Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: SpicyPass – A free and open-source minimalist password manager

github.com

Post reply on HN
Print view View original

71–80 of 113 posts

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#71

Post by munchbunny »

woadwarrior01 wrote: post #62
threentaway wrote: post #56

Earlier quoted context omitted.

1Password with WebAuthn 2FA is probably better (harder for generic malware to steal), and leagues more convenient.

Not true. The solution I described would survive a local machine compromise (the GPG key is maintained on the Yubikey), the 1Password based solution won’t. How could generic malware steal secrets that are not even on the device? Furthermore, pass encrypts each password separately (I.e GPG generates a new symmetric key for each password). In case of 1password, if the master password is compromised, it’s game over. Als…

Your solution doesn't survive a real-time attack on a local machine compromise (wait for you to enter the PIN and then opportunistically use the private key). It only makes doing so harder by automatically re-locking the key.

That said, your system is well past the point of "password storage is no longer the most economical surface to attack".

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#72

Post by forty »

hanklazard wrote: post #53
sethammons wrote: post #50

Earlier quoted context omitted.

I use bitwarden too, but I can't figure out how to get the cert to automatically update. I have port 443 served by Caddy2 and use that as a reverse proxy to Bitwarden, but Bitwarden wants to bind to 443 to update the cert. So, for now, it is a case of manually stopping Caddy, updating Bitwarden, and starting Caddy back up. The downtime is only acceptable because I only host personal stuff.

I’ve been running it in a docker container plugged into the nginx reverse proxy and letsencrypt companion containers. The latter claims to automatically update certs though I haven’t had it running long enough to test it. Unless you’re set on using Caddy, it’s a pretty straightforward option. Instructions here: https://hub.docker.com/r/jrcs/letsencrypt-nginx-proxy-compan...

The issue with this kind of solution is that you need to pass your docker socket to the container. Not great.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#73

Post by forty »

Jfreegman wrote: post #28
sdan wrote: post #6

Earlier quoted context omitted.

The benefit of Pass is it already has Chrome/Firefox plugins so all you need to do is press a keyboard shortcut and it automatically fills it in on the site. Given SpicyPass doesn't have that, I think I'll still be with Pass, because it's free and simply amazing.

Third party browser extensions (and cloud syncing) are two things that, while convenient, create potential security holes. I opted for security over convenience with spicypass. I absolutely understand why this might turn some people off, maybe even most people. But I know that there are people (like me) who want something that isn't connected to the cloud, and isn't going to inherit all of the security flaws of their…

Not having a browser extension is also a security risk, because copy/pasting is error prone, and does not protect you from phishing - which is more of a risk than someone taking control your computer and bruteforcing your vault IMO (of course your threat model might be different from most users, for example if you store passwords not for the web)

(Disclosure: I work for a commercial password manager that do offer browser extensions)

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#74

Post by anderspitman »

jkepler wrote: post #22

How would this compare with pass[1], the "standard UNIX password manager"? Is it simply that SpicyPass uses newer cryptography than pass? Pass uses gpg along with the filesystem and git, so it is lightweight, and super-easy to backup offsite, as long as you guard your gpg keys separately. For those who want a GUI, QtPass[2] provides a simple GUI while using pass in the background. [1] https://www.passwordstore.org/ […

Is there a decent pass integration with Android?

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#75

Post by jjnoakes »

z6 wrote: post #58
yingw787 wrote: post #39

Earlier quoted context omitted.

I evaluated LastPass, OnePassword, and Bitwarden personally for my devices (Windows / macOS / Linux / iOS). Bitwarden supports all these plus more, is cheap, lightweight, reliable, UX-decent, and open-source. If you build a great product people need, it's not a headspinner why people would use it and buy it. Hopefully going into this recession we'll see more products with that lesson baked in.

Other than being open source, what does Bitwarden offer over Lastpass on the free tier?

For me: the ability to self-host and the ability to read through the code.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#76

Post by 101101001010 »

anderspitman wrote: post #74
jkepler wrote: post #22

How would this compare with pass[1], the "standard UNIX password manager"? Is it simply that SpicyPass uses newer cryptography than pass? Pass uses gpg along with the filesystem and git, so it is lightweight, and super-easy to backup offsite, as long as you guard your gpg keys separately. For those who want a GUI, QtPass[2] provides a simple GUI while using pass in the background. [1] https://www.passwordstore.org/ […

Is there a decent pass integration with Android?

There is Password Store[0] although apparently no longer maintained (currently still using it). The downside is that there's no auto-fill etc. meaning that you have to copy and paste every login manually.

[0] https://play.google.com/store/apps/details?id=com.zeapo.pwds...

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#77

Post by marcthe12 »

cycomanic wrote: post #64

I am surprised that keepassxc does not get suggested more often. Uses the probably most common file format, has support for uibikeys, ssh agent and secret service (can act as gnome-keyring/KDE wallet substitute). Those features make it the best password manager for me

Interesting. Just 2 questions, is there a way to sync it run on Android. Got nextcloud instance. Nice if it can do that. Since there are password I would need on the move.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#78

Post by flanbiscuit »

znpy wrote: post #29

I'm using keepassxc and I'm loving it. Specifically, I love the fact that I can configure otp and depend less on my phone.

I did not know this is something KeepassXC could do! So this is basically making it do the same thing as Google Authenticator?

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#79

Post by dpacmittal »

marcthe12 wrote: post #77
cycomanic wrote: post #64

I am surprised that keepassxc does not get suggested more often. Uses the probably most common file format, has support for uibikeys, ssh agent and secret service (can act as gnome-keyring/KDE wallet substitute). Those features make it the best password manager for me

Interesting. Just 2 questions, is there a way to sync it run on Android. Got nextcloud instance. Nice if it can do that. Since there are password I would need on the move.

I just store my database on Dropbox and use keepassdb on android.

Re: Show HN: SpicyPass – A free and open-source minimalist password manager

#80

Post by Jfreegman »

tleb_ wrote: post #69

Why does the string random_password(unsigned int size) function have "no duplicate characters" as a requirement? Seems to me that this would only reduce the entropy; what does it bring? I need access to passwords from my phone so I'll stick with KeePassXC, but nice project! This makes me want to play around with lib-sodium, the API looks nice.

That's a great question, and I wish I was good enough at math to give you a sophisticated answer. But my thinking is that the entropy you might gain by allowing duplicates is negated by the huge set of weak/guessable passwords you allow. For example, the password "aaaaA1!" is probably more likely to be guessed or used by others than "agkxA1!". (I just checked on haveibeenpwned.com, and the former has been seen 12 times, while the latter has been seen 0 times. Not very scientific I know)

Though this isn't set in stone if someone wants to formally correct me.

And libsodium is indeed a pleasure to work with.

Post reply on HN