePassHTTP and downloading favicons.
We do not have cloud sync built in.

[unai-ndz]

I think you should reconsider this feature, specially now considering the phoerious's commentary above. When I saw this project I got excited, open source, good cross platform (Not like keppass2 using mono), even native favicon donwloading. Just perfect except for this feature not implemented. Is a must have for me and keeping in mind the number of issues opened abut the subject I think that a lot of people wants this. I will check the project regularly looking for this feature.

[tkolo]

I'll also share my use case in case you guys reconsider.
I also use keepass at work. Fortunately unlike @philledwards I do have admin access there so I can install, in my case, nextcloud client and be happy with the result. In theory. There are two problems with this approach

1. Keepass is not the only thing I keep on my nextcloud drive. And nextcloud client will let me only sync entire folders, not single files (I imagnine other cloud clients work in a similar fashion). However I'd rather avoid downloading my personal files on my work PC. This can be workarounded by putting keepass database in a dedicated folder. It is what it is though - a workaround.
2. For convenience reasons I'd rather have nextcloud client remember my password. And this is problem number two - in case I change my job and forget to disconnect cloud client before I return my equipment, I can consider my cloud credentials leaked, because I bet it's stored either in plaintext or not too hard to reverse encryption. And cloud credentials are one of those things for which you'd rather have a password you remember because well, you need them to access keepass database for one. So they're not so easily changable. Keepass has this case solved very elegantly: you can tell it to download database from WebDAV, remember the password and then it'll store the password encrypted with _database master password_ (as far as I know). So it avoids the problem of one password leaked entirely, at least leaked in a persistent on-harddrive manner. There are always keyloggers, but there's only so much you can do to defend yourself.
   This can also be workarounded by using dedicated cloud account just for keepass. But this is even more a workaround than the one for the previous point.

[goetzc]

What about having a _post-save_ hook? This way it would be possible to call an external program to perform the sync/backup, like calling rsync, dropbox_uploader.sh, rclone, etc.

[droidmonkey]

@goetzc please see #1016

[snakyjake1]

How do I get all my devices to sync (Linux, Windows, iPhone, iPad)?
Please offer cloud sync within the app to simplify for the end user.

[droidmonkey]

Use any cloud service provider that you wish.