11–20 of 113 posts
I still think pass is the best password manager for Unix-like systems.
It lets me use multiple keys using GPG. It's simple and minimalistic. It allows for integration with 3rd party web GUIs you can expose on your home LAN and access with a VPN from your cellphone.
Why might I want to use this over something like pass ( https://www.passwordstore.org/ )?
So one of the main differences is that spicypass is setup-free. You just pick a master password and go. It achieves this by using symmetric encryption via the libsodium library. A nice side-effect of this is that backups are as simple as copying the .spicypass file to your backup device/server. With asymmetric encryption you have to worry about backing up your private keys in addition to the store file(s).
Another major difference is that it has an idle lock. Even if someone has root access to your machine and you leave it unattended while spicypass is running, they won't be able to see your passwords (assuming there's no keylogger involved).
There's also the minimalist aspect. pass has a lot of features that I personally don't need and consider to be bloat. I designed spicypass to my own personal specs: A very simple notepad-like interface, but secure. I figure I can't be the only one who thinks all the bells and whistles that most password managers have just get in the way.
Sometimes you don't want minimalist- you want to quickly find and visualise things. What I'd love is a Tui "curses" interface to keepassdb with quick vim like navigation. GUI is both too heavy and not too keyboard friendly. In fact, unless there's a specific (and specified) reason, all password managers should be based on the somewhat de facto standard of keepassdb
This is really cool, thanks for sharing! I personally use Bitwarden, also because it's free and open source software, and because the cloud managed option is $10 / year. I've found the GUI to be very well-made for a heavy keyboard user like me. I also second a curses-based terminal interface for password management, I think it'll be really useful!
Why might I want to use this over something like pass ( https://www.passwordstore.org/ )?
The benefit of Pass is it already has Chrome/Firefox plugins so all you need to do is press a keyboard shortcut and it automatically fills it in on the site. Given SpicyPass doesn't have that, I think I'll still be with Pass, because it's free and simply amazing.
It looks like you're storing an unsalted hash of the database's password in the plaintext header of the database itself. Is that correct? If so, this is a really really bad idea
>The string produced by crypto_pwhash_str() already includes an algorithm identifier, as well as all the parameters (including the automatically generated salt) that have been used to hash the password.
https://libsodium.gitbook.io/doc/password_hashing/default_ph...
Sometimes you don't want minimalist- you want to quickly find and visualise things. What I'd love is a Tui "curses" interface to keepassdb with quick vim like navigation. GUI is both too heavy and not too keyboard friendly. In fact, unless there's a specific (and specified) reason, all password managers should be based on the somewhat de facto standard of keepassdb
If I have a keyboard, then for a relatively small dataset, such as my saved passwords, I prefer a text file over any database. Lookup workflow: decrypt file (with, say, gpg), find what I want (with, say, grep), delete decrypted file. (Not safe if you don't use disk encryption!) Update workflow: decrypt file, edit file, encrypt file, commit encrypted file to local git repo, git push to backup storage.
This is really cool, thanks for sharing! I personally use Bitwarden, also because it's free and open source software, and because the cloud managed option is $10 / year. I've found the GUI to be very well-made for a heavy keyboard user like me. I also second a curses-based terminal interface for password management, I think it'll be really useful!
I honestly might just pay the $10/yr just to support them but bitwarden_rs is dead simple to deploy if you already have a VPS sitting around for other stuff.