Show HN: Manage passwords with GPG • Hacker News Board

Re: Show HN: Manage passwords with GPG

#31

Post by uxcn » Thu, Jul 02, 2015, 8:44 PM UTC

raldu wrote: post #22

nmrm2 wrote: post #4

http://www.passwordstore.org/ is a similar solution, and I prefer it to this solution for a few reasons: * git integration. * Separate file for each secret, so that I can store the password on the first line and then other sensitive account details on subsequent lines. * -c flag for copying passwords to clipboard (but only copies the first line of the file, so it doesn't interfere with the usecase above) * tab comple…

This nice solution is minimal, well scripted and very UNIXy. However, one tradeoff is that filenames for the stored password are plain. Running the tree command on the directory where encrypted files are stored would give us something like, $ tree .password-store irc ├── efnet └── freenode

You can avoid a lot of these types of issues using a digest for the username and password plus a master key as a salt. It generates a unique and relatively complex sequence for each site and doesn't require any persistent state other than the salt.

The downside is a lack of control over complexity and the issue of passwords being strictly dependent on the salt. So, if one set of credentials is compromised, you would need update them all.

I've seen software that does this, but there are subtle details to consider to actually get it correct.

Re: Show HN: Manage passwords with GPG

#32

Post by vdfs » Thu, Jul 02, 2015, 9:05 PM UTC

An other solution to manage password in one file using GPG encryption: https://github.com/boussouira/bash-pass

Re: Show HN: Manage passwords with GPG

#33

Post by tbe » Thu, Jul 02, 2015, 9:39 PM UTC

raldu wrote: post #22

nmrm2 wrote: post #4

http://www.passwordstore.org/ is a similar solution, and I prefer it to this solution for a few reasons: * git integration. * Separate file for each secret, so that I can store the password on the first line and then other sensitive account details on subsequent lines. * -c flag for copying passwords to clipboard (but only copies the first line of the file, so it doesn't interfere with the usecase above) * tab comple…

This nice solution is minimal, well scripted and very UNIXy. However, one tradeoff is that filenames for the stored password are plain. Running the tree command on the directory where encrypted files are stored would give us something like, $ tree .password-store irc ├── efnet └── freenode

For this reason I'm thinking of switching from gpg to encfs. It has an option for auto-unmounting after a period of unactivity. It would also play well with programs that need to read password from a file.

Has anyone else here had the same thought? This guy seems to at least;

https://github.com/equivrel/password-store-encfs/blob/master...

Edit: spelling

Re: Show HN: Manage passwords with GPG

#34

Post by ufo » Thu, Jul 02, 2015, 9:46 PM UTC

Does anyone know if there is a way to make something equivalent to this but using GPG's symmetric crypto instead of public crypto? This way you don't need to carry a key file around with you, just the encrypted secrets.

Re: Show HN: Manage passwords with GPG

#35

Post by noondip » Thu, Jul 02, 2015, 10:03 PM UTC

ufo wrote: post #34

Does anyone know if there is a way to make something equivalent to this but using GPG's symmetric crypto instead of public crypto? This way you don't need to carry a key file around with you, just the encrypted secrets.

This is a great point. The advantage I see to using pubkey is integration with, for example, a cryptocard (https://trmm.net/Yubikey). Still, I wonder if the default should be to use gpg --symmetric instead.

Re: Show HN: Manage passwords with GPG

#36

Post by ufo » Thu, Jul 02, 2015, 10:58 PM UTC

noondip wrote: post #35

ufo wrote: post #34

Does anyone know if there is a way to make something equivalent to this but using GPG's symmetric crypto instead of public crypto? This way you don't need to carry a key file around with you, just the encrypted secrets.

This is a great point. The advantage I see to using pubkey is integration with, for example, a cryptocard ( https://trmm.net/Yubikey ). Still, I wonder if the default should be to use gpg --symmetric instead.

The reason I asked that is because last time I messed around in this problem space I had some trouble making gpg-agent remember the password for symmetrically-encrypted stuff.

Re: Show HN: Manage passwords with GPG

#37

Post by bruo » Thu, Jul 02, 2015, 11:35 PM UTC

DDub wrote: post #23

davej wrote: post #15

Earlier quoted context omitted.

These tools really need a browser plugin for them to be useful to me.

Has anyone tried using these? - https://github.com/gustaebel/passext (Chrome) or - https://github.com/jvenant/passff (firefox)

I use passff a lot of times everyday. I can't complaint :)

Re: Show HN: Manage passwords with GPG

#38

Post by k2enemy » Fri, Jul 03, 2015, 12:40 AM UTC

davej wrote: post #15

nmrm2 wrote: post #4

http://www.passwordstore.org/ is a similar solution, and I prefer it to this solution for a few reasons: * git integration. * Separate file for each secret, so that I can store the password on the first line and then other sensitive account details on subsequent lines. * -c flag for copying passwords to clipboard (but only copies the first line of the file, so it doesn't interfere with the usecase above) * tab comple…

These tools really need a browser plugin for them to be useful to me.

For Safari (and Chrome) I made a little automator service that gets the url from the browser, strips the hostname, then feeds that into a shell script that calls pass and puts the password in the clipboard for 45 seconds.

It actually works better (for me) than 1password which was always a little flaky at recognizing a website after any kind of site update.

Re: Show HN: Manage passwords with GPG

#39

Post by k2enemy » Fri, Jul 03, 2015, 12:43 AM UTC

jrcii wrote: post #5

nmrm2 wrote: post #4

http://www.passwordstore.org/ is a similar solution, and I prefer it to this solution for a few reasons: * git integration. * Separate file for each secret, so that I can store the password on the first line and then other sensitive account details on subsequent lines. * -c flag for copying passwords to clipboard (but only copies the first line of the file, so it doesn't interfere with the usecase above) * tab comple…

It would be nice if there were a way to integrate it with the OS X keychain, unfortunately I haven't gotten around to it and I haven't been able to find anyone who has done this already since it's tricky to google.

I'm not sure exactly what you mean by "integrate," but you can have gpg-pinentry use keychain to remember your gpg passphrase for pass.

Re: Show HN: Manage passwords with GPG

#40

Post by asimilator » Fri, Jul 03, 2015, 1:21 AM UTC

davej wrote: post #15

nmrm2 wrote: post #4

http://www.passwordstore.org/ is a similar solution, and I prefer it to this solution for a few reasons: * git integration. * Separate file for each secret, so that I can store the password on the first line and then other sensitive account details on subsequent lines. * -c flag for copying passwords to clipboard (but only copies the first line of the file, so it doesn't interfere with the usecase above) * tab comple…

These tools really need a browser plugin for them to be useful to me.

passwordstore just (with my distro) starting shipping a dmenu (http://tools.suckless.org/dmenu/) script that I think is great, and personally removes the need for a browser extension. Unfortunately only available on linux.