Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: SpicyPass – A free and open-source minimalist password manager

github.com

Post reply on HN
Print view View original

61–70 of 113 posts

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#61

Post by Jfreegman »

dnpp123 wrote: post #30
jkepler wrote: post #22

How would this compare with pass[1], the "standard UNIX password manager"? Is it simply that SpicyPass uses newer cryptography than pass? Pass uses gpg along with the filesystem and git, so it is lightweight, and super-easy to backup offsite, as long as you guard your gpg keys separately. For those who want a GUI, QtPass[2] provides a simple GUI while using pass in the background. [1] https://www.passwordstore.org/ […

Yeah I don't see the advantages of this compared to `pass` as well. The whole source code of bash pass [1] is almost as long as a single header file [2] from this C++ software. Plus pass already handles backup... Minimalist heh. [1] https://git.zx2c4.com/password-store/tree/src/password-store... [2] https://github.com/JFreegman/SpicyPass/blob/master/src/spicy...

The pass source code you linked to is just a wrapper for the unix toolset (and has twice the byte count, not that it matters). Pass has a completely different crypto implementation and security model than SpicyPass. The two are not synonymous, either in features or UX. I elaborated on more of the differences between the two in a different reply to a similar comment.

tl;dr different strokes for different folks. I didn't write spicypass with the intent of replacing pass.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#62

Post by woadwarrior01 »

threentaway wrote: post #56
woadwarrior01 wrote: post #54

I switched from 1Password to pass with my gpg private key sitting on a Yubikey (with backup keys). I don’t think anything else comes close to this setup in terms of security.

1Password with WebAuthn 2FA is probably better (harder for generic malware to steal), and leagues more convenient.

Not true. The solution I described would survive a local machine compromise (the GPG key is maintained on the Yubikey), the 1Password based solution won’t. How could generic malware steal secrets that are not even on the device? Furthermore, pass encrypts each password separately (I.e GPG generates a new symmetric key for each password). In case of 1password, if the master password is compromised, it’s game over.

Also, I was a long time 1password user, switched to my current setup after 1Password moved to the rent-seeking subscription business model with 1Password 7.

In terms of convenience, it’s even more convenient than using 1Password. The only minor hitch is having to key in the PIN for the Yubikey if I haven’t used it for a bit.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#63

Post by tjoff »

jkepler wrote: post #22

How would this compare with pass[1], the "standard UNIX password manager"? Is it simply that SpicyPass uses newer cryptography than pass? Pass uses gpg along with the filesystem and git, so it is lightweight, and super-easy to backup offsite, as long as you guard your gpg keys separately. For those who want a GUI, QtPass[2] provides a simple GUI while using pass in the background. [1] https://www.passwordstore.org/ […

I find pass quite hard to follow and grok what it is doing and what assumptions or consequences of using it are.

And for the life of me I can not get it to prompt for the password in the terminal, which is infuriating.

First glance of SpicyPass looks promising in my eyes.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#64

Post by cycomanic »

I am surprised that keepassxc does not get suggested more often. Uses the probably most common file format, has support for uibikeys, ssh agent and secret service (can act as gnome-keyring/KDE wallet substitute).

Those features make it the best password manager for me

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#65

Post by woile »

jkepler wrote: post #22

How would this compare with pass[1], the "standard UNIX password manager"? Is it simply that SpicyPass uses newer cryptography than pass? Pass uses gpg along with the filesystem and git, so it is lightweight, and super-easy to backup offsite, as long as you guard your gpg keys separately. For those who want a GUI, QtPass[2] provides a simple GUI while using pass in the background. [1] https://www.passwordstore.org/ […

I remember reading somewhere that Pass could be used with libsodium (or age), but I cannot find the source now, sorry.

One difference I see between this and pass is that spicypass is storing all the credentials in a single file. If you don't want to leak metadata with pass you have to add pass-tomb[1].

Anyway I just use pass (gopass actually) and I have no problems, it's a great improvement over a text editor.

[1] https://github.com/roddhjav/pass-tomb

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#66

Post by woile »

tjoff wrote: post #63
jkepler wrote: post #22

How would this compare with pass[1], the "standard UNIX password manager"? Is it simply that SpicyPass uses newer cryptography than pass? Pass uses gpg along with the filesystem and git, so it is lightweight, and super-easy to backup offsite, as long as you guard your gpg keys separately. For those who want a GUI, QtPass[2] provides a simple GUI while using pass in the background. [1] https://www.passwordstore.org/ […

I find pass quite hard to follow and grok what it is doing and what assumptions or consequences of using it are. And for the life of me I can not get it to prompt for the password in the terminal, which is infuriating. First glance of SpicyPass looks promising in my eyes.

Hey, for me it took me a while to understand it as well, so I created a cheatsheet[1] and a tutorial[2] (shameless plug). Maybe they are helpful to you.

[1] https://woile.github.io/gopass-cheat-sheet/

[2] http://woile.github.io/posts/sharing-team-secrets/

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#67

Post by xfitm3 »

brachi wrote: post #45
jkepler wrote: post #22

How would this compare with pass[1], the "standard UNIX password manager"? Is it simply that SpicyPass uses newer cryptography than pass? Pass uses gpg along with the filesystem and git, so it is lightweight, and super-easy to backup offsite, as long as you guard your gpg keys separately. For those who want a GUI, QtPass[2] provides a simple GUI while using pass in the background. [1] https://www.passwordstore.org/ […

I'm pretty satisfied with the minimalism of pass, and thought of asking this question. The documentation is also pretty good.

pass is great. sops by Mozilla is pretty sweet too.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#68

Post by gingerlime »

yingw787 wrote: post #9

This is really cool, thanks for sharing! I personally use Bitwarden, also because it's free and open source software, and because the cloud managed option is $10 / year. I've found the GUI to be very well-made for a heavy keyboard user like me. I also second a curses-based terminal interface for password management, I think it'll be really useful!

> I also second a curses-based terminal interface for password management, I think it'll be really useful!

Bitwarden also has a CLI, so it's probably do-able to create something like this.

I built envwarden[0] on top of the CLI, which lets us manage our server secrets with Bitwarden.

[0] https://github.com/envwarden/envwarden

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#69

Post by tleb_ »

Why does the string random_password(unsigned int size) function have "no duplicate characters" as a requirement? Seems to me that this would only reduce the entropy; what does it bring?

I need access to passwords from my phone so I'll stick with KeePassXC, but nice project! This makes me want to play around with lib-sodium, the API looks nice.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#70

Post by exhilaration »

sethammons wrote: post #50
yingw787 wrote: post #9

This is really cool, thanks for sharing! I personally use Bitwarden, also because it's free and open source software, and because the cloud managed option is $10 / year. I've found the GUI to be very well-made for a heavy keyboard user like me. I also second a curses-based terminal interface for password management, I think it'll be really useful!

I use bitwarden too, but I can't figure out how to get the cert to automatically update. I have port 443 served by Caddy2 and use that as a reverse proxy to Bitwarden, but Bitwarden wants to bind to 443 to update the cert. So, for now, it is a case of manually stopping Caddy, updating Bitwarden, and starting Caddy back up. The downtime is only acceptable because I only host personal stuff.

Here's what worked for me:

Run the bitwardenrs container without SSL:

sudo docker pull bitwardenrs/server:raspberry

sudo docker run -d --name bitwarden --restart always -e ADMIN_TOKEN=your_admin_token -v /bw-data/:/data/ -p 80:80 bitwardenrs/server:raspberry

Proxy through Caddy (note that I'm using DuckDNS for DNS):

curl https://getcaddy.com | bash -s personal tls.dns.duckdns

nohup caddy -http-port 999 -conf /etc/caddy/Caddyfile -envfile /etc/caddy/CaddyEnvFile -agree -email YOUR_EMAIL@gmail.com &

(the port 999 is because we've already got docker container running on port 80)

Follow the examples here for the configuration: https://github.com/dani-garcia/bitwarden_rs/wiki/Proxy-examp...

Post reply on HN