Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: A standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

111–120 of 212 posts

Re: Pass: A standard Unix password manager

#111

Post by zamber »

ufo wrote: post #93
roddhjav wrote: post #38

Earlier quoted context omitted.

This "issue" has been fixed with the pass extension 'pass-tomb' that keep the whole tree of password encrypted inside a tomb See https://github.com/roddhjav/pass-tomb However keep in mind it's not always a big "issue", for instance only looking at your browser history will retrieve the same knowledge.

Oh well... I wonder why they didnt make something like this the default.

s/they/he/

Pass is pretty much a glorified bash script using GPG and Git.

Adding filename encryption on top would be a nightmare, not to mention that terminal suggestions would be pretty much broken.

Re: Pass: A standard Unix password manager

#112

Post by hdhzy »

kronos29296 wrote: post #54
hdhzy wrote: post #29

Earlier quoted context omitted.

There is also QtPass (GUI around pass), and various browser extensions (e.g. BrowserPass). Of course one has to set it up, it's not an integrated solution. But GPG provides interesting features like storing encryption keys on hardware devices. Some devices like Yubikeys can have touch-to-use enabled. So each use of a secret requires a touch (after PIN but that's once a session). Perfect combination of convenience and…

KeepassXC now supports YUBIkey now.

Well "supports" is a very broad term given that yubikey supports multiple applets (OpenPGP, PIV, U2F, static passwords etc.).

Do you mean this:

> YubiKey challenge-response support for strengthening your database encryption key

From https://keepassxc.org/blog/2017-06-26-2.2.0-released/

Then it's not clear for me how this works exactly.

Re: Pass: A standard Unix password manager

#113

Post by zamber »

painted wrote: post #30
alex_duf wrote: post #26

I don't like the fact someone with access to my hard-drive can figure out all the services I'm using just by looking at the filenames. It's convenient yes, but I prefer one encrypted file that contains it all.

yeah, from a security point of view it's similar to have one file or multiple ones encrypted with the same key

It's not. When you decrypt one file you have all of your passwords in-memory (terminal, clipboard, browser extension, qtpass). When you do that for one login/password pair you only expose that pair, not all of the others.

Re: Pass: A standard Unix password manager

#114

Post by jbg_ »

fps wrote: post #83
jbg_ wrote: post #55

I've used this for a long time, and along with its Git integration (pushing/pulling to/from a repository on my own server, accessed over SSH) and a GPG key stored on a Yubikey Neo, I've got basically seamless sync between two laptops, a desktop and an Android phone, without using any third-party service. The "Password Store" app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo t…

I have the same setup, but I haven't yet been able to get the Yubikey Neo to work as a GPG key on android via NFC. It prompts for a PIN, but the PIN I use for GPG on linux isn't accepted. There's also no working windows client for this setup, so I find I have to manually copy a lot of 20 character complex passwords by hand these days.

Interesting. The same PIN that I use to unlock the card on my laptops works on my phone. I'm not sure what would lead to the behaviour you describe!

Re: Pass: A standard Unix password manager

#115

Post by jbg_ »

emilecantin wrote: post #81
jbg_ wrote: post #55

I've used this for a long time, and along with its Git integration (pushing/pulling to/from a repository on my own server, accessed over SSH) and a GPG key stored on a Yubikey Neo, I've got basically seamless sync between two laptops, a desktop and an Android phone, without using any third-party service. The "Password Store" app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo t…

I've got the same setup, it's pretty great. One thing, though: make sure you have another way of decrypting your passwords! I lost my Yubikey once, and I lost all my passwords. Now I have a copy of that key on a USB drive I keep at home in a small safe.

Yeah, my passwords are encrypted to two private keys. One is on the Yubikey, the other is printed and stored securely.

Re: Pass: A standard Unix password manager

#116

Post by benchaney »

crypt1d wrote: post #67
koolba wrote: post #64

Earlier quoted context omitted.

Yep. Or saves the plaintext of the password elsewhere after using it once for a "legit" use. Rule zero of security is that you can't ask people to forget things. If they had knowledge of a shared secret and they're not supposed to going forward, then that shared secret needs to be changed.

Thats the whole point of audit logs. You lookup the passwords he accessed and only rotate those (vs rotating all of team's shared secrets because you dont know which ones he used/saved/etc).

You're missing the point. The software has no way to tell if a compromised user looked at certain passwords out of band. The audit logs aren't guaranteed to be complete, so you should rotate every key they could have accessed anyway.

Re: Pass: A standard Unix password manager

#117

Post by kranner »

fps wrote: post #83
jbg_ wrote: post #55

I've used this for a long time, and along with its Git integration (pushing/pulling to/from a repository on my own server, accessed over SSH) and a GPG key stored on a Yubikey Neo, I've got basically seamless sync between two laptops, a desktop and an Android phone, without using any third-party service. The "Password Store" app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo t…

I have the same setup, but I haven't yet been able to get the Yubikey Neo to work as a GPG key on android via NFC. It prompts for a PIN, but the PIN I use for GPG on linux isn't accepted. There's also no working windows client for this setup, so I find I have to manually copy a lot of 20 character complex passwords by hand these days.

I share a pass git repo between a Mac and a Windows machine. GPG4Win works fine on Windows.

Re: Pass: A standard Unix password manager

#118

Post by Tharkun »

roddhjav wrote: post #38
alex_duf wrote: post #26

I don't like the fact someone with access to my hard-drive can figure out all the services I'm using just by looking at the filenames. It's convenient yes, but I prefer one encrypted file that contains it all.

This "issue" has been fixed with the pass extension 'pass-tomb' that keep the whole tree of password encrypted inside a tomb See https://github.com/roddhjav/pass-tomb However keep in mind it's not always a big "issue", for instance only looking at your browser history will retrieve the same knowledge.

I mount my pass dir with encfs. Mount when I need access to passwords, and no need to remember to close it before I shut down (or if the machine randomly crashes).

I can store the encfs encrypted tree on cloud storage (spideroak in my case) and have it synched across machines. Works pretty well.

Re: Pass: A standard Unix password manager

#119

Post by deong »

Sir_Cmpwn wrote: post #16
hasenj wrote: post #12

If it becomes standard, people would use it without a master password, and then stealing passwords via malicious scripts will become very easy.

What? How does this follow?

Well, I guess if you had no master password, any script you expect people to run could have a surreptitious "pass | curl" to post password data to some web service of your choosing.

Still, if you use a password manager without a master password, I don't think you can be protected from consequence, regardless of what your tools do. Pass could refuse to allow the no master password scenario, or could force some type of blatant user interaction to allow it to work, but ultimately, that user is screwed by something somewhere.

Re: Pass: A standard Unix password manager

#120

Post by darrmit »

aeorgnoieang wrote: post #107
darrmit wrote: post #91

I think pass is awesome if you have the workflow that supports it, but for the vast majority (myself included) it's entirely too difficult to setup and maintain. Particularly if you're using Windows regularly.

Setup is a bit of a pain, but what workflow is required? I just keep a Cygwin window or a Bash on Ubuntu on Windows window open and tab over when I need a password. With the shell auto-completion I find it easier to use than other password managers, tho I prefer not using my mouse so I'm surely biased about that aspect. I was previously using Password Safe, on Windows, and various compatible alternatives on Linux and…

Well, I'm talking from a non-developer perspective. I don't use Git daily, so I had to stand up my own Git instance or pay Github for a private repo.

PassFF works well for Firefox on my Mac, but no equivalent for Windows. If you're willing to forgo browser integration then that's less of an issue.

Lack of browser integration might also be less of an issue in Linux with dmenu or rofi plugins like others have mentioned, but that still doesn't solve Windows issues.

I had considered the Bash/Ubuntu/Windows option (instead of qtpass) but haven't tried it yet.

Post reply on HN