Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Passbox – Another password manager using Bash and GPG

github.com

Post reply on HN
Print view View original

21–30 of 34 posts

Re: Show HN: Passbox – Another password manager using Bash and GPG

#21

Post by fensipens »

sasvari wrote: post #3

related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…

the standard unix password manager

Annoying amount of hubris.

This pile of unattractive bash-snippets is neither unix nor standard. Just call it what it is: A very dependent script that will probably work on most GNU/Linux distributions.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#22

Post by klapinat0r »

sasvari wrote: post #3

related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…

I've been using pass since mitro.co announced their shutdown.

The only (somewhat big) downside to this, and related unix pw managers is the sheer lack of browser compatibility - mobile would also be nice, as that's one of the places where it's a PITA to use and enter long passphrases.

pass claims to have both, but doesn't:

https://github.com/jvenant/passff#readme does not work.

The iOS app has disappeared from github: https://github.com/rephorm/pass-ios#readme

It's solvable problems, I just find it a somewhat important part of a password manager.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#23

Post by RobBollons »

sasvari wrote: post #20
RobBollons wrote: post #17

Earlier quoted context omitted.

That's definitely a way of using it, another is to just manually type it in as you see it and clear the terminal buffer afterwards. If you do use your clipboard it does require a certain amount of due diligence in making sure you empty it afterwards if you're concerned about that as a security risk. It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard aft…

It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay. pass [0] (see comment above [1]) claims to do that: show [ --clip, -c ] pass-name Decrypt and print a password named pass-name. If --clip or -c is specified, do not print the password but instead copy the first line to the clipboard using xclip(1) and then restore the clip‐board afte…

Clipboard integration probably isn't something i would look to add to passbox myself, but if someone can find a way to get it to work nicely cross platform and submit a PR then i would likely merge it.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#24

Post by bradleyjg »

UK-AL wrote: post #2

Has anyone build a hash style password manager. hash(website name + global password + increment) = password to use? or something like it

This has similar security properties to a salted password based key derivation scheme. Given the output, and assuming a function with effective preimage resistance, the best way to find the global password is brute force it by trying lots of master passwords. The security is a function of the forward difficulty of the KDF (in space and time) and the quality of the master password. Use the password 'password' and MD5 and you don't have much security except through obscurity. Use an 8 word diceware password and scypt and you are doing great security wise (assuming of course no implementation problems, a big assumption!)

Re: Show HN: Passbox – Another password manager using Bash and GPG

#25

Post by RobBollons »

klapinat0r wrote: post #22
sasvari wrote: post #3

related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…

I've been using pass since mitro.co announced their shutdown. The only (somewhat big) downside to this, and related unix pw managers is the sheer lack of browser compatibility - mobile would also be nice, as that's one of the places where it's a PITA to use and enter long passphrases. pass claims to have both, but doesn't: https://github.com/jvenant/passff#readme does not work. The iOS app has disappeared from github…

I suppose it just depends what you look for in a password manager. I tried lots of solutions from Last Pass, KeepassX to pass but i prefer the scriptability and portability of a command line based password manager and i'm not overly bothered about mobile and browser.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#26

Post by klapinat0r »

RobBollons wrote: post #25
klapinat0r wrote: post #22

Earlier quoted context omitted.

I've been using pass since mitro.co announced their shutdown. The only (somewhat big) downside to this, and related unix pw managers is the sheer lack of browser compatibility - mobile would also be nice, as that's one of the places where it's a PITA to use and enter long passphrases. pass claims to have both, but doesn't: https://github.com/jvenant/passff#readme does not work. The iOS app has disappeared from github…

I suppose it just depends what you look for in a password manager. I tried lots of solutions from Last Pass, KeepassX to pass but i prefer the scriptability and portability of a command line based password manager and i'm not overly bothered about mobile and browser.

You're right, and don't take this as a challenge, I'm honestly wondering:

How come you aren't bothered? I ask because I can't image apart from:

a. I use short or cryptically unsafe passphrases,

b. I use passphrases and type them easily,

c. I only need to log in a few times.

Am I forgetting others?

Re: Show HN: Passbox – Another password manager using Bash and GPG

#27

Post by ape4 »

drdaeman wrote: post #7
sasvari wrote: post #3

related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…

Downside of pass is that the filenames are in the open. Thus, metadata (which sites you have account on) is not secured. Linked one seems to store everything in a single encrypted file. Upside is that it has ton of implementations readily available - browser integration, mobile apps, etc. Linked one (passbox) is just a bash script at the moment, if one wants to use it across multiple devices and platforms, the experi…

I agree. Perhaps a zip file with a password?

Re: Show HN: Passbox – Another password manager using Bash and GPG

#28

Post by teh »

klapinat0r wrote: post #22
sasvari wrote: post #3

related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…

I've been using pass since mitro.co announced their shutdown. The only (somewhat big) downside to this, and related unix pw managers is the sheer lack of browser compatibility - mobile would also be nice, as that's one of the places where it's a PITA to use and enter long passphrases. pass claims to have both, but doesn't: https://github.com/jvenant/passff#readme does not work. The iOS app has disappeared from github…

I'm running a small agency with two friends and we're keeping mitro alive (and better: are fixing issues) here: https://passopolis.com/

Firefox and Chrome extensions are working, and I'm currently spending a few hours a week on migrating to the new Firefox-extension protocol.

Re: Show HN: Passbox – Another password manager using Bash and GPG

#30

Post by deathanatos »

drdaeman wrote: post #7
sasvari wrote: post #3

related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard comman…

Downside of pass is that the filenames are in the open. Thus, metadata (which sites you have account on) is not secured. Linked one seems to store everything in a single encrypted file. Upside is that it has ton of implementations readily available - browser integration, mobile apps, etc. Linked one (passbox) is just a bash script at the moment, if one wants to use it across multiple devices and platforms, the experi…

> Downside of pass is that the filenames are in the open.

The "entry" names (which I think would correspond to filenames in `pass`) appear to be passed on the command line here; they'll likely get swept up in your shell's history file, unless you're careful. (And thus, are essentially in the open, just like pass.) That said, I think most shells make their histfiles 600, so they're not directly readable. (And I think `pass`'s directory is 700, similarly.) And you have to trust the machine you're running on, of course; otherwise, I can just dump the memory as soon as your keyring is decrypted.

I think it was when `pass` was on HN that I mentioned this; I have a terminal keyring manager myself[1], but one of the design decisions I made in it (aside from a single-file archive) was to not pass entry names on the command line, specifically so they won't get swept up in histfiles. It's easy, though, it make it optional, and let the user decide what they want to do. Of course, your

[1] which is way not ready to be looked at… also seems like we as a crowd enjoy this topic (keyrings) as a side project.

Post reply on HN