Pass: A standard Unix password manager • Hacker News Board

Re: Pass: A standard Unix password manager

#181

Post by subway » Fri, Jul 21, 2017, 9:00 PM UTC

xur17 wrote: post #177

emilecantin wrote: post #81

Earlier quoted context omitted.

I've got the same setup, it's pretty great. One thing, though: make sure you have another way of decrypting your passwords! I lost my Yubikey once, and I lost all my passwords. Now I have a copy of that key on a USB drive I keep at home in a small safe.

What's the best way to backup the private key on your yubikey? Do you just generate it on your computer instead of on your device, and then back that up?

Generally a good way to do this is via GPG subkeys. You keep your master/certifying key offline, in your safety deposit box, and load a subkey onto your Yubikey. If the Yubikey is lost, you can easily revoke the subkeys and generate new ones.

Here's a nice tutorial on it: https://www.jfry.me/articles/2015/gpg-smartcard/

Re: Pass: A standard Unix password manager

#182

Post by thesmallestcat » Fri, Jul 21, 2017, 9:01 PM UTC

mdekkers wrote: post #124

thesmallestcat wrote: post #7

No, no it's not.

Why?

"standard Unix $THING" has meaning beyond marketing-speak. https://en.wikipedia.org/wiki/Single_UNIX_Specification

Re: Pass: A standard Unix password manager

#183

Post by dfox » Fri, Jul 21, 2017, 9:07 PM UTC

painted wrote: post #58

jbg_ wrote: post #52

Earlier quoted context omitted.

A hash is a value. You don't have to encode it in hex.

typically the hashes are represented as a sequence of hexadecimal digits, just as an example md5 and sha265

Hash value is just a value picked out of some domain. For most hashes this domain is Z_{2^n} with n usually divisible by 8. It is then convenient to represent that as hexadecimal number, but there is nothing special about that particular encoding. For purpose of generating secure password you can even use said hash as seed for CSPRNG and then use it for FIPS 181 random password generator algorith or something similar.

Re: Pass: A standard Unix password manager

#184

Post by c13k » Fri, Jul 21, 2017, 9:11 PM UTC

redthrow wrote: post #178

guillaume20100 wrote: post #158

I recommend using Pass or Keepass, because we can see the source code. But like all these password managers, you need to synchronize your password vault. If you do not want to synchronize your vault among all your devices, but still want to have a unique password per site, try LessPass[1]. LessPass is a stateless open source password manager. Disclaimer I am the creator of LessPass [1] https://lesspass.com/

Lesspass seems nice but how about keeping all passwords in a .txt file and password protecting that file? One benefit of the password-protect-text-file method over Lesspass is you can also save answers to so-called "security questions" (for those sites that still use them, like Paypal and government sites). Alternatively, one can use Schneier's write-down-password-on-a-small-piece-of-paper method. https://www.schneie…

This method works very well. I have one large text file containing all my credentials, stored in a an encrypted VeraCrypt file.

I have all this stored in my Linux box. I backup to my server side encrypted AWS S3 bucket protected with 2FA. No need for me to sync anything, but if I need access to my VeraCrypt file, I can download it when required.

I've used this method for two decades now, first using OSX .dmg files, then TrueCrypt, now VeraCrypt. Simple, and works well.

Re: Pass: A standard Unix password manager

#185

Post by Accacin » Fri, Jul 21, 2017, 9:20 PM UTC

I'm currently a Lastpass user. I know, trusting them to store my passwords is probably not a great idea but it works on Windows, macOS and Linux and my iPhone with no problems at all.

Would I like to move to something that isn't stored online? Yes, of course but I haven't found a decent solution that works everywhere.

Any recommendations?

Re: Pass: A standard Unix password manager

#186

Post by ss64 » Fri, Jul 21, 2017, 9:36 PM UTC

guillaume20100 wrote: post #158

I recommend using Pass or Keepass, because we can see the source code. But like all these password managers, you need to synchronize your password vault. If you do not want to synchronize your vault among all your devices, but still want to have a unique password per site, try LessPass[1]. LessPass is a stateless open source password manager. Disclaimer I am the creator of LessPass [1] https://lesspass.com/

https://ss64.com/pass/ Is similar to LessPass but is entirely javascript in the browser, so you can save the page and run a local copy completely offline or upload to your own website. Theres also a command line version for both bash and PowerShell https://ss64.com/pass/command-line.html

Re: Pass: A standard Unix password manager

#187

Post by darrmit » Fri, Jul 21, 2017, 9:39 PM UTC

bqe wrote: post #131

darrmit wrote: post #120

Earlier quoted context omitted.

Well, I'm talking from a non-developer perspective. I don't use Git daily, so I had to stand up my own Git instance or pay Github for a private repo. PassFF works well for Firefox on my Mac, but no equivalent for Windows. If you're willing to forgo browser integration then that's less of an issue. Lack of browser integration might also be less of an issue in Linux with dmenu or rofi plugins like others have mentioned…

Both Bitbucket and Gitlab have free private repos.

Thanks for the tip. Didn't think to check anywhere other than Github, just defaulted to standing up an Ubuntu server.

Re: Pass: A standard Unix password manager

#188

Post by compuguy » Fri, Jul 21, 2017, 9:52 PM UTC

JetSpiegel wrote: post #14

Using this and something like rofi-pass: https://github.com/carnager/rofi-pass/ Gets me really close to the holy grail of password managers. Browser integration is possible too with PassFF: https://github.com/passff/passff

Pass/gopass really needs a good browser integration add-on. I have not found one that doesn't have some minor bug or issue.

Re: Pass: A standard Unix password manager

#189

Post by zx2c4 » Fri, Jul 21, 2017, 10:10 PM UTC

mrhigat4 wrote: post #46

I use pass and love it. It provides a lot of flexibility. To fix the "website metadata is leaked in filenames" issue, I use another project by Jason, ctmg[0]. I changed the pass directory to be one directory deeper, encrypted it and just do `ctmg open` when I boot to open my password list (similar to unlocking a keypassX store) then use pass as normal. On shutdown, the opened folder is re-encrypted automatically. You…

Nice to hear somebody out there is using ctmg. I never bothered making packages for distros other than Gentoo, but ctmg is quite useful so maybe I'll do that.

Re: Pass: A standard Unix password manager

#190

Post by zx2c4 » Fri, Jul 21, 2017, 10:11 PM UTC

aeorgnoieang wrote: post #100

tombert wrote: post #90

I love Pass, but the problem I've had is that I always feel like I have to spend a bunch of time setting it up when I'm on Windows. I understand it's the standard UNIX password manager, so I suppose I don't have a ton of room to complain, and most of my computers are Mac or Linux, so it's not a huge deal, but I think it increases the barrier of entry a ton of people. That said, I think Pass is awesome, and having my…

It's somewhat easier with Bash on Ubuntu on Windows, tho kinda broken (because the copy to clipboard feature doesn't work out of the box unless you're running an X server). But yeah, I kinda don't like using Gpg4Win with Cygwin, which is what I'm guessing you've used too. With the "Creators Update" there's now a `clip.exe` to which one can pipe so maybe it's not too hard to update Pass, which is itself just a Bash sc…

That's good to know. I'll add support for clip.exe with the next pass version. Send an email to the mailing list to remind me?