11–13 of 13 posts
Tangentially related: The gopher on that site is cool - try hovering it! Works well on that page - looks good as a static image - but hovering gives a nice "wov" effect.
I personally don't like to name a project like this and to use Gopher logo unless it's a development tools it shouldn't be named after the tech behind it. It reduces the chance of getting some serius users as it presents the project as a hobby project by a Golang enthusiast.
The thing I don't get about pass or gopass is that "each secret lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the secret." Why leak the information that there are passwords for those websites or resources?
Wouldn't that just be security by obscurity if you hide what services you have?
But encrypting metadata isn’t “obscurity” at all. It’s strongly protecting sensitive personal information. And it’s table-stakes for a password manager.
“Obscurity” refers to obfuscating data in a way that’s easily reversible by knowing a trick or method. Like the FortiNet XOR with a static key.
“Secured by a high entropy secret and a trusted algorithm” is not obscurity, unless, for example, the key is packaged with the data it is meant to protect in a cute way.
The thing I don't get about pass or gopass is that "each secret lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the secret." Why leak the information that there are passwords for those websites or resources?
Wouldn't that just be security by obscurity if you hide what services you have?