Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: A standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

51–60 of 212 posts

Re: Pass: A standard Unix password manager

#51

Post by jbg_ »

amelius wrote: post #45
hiq wrote: post #41

Earlier quoted context omitted.

If your master password leaks you are exposed on every website where you used this scheme (and you should then change every password), so on the security side this is inferior to a master password granting access to uncorrelated passwords.

Well, you can add a salt to this scheme. I know, it's not perfect, but it beats carrying around password files between devices.

But you would just need to carry the salt around instead. You're just trading convenience for (significantly) lower security.

Re: Pass: A standard Unix password manager

#52

Post by jbg_ »

painted wrote: post #44
amelius wrote: post #37

Anybody else here simply hashing their master password with the domain name of the website? I think this is something the browser should offer by default.

What about websites that require to have special characters in your password, since the hash is just HEX? What about multiple accounts on the same website, same password?

A hash is a value. You don't have to encode it in hex.

Re: Pass: A standard Unix password manager

#53

Post by jbg_ »

amelius wrote: post #32
nickjj wrote: post #10

I've been using pass for a long time now. I have over 200 passwords stored. I like it because you can use it to store sensitive info along with metadata, not just single field passwords. It's also super easy to access the info on the command line with ways to auto-copy passwords to your clipboard (which expires after 45 seconds). I did a write up on it a while back at https://nickjanetakis.com/blog/managing-your-pass…

How do you deal with multiple devices? Do you sync your password files regularly between them?

I use Git; pass has integration with it out of the box (makes a commit for each change to the password store). I just push and pull periodically myself, but this could be automated. There is an Android app called Password Store that is compatible with pass and has Git integration built in.

I remember seeing some guy who had his `pass` Git repository public on GitHub and challenged the world to crack any of them. Myself, it's just git+ssh to a repository on my own server.

Re: Pass: A standard Unix password manager

#54

Post by kronos29296 »

hdhzy wrote: post #29
scbrg wrote: post #19

Earlier quoted context omitted.

So it does, yes. I forgot about that, since I needed to write my own wrapper to paste both username and password (stored on separate lines) anyway. Thank you for the correction, I'll update my post.

There is also QtPass (GUI around pass), and various browser extensions (e.g. BrowserPass). Of course one has to set it up, it's not an integrated solution. But GPG provides interesting features like storing encryption keys on hardware devices. Some devices like Yubikeys can have touch-to-use enabled. So each use of a secret requires a touch (after PIN but that's once a session). Perfect combination of convenience and…

KeepassXC now supports YUBIkey now.

Re: Pass: A standard Unix password manager

#55

Post by jbg_ »

I've used this for a long time, and along with its Git integration (pushing/pulling to/from a repository on my own server, accessed over SSH) and a GPG key stored on a Yubikey Neo, I've got basically seamless sync between two laptops, a desktop and an Android phone, without using any third-party service.

The "Password Store" app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo to decrypt the passwords.

Re: Pass: A standard Unix password manager

#56

Post by amelius »

jbg_ wrote: post #51
amelius wrote: post #45

Earlier quoted context omitted.

Well, you can add a salt to this scheme. I know, it's not perfect, but it beats carrying around password files between devices.

But you would just need to carry the salt around instead. You're just trading convenience for (significantly) lower security.

Yes, it's a trade-off.

By the way, I'd prefer to have a password manager on my phone (or smartwatch), and have it beam my password to my keyboard by NFC. But this solution does not exist yet.

Re: Pass: A standard Unix password manager

#57

Post by kronos29296 »

amelius wrote: post #37

Anybody else here simply hashing their master password with the domain name of the website? I think this is something the browser should offer by default.

Such ideas are already implemented in deterministic password managers (erm generators) which have a some key security issues related to portablility and weaker schemes that can be hacked and if your master password is compromised or insecure. A bad idea in my opinion.

Re: Pass: A standard Unix password manager

#58

Post by painted »

jbg_ wrote: post #52
painted wrote: post #44

Earlier quoted context omitted.

What about websites that require to have special characters in your password, since the hash is just HEX? What about multiple accounts on the same website, same password?

A hash is a value. You don't have to encode it in hex.

typically the hashes are represented as a sequence of hexadecimal digits, just as an example md5 and sha265

Re: Pass: A standard Unix password manager

#59

Post by nickjj »

amelius wrote: post #32
nickjj wrote: post #10

I've been using pass for a long time now. I have over 200 passwords stored. I like it because you can use it to store sensitive info along with metadata, not just single field passwords. It's also super easy to access the info on the command line with ways to auto-copy passwords to your clipboard (which expires after 45 seconds). I did a write up on it a while back at https://nickjanetakis.com/blog/managing-your-pass…

How do you deal with multiple devices? Do you sync your password files regularly between them?

As others have mentioned, git / dropbox works well for this.

But personally I use a different approach. I rolled my own little rsync script that syncs files that I care about (passwords and other things) between my workstation and Chromebook (I run Linux natively on it).

Re: Pass: A standard Unix password manager

#60

Post by painted »

mrhigat4 wrote: post #46

I use pass and love it. It provides a lot of flexibility. To fix the "website metadata is leaked in filenames" issue, I use another project by Jason, ctmg[0]. I changed the pass directory to be one directory deeper, encrypted it and just do `ctmg open` when I boot to open my password list (similar to unlocking a keypassX store) then use pass as normal. On shutdown, the opened folder is re-encrypted automatically. You…

looks like a nice setup, but what about mobile?
Post reply on HN