Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: A standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

61–70 of 212 posts

Re: Pass: A standard Unix password manager

#61

Post by kronos29296 »

JetSpiegel wrote: post #14

Using this and something like rofi-pass: https://github.com/carnager/rofi-pass/ Gets me really close to the holy grail of password managers. Browser integration is possible too with PassFF: https://github.com/passff/passff

Browser integration just means you trust the plugins that provide browser integration. May not always be secure. With the recent trend of popular browser extensions being made adware after purchasing them I wouldn't always trust them. A time out clipboard is sufficient for me.

Re: Pass: A standard Unix password manager

#62

Post by dsacco »

painted wrote: post #50
StavrosK wrote: post #42

Earlier quoted context omitted.

Then you can't use that machine. Not with a password manager, not without.

so you know and trust every piece of software that is running on your machine?

> so you know and trust every piece of software that is running on your machine?

Ostensibly, yes. Because (as 'StavrosK said), if I don't then we can't even begin to talk about security on that machine yet. We have to start with assumptions somewhere.

If software on your machine is compromised, your machine is compromised (or will be in short order). You need to make reasonable concessions and stick with them in order to get anywhere.

Re: Pass: A standard Unix password manager

#63

Post by crypt1d »

jbg_ wrote: post #49
crypt1d wrote: post #20

Earlier quoted context omitted.

Looks nice. Unfortunately I would never use it for teams as it doesn't have audit logs. These are very useful in case a user is compromised - you can lookup which passwords he accessed and only change those. Same goes if the user left the team and u want to make sure all accesses are revoked.

"you can lookup which passwords he accessed" Really? What if s/he just decrypted the file themselves and had a look at the content, rather than using the convenient wrapper that a password manager provides?

Thats why password managers that do support audit logs (normally) do not provide this kind of mechanism of manually decrypting the file. The only way of accessing passwords would be through whatever interface they came up with.

Re: Pass: A standard Unix password manager

#64

Post by koolba »

jbg_ wrote: post #49
crypt1d wrote: post #20

Earlier quoted context omitted.

Looks nice. Unfortunately I would never use it for teams as it doesn't have audit logs. These are very useful in case a user is compromised - you can lookup which passwords he accessed and only change those. Same goes if the user left the team and u want to make sure all accesses are revoked.

"you can lookup which passwords he accessed" Really? What if s/he just decrypted the file themselves and had a look at the content, rather than using the convenient wrapper that a password manager provides?

Yep. Or saves the plaintext of the password elsewhere after using it once for a "legit" use.

Rule zero of security is that you can't ask people to forget things. If they had knowledge of a shared secret and they're not supposed to going forward, then that shared secret needs to be changed.

Re: Pass: A standard Unix password manager

#65

Post by notheguyouthink »

painted wrote: post #50
StavrosK wrote: post #42

Earlier quoted context omitted.

Then you can't use that machine. Not with a password manager, not without.

so you know and trust every piece of software that is running on your machine?

I think the point in discussions like these is, what is the alternative? Ie, add value to the discussion, not argue over semantics. Arguing that everything (or this thing) sucks is.. non constructive. What do you see as better alternatives?

I agree completely, the clipboard is non-trusted. Yet the fact remains, how can we transmit an arbitrary string from a secure app like a password store, to another app in need of authorization? Lets build constructive conversations.

Re: Pass: A standard Unix password manager

#67

Post by crypt1d »

koolba wrote: post #64
jbg_ wrote: post #49

Earlier quoted context omitted.

"you can lookup which passwords he accessed" Really? What if s/he just decrypted the file themselves and had a look at the content, rather than using the convenient wrapper that a password manager provides?

Yep. Or saves the plaintext of the password elsewhere after using it once for a "legit" use. Rule zero of security is that you can't ask people to forget things. If they had knowledge of a shared secret and they're not supposed to going forward, then that shared secret needs to be changed.

Thats the whole point of audit logs. You lookup the passwords he accessed and only rotate those (vs rotating all of team's shared secrets because you dont know which ones he used/saved/etc).

Re: Pass: A standard Unix password manager

#68

Post by mrhigat4 »

painted wrote: post #60
mrhigat4 wrote: post #46

I use pass and love it. It provides a lot of flexibility. To fix the "website metadata is leaked in filenames" issue, I use another project by Jason, ctmg[0]. I changed the pass directory to be one directory deeper, encrypted it and just do `ctmg open` when I boot to open my password list (similar to unlocking a keypassX store) then use pass as normal. On shutdown, the opened folder is re-encrypted automatically. You…

looks like a nice setup, but what about mobile?

Syncthing has a mobile app and there's an app for pass called PasswordStore[0] using OpenKeychain[1] (pgp manager). I'm not a fan of putting my private key on my mobile, but if I were, this would be a nice setup.

[0]: https://github.com/zeapo/Android-Password-Store

[1]: https://github.com/open-keychain/open-keychain

Edit: yeah for ctmg support, probably have to hold out for something like PostMarketOS to save us.

Re: Pass: A standard Unix password manager

#69

Post by dsacco »

Note that pass was developed (and is maintained) by Jason Donenfeld (zx2c4), the same person who developed Wireguard, the new VPN protocol.

Not that my opinion is worth a whole lot, but this is the password manager I would choose to use if I wasn't using 1Password. Where many other password managers use convoluted constructions with (e.g.) AES and PBKDF2, this is very straightforward GPG.

Re: Pass: A standard Unix password manager

#70

Post by mi100hael »

crypt1d wrote: post #20
allerhellsten wrote: post #8

Pass is pretty awesome, but nowadays I've switched to gopass: https://github.com/justwatchcom/gopass - much better support for teams, structured secrets, binary secrets and quite a few other improvements. Oh, and it's (mostly) drop-in compatible.

Looks nice. Unfortunately I would never use it for teams as it doesn't have audit logs. These are very useful in case a user is compromised - you can lookup which passwords he accessed and only change those. Same goes if the user left the team and u want to make sure all accesses are revoked.

For teams, I almost always go with Vault (http://vaultproject.io/)
Post reply on HN