Pass: A standard Unix password manager • Hacker News Board

Re: Pass: A standard Unix password manager

#171

Post by eikenberry » Fri, Jul 21, 2017, 7:10 PM UTC

prophesi wrote: post #164

arthulia wrote: post #161

Earlier quoted context omitted.

This is pretty brilliant. My biggest concern is that if my password for a site gets compromised, it gets a lot more complicated. Presumably I'd have to memorize a separate master password for retrieving the new password for that site.

They have a counter option that you can increment which allows you to generate a completely different password for the same site.

But once you did that it wouldn't be stateless anymore as you'd need to connect to their server every time to check on the state of that site's password. This makes it not that much different from traditional online managers where you have to connect to the site to retrieve the password.

There is still the benefit that the passwords can't be exposed by a compromise of the service. Presumably it doesn't store your master password anywhere, so all they'd get is the site and counter info.

Re: Pass: A standard Unix password manager

#172

Post by hedora » Fri, Jul 21, 2017, 7:28 PM UTC

dannysu wrote: post #84

cpenner461 wrote: post #80

Earlier quoted context omitted.

> I don't understand why a simple problem like password management, needs a subscription and a private company to create software for the problem. Speaking from recent experience migrating non technical users to 1Password, while something like pass might work well for me/the typical HN user, there's no way I'd try to get family to use it. I have found the overall 1Password user experience to be very friendly and reli…

Exactly. You're paying 1Password to maintain the various apps and browser plugins. Continuing to improve UX and add language support. My parents don't speak English. Not everyone does. That's what you're paying 1Password for.

I wish people would pay pass (or some other auditable open source software team) for this sort of thing instead.

The situation is particularly painful for security critical software like password managers and disk encryption. Commercial software could be keeping a rot-13 copy of the database on an anonymous ftp server for all I know (or, worse, be written for a leaky JavaScript sandbox).

The open source stuff generally stalls out after the first 90% of the functionality is there, and the second 90% of the work remains.

Re: Pass: A standard Unix password manager

#173

Post by prophesi » Fri, Jul 21, 2017, 7:29 PM UTC

eikenberry wrote: post #171

prophesi wrote: post #164

Earlier quoted context omitted.

They have a counter option that you can increment which allows you to generate a completely different password for the same site.

But once you did that it wouldn't be stateless anymore as you'd need to connect to their server every time to check on the state of that site's password. This makes it not that much different from traditional online managers where you have to connect to the site to retrieve the password. There is still the benefit that the passwords can't be exposed by a compromise of the service. Presumably it doesn't store your mas…

True. You'd have to connect to their server or your own self-hosted LessPass to get your saved profile.

Re: Pass: A standard Unix password manager

#174

Post by ViktorEvil » Fri, Jul 21, 2017, 7:31 PM UTC

alexnewman wrote: post #155

I use pass on all my devices. IOS, chromebook and cli. I freaking love it! passforios is still on testflight but so good. Only a few issues with passforios: - It forgets my github password everytime i upgrade - I honestly don't like the fact that I can't turn off the pin. 4 digits with unlimited retries. - It can't merge sometimes. I think they should be more aggressive about git rebase

Pass for iOS is now on the App store

Re: Pass: A standard Unix password manager

#175

Post by wallunit » Fri, Jul 21, 2017, 7:35 PM UTC

I wrote a similar password manager (without knowing that pass already exists): https://github.com/snoack/mypass

But I ended up storing everything into one single encrypted file, rather than having one file per password. Though I see the point about the UNIX philosophy (i.e. "everything is a file"), but that way you'd leak information, i.e. what the passwords stored are for.

Anyway, I'd appreciate any feedback on mypass.

Re: Pass: A standard Unix password manager

#176

Post by palunon » Fri, Jul 21, 2017, 7:40 PM UTC

zamber wrote: post #113

painted wrote: post #30

Earlier quoted context omitted.

yeah, from a security point of view it's similar to have one file or multiple ones encrypted with the same key

It's not. When you decrypt one file you have all of your passwords in-memory (terminal, clipboard, browser extension, qtpass). When you do that for one login/password pair you only expose that pair, not all of the others.

When you decrypt, you have the key in memory in either case. Assuming you don't put all the password into an untrustworthy output (terminal, clipboard, etc), what's the difference ?

Re: Pass: A standard Unix password manager

#177

Post by xur17 » Fri, Jul 21, 2017, 8:29 PM UTC

emilecantin wrote: post #81

jbg_ wrote: post #55

I've used this for a long time, and along with its Git integration (pushing/pulling to/from a repository on my own server, accessed over SSH) and a GPG key stored on a Yubikey Neo, I've got basically seamless sync between two laptops, a desktop and an Android phone, without using any third-party service. The "Password Store" app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo t…

I've got the same setup, it's pretty great. One thing, though: make sure you have another way of decrypting your passwords! I lost my Yubikey once, and I lost all my passwords. Now I have a copy of that key on a USB drive I keep at home in a small safe.

What's the best way to backup the private key on your yubikey? Do you just generate it on your computer instead of on your device, and then back that up?

Re: Pass: A standard Unix password manager

#178

Post by redthrow » Fri, Jul 21, 2017, 8:44 PM UTC

guillaume20100 wrote: post #158

I recommend using Pass or Keepass, because we can see the source code. But like all these password managers, you need to synchronize your password vault. If you do not want to synchronize your vault among all your devices, but still want to have a unique password per site, try LessPass[1]. LessPass is a stateless open source password manager. Disclaimer I am the creator of LessPass [1] https://lesspass.com/

Lesspass seems nice but how about keeping all passwords in a .txt file and password protecting that file?

One benefit of the password-protect-text-file method over Lesspass is you can also save answers to so-called "security questions" (for those sites that still use them, like Paypal and government sites).

Alternatively, one can use Schneier's write-down-password-on-a-small-piece-of-paper method.

https://www.schneier.com/blog/archives/2005/06/write_down_yo...

Re: Pass: A standard Unix password manager

#179

Post by Galanwe » Fri, Jul 21, 2017, 8:52 PM UTC

wallunit wrote: post #175

I wrote a similar password manager (without knowing that pass already exists): https://github.com/snoack/mypass But I ended up storing everything into one single encrypted file, rather than having one file per password. Though I see the point about the UNIX philosophy (i.e. "everything is a file"), but that way you'd leak information, i.e. what the passwords stored are for. Anyway, I'd appreciate any feedback on mypa…

You miss the point. Having multiple files is not a matter of Unix philosophy. Pass works with GPG keys... Multiple of them! The pass repository is to be shared among your team, so every file can be encrypted for a different, specific set of keys/users.

Re: Pass: A standard Unix password manager

#180

Post by dfox » Fri, Jul 21, 2017, 8:56 PM UTC

noahdesu wrote: post #130

painted wrote: post #31

Earlier quoted context omitted.

there are so many clipboard listeners out there :D so the fact that you clear the clipboard doesn't really matter

I'm not particularly worried about other applications on my computer listening to the clipboard. But I 99% of the time I'm pasting into a webpage in Chrome or Firefox. Can any open tab sniff the clipboard passively?

No, webpages get to the contents of clipboard only after explicit user interaction.

On the other hand it does not work this way in the other direction. Random web pages can manipulate your primary selection and overwrite it with random garbage (this primarily happens with various attempts to make copying stuff from the page more "convenient", pretyy comonly resulting in state when it is simply impossible to copy said thing into say rxvt directly). It is somewhat ironic that chrome's address bar uses some magic to prevent this from happening, while the same magic is not applied to websites.