Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: SpicyPass – A free and open-source minimalist password manager

github.com

Post reply on HN
Print view View original

21–30 of 113 posts

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#21

Post by doomrobo »

Jfreegman wrote: post #18
doomrobo wrote: post #15

It looks like you're storing an unsalted hash of the database's password in the plaintext header of the database itself. Is that correct? If so, this is a really really bad idea

According to the libsodium docs: >The string produced by crypto_pwhash_str() already includes an algorithm identifier, as well as all the parameters (including the automatically generated salt) that have been used to hash the password. https://libsodium.gitbook.io/doc/password_hashing/default_ph...

Aha, looks like it's using a salt and iterated hashing under the hood. Thanks for the link.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#22

Post by jkepler »

How would this compare with pass[1], the "standard UNIX password manager"? Is it simply that SpicyPass uses newer cryptography than pass?

Pass uses gpg along with the filesystem and git, so it is lightweight, and super-easy to backup offsite, as long as you guard your gpg keys separately. For those who want a GUI, QtPass[2] provides a simple GUI while using pass in the background.

[1] https://www.passwordstore.org/ [2] http://qtpass.org/

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#23

Post by gopiandcode »

Jfreegman wrote: post #13
p0llard wrote: post #4

Why might I want to use this over something like pass ( https://www.passwordstore.org/ )?

My motivation for writing spicypass was actually a frustrating struggle I once had trying to get pass to play nicely with my GPG installation. I decided it would be easier (and more fun) to write my own. So one of the main differences is that spicypass is setup-free. You just pick a master password and go. It achieves this by using symmetric encryption via the libsodium library. A nice side-effect of this is that bac…

I've also experienced some difficulties with getting pass to play nicely with gpg, but the hassle was definitely worth it. An integrated pass and gpg setup allows for a single consistent means of authenticating and comes with the idle timeouts that you mention.

When I want to push to a git repo and authenticate with my private key, I just run git push normally, and a pin-entry prompt comes up, and I just need to enter my master password. Similarly, when I want to use a stored password for logging into a website, I just click the passff extension and enter my master password into the pinentry program. It would seem like something like spicypass would just bloat my system, requiring multiple programs for authenticating in different ways.

I can understand the drive for minimalism, but I can't see any reasonable metric by which pass could be seen as bloated - it provides a small set of features that are important for a password store and nothing more.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#24

Post by karlicoss »

ultrafilter wrote: post #14
animalnewbie wrote: post #3

Sometimes you don't want minimalist- you want to quickly find and visualise things. What I'd love is a Tui "curses" interface to keepassdb with quick vim like navigation. GUI is both too heavy and not too keyboard friendly. In fact, unless there's a specific (and specified) reason, all password managers should be based on the somewhat de facto standard of keepassdb

If I have a keyboard, then for a relatively small dataset, such as my saved passwords, I prefer a text file over any database. Lookup workflow: decrypt file (with, say, gpg), find what I want (with, say, grep), delete decrypted file. (Not safe if you don't use disk encryption!) Update workflow: decrypt file, edit file, encrypt file, commit encrypted file to local git repo, git push to backup storage.

Perhaps of you pipe it into vim (i.e. | vim - ), it'd be somewhat safer and less manual work.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#26

Post by Jfreegman »

gopiandcode wrote: post #23
Jfreegman wrote: post #13

Earlier quoted context omitted.

My motivation for writing spicypass was actually a frustrating struggle I once had trying to get pass to play nicely with my GPG installation. I decided it would be easier (and more fun) to write my own. So one of the main differences is that spicypass is setup-free. You just pick a master password and go. It achieves this by using symmetric encryption via the libsodium library. A nice side-effect of this is that bac…

I've also experienced some difficulties with getting pass to play nicely with gpg, but the hassle was definitely worth it. An integrated pass and gpg setup allows for a single consistent means of authenticating and comes with the idle timeouts that you mention. When I want to push to a git repo and authenticate with my private key, I just run git push normally, and a pin-entry prompt comes up, and I just need to ente…

Often it just comes down to personal preference. A necessary feature to one person is bloat to another. Git integration for example is not something that meets my criteria for a necessary feature of a password store (think non-developers), although I can certainly understand why some people might love it.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#27

Post by daffy »

sdan wrote: post #6
p0llard wrote: post #4

Why might I want to use this over something like pass ( https://www.passwordstore.org/ )?

The benefit of Pass is it already has Chrome/Firefox plugins so all you need to do is press a keyboard shortcut and it automatically fills it in on the site. Given SpicyPass doesn't have that, I think I'll still be with Pass, because it's free and simply amazing.

There is also rofi-pass, which inserts data from pass into any X window.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#28

Post by Jfreegman »

sdan wrote: post #6
p0llard wrote: post #4

Why might I want to use this over something like pass ( https://www.passwordstore.org/ )?

The benefit of Pass is it already has Chrome/Firefox plugins so all you need to do is press a keyboard shortcut and it automatically fills it in on the site. Given SpicyPass doesn't have that, I think I'll still be with Pass, because it's free and simply amazing.

Third party browser extensions (and cloud syncing) are two things that, while convenient, create potential security holes. I opted for security over convenience with spicypass.

I absolutely understand why this might turn some people off, maybe even most people. But I know that there are people (like me) who want something that isn't connected to the cloud, and isn't going to inherit all of the security flaws of their browser.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#30

Post by dnpp123 »

jkepler wrote: post #22

How would this compare with pass[1], the "standard UNIX password manager"? Is it simply that SpicyPass uses newer cryptography than pass? Pass uses gpg along with the filesystem and git, so it is lightweight, and super-easy to backup offsite, as long as you guard your gpg keys separately. For those who want a GUI, QtPass[2] provides a simple GUI while using pass in the background. [1] https://www.passwordstore.org/ […

Yeah I don't see the advantages of this compared to `pass` as well.

The whole source code of bash pass [1] is almost as long as a single header file [2] from this C++ software. Plus pass already handles backup... Minimalist heh.

[1] https://git.zx2c4.com/password-store/tree/src/password-store...

[2] https://github.com/JFreegman/SpicyPass/blob/master/src/spicy...

Post reply on HN