Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gopass – The Team Password Manager

gopass.pw

Post reply on HN
Print view View original

1–10 of 13 posts

Re: Gopass – The Team Password Manager

#3

Post by nemoniac »

The thing I don't get about pass or gopass is that "each secret lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the secret." Why leak the information that there are passwords for those websites or resources?

Re: Gopass – The Team Password Manager

#4

Post by dewey »

nemoniac wrote: post #3

The thing I don't get about pass or gopass is that "each secret lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the secret." Why leak the information that there are passwords for those websites or resources?

Wouldn't that just be security by obscurity if you hide what services you have?

Re: Gopass – The Team Password Manager

#5

Post by sneak »

nemoniac wrote: post #3

The thing I don't get about pass or gopass is that "each secret lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the secret." Why leak the information that there are passwords for those websites or resources?

Yes, a leak of unencrypted metadata like this is unacceptable.

Re: Gopass – The Team Password Manager

#6

Post by Hamuko »

nemoniac wrote: post #3

The thing I don't get about pass or gopass is that "each secret lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the secret." Why leak the information that there are passwords for those websites or resources?

You can choose what filenames to use. You could theoretically also stick everything inside an encrypted volume.

I don't really understand how that is a big deal though. If at some point an attacker gets to see what filenames are on my hard drive, I have bigger issues than if he knows I have an Amazon account or not.

Re: Gopass – The Team Password Manager

#7

Post by m_t »

dewey wrote: post #4
nemoniac wrote: post #3

The thing I don't get about pass or gopass is that "each secret lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the secret." Why leak the information that there are passwords for those websites or resources?

Wouldn't that just be security by obscurity if you hide what services you have?

Encrypting something is security by obscurity: the password are hidden, why wouldn't the url be hidden as well, the same way they are for every other password manager?

Re: Gopass – The Team Password Manager

#9

Post by stunt »

asmosoinio wrote: post #2

Tangentially related: The gopher on that site is cool - try hovering it! Works well on that page - looks good as a static image - but hovering gives a nice "wov" effect.

I personally don't like to name a project like this and to use Gopher logo unless it's a development tools it shouldn't be named after the tech behind it.

It reduces the chance of getting some serius users as it presents the project as a hobby project by a Golang enthusiast.

Re: Gopass – The Team Password Manager

#10

Post by Hamuko »

m_t wrote: post #7
dewey wrote: post #4

Earlier quoted context omitted.

Wouldn't that just be security by obscurity if you hide what services you have?

Encrypting something is security by obscurity: the password are hidden, why wouldn't the url be hidden as well, the same way they are for every other password manager?

Why would the URL be hidden? Most people keep their browser histories enabled.
Post reply on HN