Show HN: Passbox – Another password manager using Bash and GPG
1–10 of 34 posts
Re: Show HN: Passbox – Another password manager using Bash and GPG
#2Has anyone build a hash style password manager.
hash(website name + global password + increment) = password to use?
or something like it
Re: Show HN: Passbox – Another password manager using Bash and GPG
#3related:
pass - the standard unix password manager
Password management should be simple and follow Unix philosophy. With pass,
each password lives inside of a gpg encrypted file whose filename is the
title of the website or resource that requires the password. These encrypted
files may be organized into meaningful folder hierarchies, copied from
computer to computer, and, in general, manipulated using standard command
line file management utilities.
Re: Show HN: Passbox – Another password manager using Bash and GPG
#4Has anyone build a hash style password manager. hash(website name + global password + increment) = password to use? or something like it
Seems like everyone build this scheme. Seriously, there are many browser plugins and websites implementing it, and almost all of them ignore research (I'm guilty too). Also, most of them use fast hash functions instead of proper password hashes.
Here's a quick analysis of pros and cons of password generators compared to password managers: http://crypto.stackexchange.com/a/5691/291
I used a password generator (my own) for a few years, and I'm happy to use a password manager now, which is safer and makes me avoid keeping certain information in my mind (e.g. if I already have an account on this website and what's my username for it).
Re: Show HN: Passbox – Another password manager using Bash and GPG
#5Has anyone build a hash style password manager. hash(website name + global password + increment) = password to use? or something like it
Re: Show HN: Passbox – Another password manager using Bash and GPG
#6Has anyone build a hash style password manager. hash(website name + global password + increment) = password to use? or something like it
That's a very popular scheme.
The major downside is that site saying "your password must [not] contain blah-blah-blah"/"be N to M characters long"/"may contain only digits" when the generated one just happens to not conform to such restriction. In my personal experience, one out of dozen sites tries to be smartass about the passwords, so the scheme is a PITA in the long run.
Without the increment you also can't rotate password, while with the increment you need to store the increment value (and if you do keep the notes and the master secret, why not just remember the password already?)
The password managers are more flexible than password generators, because they don't have such limitations.
Re: Show HN: Passbox – Another password manager using Bash and GPG
#7related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…
Downside of pass is that the filenames are in the open. Thus, metadata (which sites you have account on) is not secured. Linked one seems to store everything in a single encrypted file.
Upside is that it has ton of implementations readily available - browser integration, mobile apps, etc. Linked one (passbox) is just a bash script at the moment, if one wants to use it across multiple devices and platforms, the experience may be quite rough.
Another upside is that with a single file model you have to invent your own conflict resolution scheme. For pass, git just does the trick. And this one doesn't seem to have anything in this regard.
Re: Show HN: Passbox – Another password manager using Bash and GPG
#8related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…
Good shout, I've added it to the 'Similar Projects' section of the readme.
I had a play with 'pass' before but i wasn't keen on the way it splits the entries up into separate files which was one of the drivers for putting passbox together.
Re: Show HN: Passbox – Another password manager using Bash and GPG
#9related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…
Downside of pass is that the filenames are in the open. Thus, metadata (which sites you have account on) is not secured. Linked one seems to store everything in a single encrypted file. Upside is that it has ton of implementations readily available - browser integration, mobile apps, etc. Linked one (passbox) is just a bash script at the moment, if one wants to use it across multiple devices and platforms, the experi…
...filenames are in the open.
Is this something that can't be fixed by directory perms?
Re: Show HN: Passbox – Another password manager using Bash and GPG
#10Earlier quoted context omitted.
Downside of pass is that the filenames are in the open. Thus, metadata (which sites you have account on) is not secured. Linked one seems to store everything in a single encrypted file. Upside is that it has ton of implementations readily available - browser integration, mobile apps, etc. Linked one (passbox) is just a bash script at the moment, if one wants to use it across multiple devices and platforms, the experi…
...filenames are in the open. Is this something that can't be fixed by directory perms?
If you trust the box.
That said, if you have a secure trusted machine with FDE that you don't let strangers touch, and where every piece of software is well-isolated (for example, web browser is sandboxed and can't access the ~/.password-store/), then yeah, filesystem permissions will do the trick.
But, for example, if you sync using git repo hosted on some third-party VPS then directory permissions won't protect you from that host owner or whoever gains superuser access to the filesystem.
(Hey, don't downvote the parent, he didn't said anything wrong, just asked a question! In my opinion that contributes to the discussion.)