Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: A standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

131–140 of 212 posts

Re: Pass: A standard Unix password manager

#131

Post by bqe »

darrmit wrote: post #120
aeorgnoieang wrote: post #107

Earlier quoted context omitted.

Setup is a bit of a pain, but what workflow is required? I just keep a Cygwin window or a Bash on Ubuntu on Windows window open and tab over when I need a password. With the shell auto-completion I find it easier to use than other password managers, tho I prefer not using my mouse so I'm surely biased about that aspect. I was previously using Password Safe, on Windows, and various compatible alternatives on Linux and…

Well, I'm talking from a non-developer perspective. I don't use Git daily, so I had to stand up my own Git instance or pay Github for a private repo. PassFF works well for Firefox on my Mac, but no equivalent for Windows. If you're willing to forgo browser integration then that's less of an issue. Lack of browser integration might also be less of an issue in Linux with dmenu or rofi plugins like others have mentioned…

Both Bitbucket and Gitlab have free private repos.

Re: Pass: A standard Unix password manager

#132

Post by mi100hael »

joekrill wrote: post #76
mi100hael wrote: post #70

Earlier quoted context omitted.

For teams, I almost always go with Vault ( http://vaultproject.io/ )

My impression of Vault is that it is more useful for automated situations. How useful is it as a shared password manager? Do you have non-technical folks using it? And if so, how are they interacting with the vault?

No purely non-technical individuals as far as I know, but there are a number of non-developer analysts using it who wouldn't otherwise have much exposure to a console. The flexibility of the access policies and the ability for users to easily/securely share secrets under a path with only their team and be able to have multiple policies for multiple teams all under one roof far outweighs any minor struggle during initial adoption.

Re: Pass: A standard Unix password manager

#133

Post by Spooky23 »

dsacco wrote: post #69

Note that pass was developed (and is maintained) by Jason Donenfeld (zx2c4), the same person who developed Wireguard, the new VPN protocol. Not that my opinion is worth a whole lot, but this is the password manager I would choose to use if I wasn't using 1Password. Where many other password managers use convoluted constructions with (e.g.) AES and PBKDF2, this is very straightforward GPG.

> Where many other password managers use convoluted constructions with (e.g.) AES and PBKDF2, this is very straightforward GPG.

That's a bonus until you need to demonstrate FIPS 140-2 validation.

Re: Pass: A standard Unix password manager

#134

Post by Piccollo »

thecopy wrote: post #28
adtac wrote: post #24

Isn't copying the password to clipboard a vulnerability? I think a better idea would be to fill in the password through something like xdotool

Password managers clear the clipboard after 1 minute or so.

What about clearing after one instance of 'paste'?

Re: Pass: A standard Unix password manager

#135

Post by dsacco »

Spooky23 wrote: post #133
dsacco wrote: post #69

Note that pass was developed (and is maintained) by Jason Donenfeld (zx2c4), the same person who developed Wireguard, the new VPN protocol. Not that my opinion is worth a whole lot, but this is the password manager I would choose to use if I wasn't using 1Password. Where many other password managers use convoluted constructions with (e.g.) AES and PBKDF2, this is very straightforward GPG.

> Where many other password managers use convoluted constructions with (e.g.) AES and PBKDF2, this is very straightforward GPG. That's a bonus until you need to demonstrate FIPS 140-2 validation.

GPG is FIPS 140-2 compliant (though pass itself might not be, depending on the specific way it's used). Most likely pass would have to use GPG in a specific FIPS-compliant mode to pursue validation.

Re: Pass: A standard Unix password manager

#137

Post by zabil »

I started with pass and switched to gopass because it automatically pushes new passwords to your remote git repository.

I use a fish script to hook it up to https://github.com/junegunn/fzf for easy search and copying to the clipboard. https://github.com/zabil/thanksforallthefish/blob/6145e98691...

Re: Pass: A standard Unix password manager

#138

Post by andrew3726 »

cookiecaper wrote: post #126
y4mi wrote: post #95

Earlier quoted context omitted.

the nonexistent browser support makes it even more troublesome to setup. there is some support on linux systems, but windows is plain out of luck i Really like the idea of pass, but ill never accept copy pasting logins/passwords again. they'll need to be automatically inserted on a matching website. everything else is too much manual overhead for my taste.

Please understand that browser integration is the Achilles' Heel of password managers. While you get the convenience of autofill, you're also bringing access to your password database into the browser's attack surface. Bugs in the browser sandbox or improper extension implementations can allow rogue sites to get the goods. There have been multiple instances of major password manager extensions leaking secrets just in…

I agree that browser integration is troublesome. To circumvent having to use a browser extension I use rofi-pass[0] which is a external script (using rofi/dmenu and pass), so no browser integration. But it features autofill which is extremely convenient.

[0] https://github.com/carnager/rofi-pass

Re: Pass: A standard Unix password manager

#139

Post by burnbabyburn »

zabil wrote: post #137

I started with pass and switched to gopass because it automatically pushes new passwords to your remote git repository. I use a fish script to hook it up to https://github.com/junegunn/fzf for easy search and copying to the clipboard. https://github.com/zabil/thanksforallthefish/blob/6145e98691...

you could already do that with git hooks and pass

    .git/hooks/post-commit

    #!/bin/sh
    git push origin master

Re: Pass: A standard Unix password manager

#140

Post by jethro_tell »

emilecantin wrote: post #81
jbg_ wrote: post #55

I've used this for a long time, and along with its Git integration (pushing/pulling to/from a repository on my own server, accessed over SSH) and a GPG key stored on a Yubikey Neo, I've got basically seamless sync between two laptops, a desktop and an Android phone, without using any third-party service. The "Password Store" app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo t…

I've got the same setup, it's pretty great. One thing, though: make sure you have another way of decrypting your passwords! I lost my Yubikey once, and I lost all my passwords. Now I have a copy of that key on a USB drive I keep at home in a small safe.

General recommendation is to have a backup for everything on a yubi key. Two keys or printed backup codes or whatever.
Post reply on HN