Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Passbox – Another password manager using Bash and GPG

github.com

Post reply on HN
Print view View original

11–20 of 34 posts

Re: Show HN: Passbox – Another password manager using Bash and GPG

#11

Post by reedlaw »

RobBollons wrote: post #8
sasvari wrote: post #3

related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…

Good shout, I've added it to the 'Similar Projects' section of the readme. I had a play with 'pass' before but i wasn't keen on the way it splits the entries up into separate files which was one of the drivers for putting passbox together.

Is there a way to share passwords with passbox? pass lets you encrypt different files with different keys so it could potentially be used within an organization with varying levels of permission. Another advantage is that each password is just an encrypted file that could be read with just GPG if pass isn't installed.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#12

Post by brillenfux »

UK-AL wrote: post #2

Has anyone build a hash style password manager. hash(website name + global password + increment) = password to use? or something like it

I had people tell me that this would have problems with entropy. I didn't fully understand that, though.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#13

Post by RobBollons »

reedlaw wrote: post #11
RobBollons wrote: post #8

Earlier quoted context omitted.

Good shout, I've added it to the 'Similar Projects' section of the readme. I had a play with 'pass' before but i wasn't keen on the way it splits the entries up into separate files which was one of the drivers for putting passbox together.

Is there a way to share passwords with passbox? pass lets you encrypt different files with different keys so it could potentially be used within an organization with varying levels of permission. Another advantage is that each password is just an encrypted file that could be read with just GPG if pass isn't installed.

Not really, i wanted this to just be a personal password manager and sharing passwords is mostly out of scope in that respect. Although there's nothing stopping you having multiple 'passbox.gpg' files of different names with different keys by manipulating the PASSBOX_LOCATION env variable within aliases or something like that.

You can still decrypt the file with just GPG if you wanted and modify the file in plain text. Passbox just acts as a layer on top of that to interrogate the encrypted GPG file.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#15

Post by AdmiralAsshat »

UK-AL wrote: post #2

Has anyone build a hash style password manager. hash(website name + global password + increment) = password to use? or something like it

I assume that the "increment" is so that you can hash the password again in case the password needs to be changed. But how do you tie the increment to that particular password? Otherwise your increment would have to be global, and if one of your passwords gets compromised you would have to hash all 200 others again simply in order to keep the increment consistent.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#16

Post by cornstalks »

How do you work with these terminal-based password managers? Request the password (à la `passbox get facebook`) and then copy 'n' paste it into the website?

Are there any security concerns of the password being in the clipboard/memory (beyond the obvious of accidentally pasting it)?

Re: Show HN: Passbox – Another password manager using Bash and GPG

#17

Post by RobBollons »

cornstalks wrote: post #16

How do you work with these terminal-based password managers? Request the password (à la `passbox get facebook`) and then copy 'n' paste it into the website? Are there any security concerns of the password being in the clipboard/memory (beyond the obvious of accidentally pasting it)?

That's definitely a way of using it, another is to just manually type it in as you see it and clear the terminal buffer afterwards. If you do use your clipboard it does require a certain amount of due diligence in making sure you empty it afterwards if you're concerned about that as a security risk. It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay.

It would be possible to construct an attack using Flash to access a users clipboard form a web browser.

I know a lot of people like to have browser plugins for password managers but i always feel uncomfortable using them because i don't understand enough about the technology to trust that it wont be vulnerable.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#18

Post by onionjake »

drdaeman wrote: post #6
UK-AL wrote: post #2

Has anyone build a hash style password manager. hash(website name + global password + increment) = password to use? or something like it

That's a very popular scheme. The major downside is that site saying "your password must [not] contain blah-blah-blah"/"be N to M characters long"/"may contain only digits" when the generated one just happens to not conform to such restriction. In my personal experience, one out of dozen sites tries to be smartass about the passwords, so the scheme is a PITA in the long run. Without the increment you also can't rotat…

I wrote my own hashing method [1] that given a correct spec for password restrictions would always generate a valid password. It does it by taking the hash in base64, then translating those a new set of base64 characters chosen to increase the likelihood of getting a valid password. If one generated is not valid, it then iterates until a valid one is found (by cycling the bits).

I have used this personally since I wrote it. Given the downsides, I agree that password managers are probably better for most people.

[1]: https://github.com/onionjake/doh

Re: Show HN: Passbox – Another password manager using Bash and GPG

#20

Post by sasvari »

RobBollons wrote: post #17
cornstalks wrote: post #16

How do you work with these terminal-based password managers? Request the password (à la `passbox get facebook`) and then copy 'n' paste it into the website? Are there any security concerns of the password being in the clipboard/memory (beyond the obvious of accidentally pasting it)?

That's definitely a way of using it, another is to just manually type it in as you see it and clear the terminal buffer afterwards. If you do use your clipboard it does require a certain amount of due diligence in making sure you empty it afterwards if you're concerned about that as a security risk. It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard aft…

It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay.

pass [0] (see comment above [1]) claims to do that:

  show [ --clip, -c ] pass-name
       Decrypt and print a password named pass-name. If --clip or -c is specified,
       do not print the password but instead copy the first line to the clipboard
       using xclip(1) and then restore the clip‐board after 45 (or
       PASSWORD_STORE_CLIP_TIME) seconds.
[0] http://www.passwordstore.org/

[1] https://news.ycombinator.com/item?id=10190719

Post reply on HN