Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: A standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

201–210 of 212 posts

Re: Pass: A standard Unix password manager

#201

Post by rorosaurus »

c13k wrote: post #184
redthrow wrote: post #178

Earlier quoted context omitted.

Lesspass seems nice but how about keeping all passwords in a .txt file and password protecting that file? One benefit of the password-protect-text-file method over Lesspass is you can also save answers to so-called "security questions" (for those sites that still use them, like Paypal and government sites). Alternatively, one can use Schneier's write-down-password-on-a-small-piece-of-paper method. https://www.schneie…

This method works very well. I have one large text file containing all my credentials, stored in a an encrypted VeraCrypt file. I have all this stored in my Linux box. I backup to my server side encrypted AWS S3 bucket protected with 2FA. No need for me to sync anything, but if I need access to my VeraCrypt file, I can download it when required. I've used this method for two decades now, first using OSX .dmg files, t…

I suppose the main pain with this method would be accessing the passwords on other devices. For example, I'd prefer to be able to copy/paste password on my phone, instead of referring to another computer and typing it in one random character at a time.

Re: Pass: A standard Unix password manager

#202

Post by subway »

xur17 wrote: post #196
subway wrote: post #195

Earlier quoted context omitted.

Yes -- revocation is just an indicator of the subkey's trust going forward. Once revoked, the user would generate a new subkey and re-encrypt their password wallet. While the git features and multi-key capabilities of pass lend well to very lightweight team usage, the model is definitely best suited for use by an individual.

So a subkey is aware of all revocations from before it was generated? If I generate 2 subkeys, can they both encrypt and decrypt my passwords? The only difference is that I can revoke them independently?

Sorry, to clarify, you need to keep a backup of all subkeys along side your master/certifying key. Data encrypted to a given subkey can only be decrypted by that same subkey.

Honestly, if you're using GPG strictly for personal password wallet encryption, and don't intend to maintain an identity tied with the key long term, there's no need to do the subkey thing -- just create an offline key, load it to your YK, then securely store the offline key.

Subkeys shines when you want to maintain an identity long term, while allowing rotation of the keys that do your day to day encryption (or signing/auth)

Re: Pass: A standard Unix password manager

#204

Post by nzp »

hasenj wrote: post #12

If it becomes standard, people would use it without a master password, and then stealing passwords via malicious scripts will become very easy.

Pass doesn't handle your "master password" at all, it's completely delegated to GnuPG (pass is really nothing more than a shell wrapper your file system, GnuPG, and Git). Does GnuPG let you easily get away without a password on your key, I don't remember ATM.

Re: Pass: A standard Unix password manager

#205

Post by pnutjam »

cpenner461 wrote: post #80
planetjones wrote: post #25

With all the discussion about 1password and its decision to "more or less" move to the web and a subscription based model, I had a TODO to look at what the open source community had; especially regarding browser plug-ins, mobile apps, etc. I don't understand why a simple problem like password management, needs a subscription and a private company to create software for the problem. This post seems to have saved me th…

> I don't understand why a simple problem like password management, needs a subscription and a private company to create software for the problem. Speaking from recent experience migrating non technical users to 1Password, while something like pass might work well for me/the typical HN user, there's no way I'd try to get family to use it. I have found the overall 1Password user experience to be very friendly and reli…

spider oak has a nice one for non-technical users, https://spideroak.com/personal/encryptr.

Encryptr uses their no-knowledge cloud. It's pretty cool and their processes are openly documented.

Re: Pass: A standard Unix password manager

#206

Post by reledi »

guillaume20100 wrote: post #158

I recommend using Pass or Keepass, because we can see the source code. But like all these password managers, you need to synchronize your password vault. If you do not want to synchronize your vault among all your devices, but still want to have a unique password per site, try LessPass[1]. LessPass is a stateless open source password manager. Disclaimer I am the creator of LessPass [1] https://lesspass.com/

Disclaimer: stateless/deterministic password managers have some serious flaws compared to stateful/vault password managers. See https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... for example

Re: Pass: A standard Unix password manager

#207

Post by foobar__ »

dsacco wrote: post #69

Note that pass was developed (and is maintained) by Jason Donenfeld (zx2c4), the same person who developed Wireguard, the new VPN protocol. Not that my opinion is worth a whole lot, but this is the password manager I would choose to use if I wasn't using 1Password. Where many other password managers use convoluted constructions with (e.g.) AES and PBKDF2, this is very straightforward GPG.

FWIW, the source code looks fairly solid to me, considering that it's a bash script meant to be used on trusted inputs.

To illustrate my point, look at the elaborate loop to iterate over *.gpg files: https://git.zx2c4.com/password-store/tree/src/password-store...

This looks to me like the correct way to do this in bash, as long as you can guarantee that $PREFIX does not start with whitespace (which may be a valid assumption here).

From what I can tell, the code quality is way better than what you see in your average bash script.

Re: Pass: A standard Unix password manager

#208

Post by tom4000 »

rorosaurus wrote: post #198
guillaume20100 wrote: post #158

I recommend using Pass or Keepass, because we can see the source code. But like all these password managers, you need to synchronize your password vault. If you do not want to synchronize your vault among all your devices, but still want to have a unique password per site, try LessPass[1]. LessPass is a stateless open source password manager. Disclaimer I am the creator of LessPass [1] https://lesspass.com/

This appears to be very similar to MasterPassword. Do you have a minute to explain to me what advantages LessPass offers? [1] http://masterpasswordapp.com/

Not at all. While Masterpassword does not save any passwords but generates it based on some unique parameters live - pass stores passwords and notes encrypted with GPG in a git repository.

The list differences to LastPass is long.

Pass is OpenSource. Pass doesn't store your information on anybody else's computer by default. Pass has not first party browser plugin and is therefore not open to attack through browser plugin holes.

On the other hand you control everything by yourself including batch updating your passwords. And there's no online service.

Re: Pass: A standard Unix password manager

#209

Post by mrhigat4 »

zx2c4 wrote: post #189
mrhigat4 wrote: post #46

I use pass and love it. It provides a lot of flexibility. To fix the "website metadata is leaked in filenames" issue, I use another project by Jason, ctmg[0]. I changed the pass directory to be one directory deeper, encrypted it and just do `ctmg open` when I boot to open my password list (similar to unlocking a keypassX store) then use pass as normal. On shutdown, the opened folder is re-encrypted automatically. You…

Nice to hear somebody out there is using ctmg. I never bothered making packages for distros other than Gentoo, but ctmg is quite useful so maybe I'll do that.

Cheers. Yeah for sure, I was too lazy to make a PR on nixpkgs, but this[0] is what I wrote if anyone stumbles on this using NixOS. The nix package manager can be installed on top of most OS's too.

[0]: https://pastebin.com/raw/FYMean1q

Re: Pass: A standard Unix password manager

#210

Post by likeclockwork »

andrew3726 wrote: post #138
cookiecaper wrote: post #126

Earlier quoted context omitted.

Please understand that browser integration is the Achilles' Heel of password managers. While you get the convenience of autofill, you're also bringing access to your password database into the browser's attack surface. Bugs in the browser sandbox or improper extension implementations can allow rogue sites to get the goods. There have been multiple instances of major password manager extensions leaking secrets just in…

I agree that browser integration is troublesome. To circumvent having to use a browser extension I use rofi-pass[0] which is a external script (using rofi/dmenu and pass), so no browser integration. But it features autofill which is extremely convenient. [0] https://github.com/carnager/rofi-pass

Also using rofi-pass, really it's better than browser integration. Especially if you bind it to a hotkey.
Post reply on HN