71–80 of 212 posts
Earlier quoted context omitted.
Password managers clear the clipboard after 1 minute or so.
there are so many clipboard listeners out there :D so the fact that you clear the clipboard doesn't really matter
Earlier quoted context omitted.
looks like a nice setup, but what about mobile?
Syncthing has a mobile app and there's an app for pass called PasswordStore[0] using OpenKeychain[1] (pgp manager). I'm not a fan of putting my private key on my mobile, but if I were, this would be a nice setup. [0]: https://github.com/zeapo/Android-Password-Store [1]: https://github.com/open-keychain/open-keychain Edit: yeah for ctmg support, probably have to hold out for something like PostMarketOS to save us.
Using this and something like rofi-pass: https://github.com/carnager/rofi-pass/ Gets me really close to the holy grail of password managers. Browser integration is possible too with PassFF: https://github.com/passff/passff
Browser integration just means you trust the plugins that provide browser integration. May not always be secure. With the recent trend of popular browser extensions being made adware after purchasing them I wouldn't always trust them. A time out clipboard is sufficient for me.
Earlier quoted context omitted.
"you can lookup which passwords he accessed" Really? What if s/he just decrypted the file themselves and had a look at the content, rather than using the convenient wrapper that a password manager provides?
Thats why password managers that do support audit logs (normally) do not provide this kind of mechanism of manually decrypting the file. The only way of accessing passwords would be through whatever interface they came up with.
The only way this kind of auditing could be trusted is if all the secrets are stored on the server that implements the auditing, which is exactly the model I believe that most users of `pass` are trying to avoid.
With all the discussion about 1password and its decision to "more or less" move to the web and a subscription based model, I had a TODO to look at what the open source community had; especially regarding browser plug-ins, mobile apps, etc. I don't understand why a simple problem like password management, needs a subscription and a private company to create software for the problem. This post seems to have saved me th…
Earlier quoted context omitted.
Looks nice. Unfortunately I would never use it for teams as it doesn't have audit logs. These are very useful in case a user is compromised - you can lookup which passwords he accessed and only change those. Same goes if the user left the team and u want to make sure all accesses are revoked.
For teams, I almost always go with Vault ( http://vaultproject.io/ )
Isn't copying the password to clipboard a vulnerability? I think a better idea would be to fill in the password through something like xdotool
Some programs support calling an external command to get a password, that's convenient (mutt and msmtp allow that for instance). I thought about integrating pass in my window manager directly but I didn't take the time to implement it yet.
pass also tries to clear the clipboard after 45 seconds.
But really if you can't trust your clibpoard what can you do? I didn't really feel a lot safer with lastpass' browser plugin.
With all the discussion about 1password and its decision to "more or less" move to the web and a subscription based model, I had a TODO to look at what the open source community had; especially regarding browser plug-ins, mobile apps, etc. I don't understand why a simple problem like password management, needs a subscription and a private company to create software for the problem. This post seems to have saved me th…
This does seem attractive. Any feedback on iOS client passforios it's MIT licensed? And how is sync done,itunes?
Earlier quoted context omitted.
looks like a nice setup, but what about mobile?
Syncthing has a mobile app and there's an app for pass called PasswordStore[0] using OpenKeychain[1] (pgp manager). I'm not a fan of putting my private key on my mobile, but if I were, this would be a nice setup. [0]: https://github.com/zeapo/Android-Password-Store [1]: https://github.com/open-keychain/open-keychain Edit: yeah for ctmg support, probably have to hold out for something like PostMarketOS to save us.
With all the discussion about 1password and its decision to "more or less" move to the web and a subscription based model, I had a TODO to look at what the open source community had; especially regarding browser plug-ins, mobile apps, etc. I don't understand why a simple problem like password management, needs a subscription and a private company to create software for the problem. This post seems to have saved me th…
Speaking from recent experience migrating non technical users to 1Password, while something like pass might work well for me/the typical HN user, there's no way I'd try to get family to use it. I have found the overall 1Password user experience to be very friendly and reliable, but am still semi regularly having to help family figure out/re-explain something about how it works. They'd be lost with something like pass.