Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: The standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

51–60 of 213 posts

Re: Pass: The standard Unix password manager

#51

Post by ufo »

woodruffw wrote: post #25
bloaf wrote: post #2

It feels nice and clean, but also like it is leaking the list of sites I use.

I think this is outside of the threat model of most password managers -- your desktop search history (whether in your shell, Spotlight, or whatever) is leaking equivalent and probably more detailed information.

It can be a problem if you want to back up the password database to the cloud.

That's part of the threat model for most other password managers, which use a single encrypted file for the database. Pass is the only popular one I know that stores part of the information in plaintext.

Re: Pass: The standard Unix password manager

#52

Post by aborsy »

PureParadigm wrote: post #14
spicybright wrote: post #11

Earlier quoted context omitted.

How do you get your passwords out of the repo on your phone?

git push. The Android app works with git repos from SSH. I also use Wireguard since I run my SSH server behind the VPN, but this is obviously optional since you can just expose your SSH server to the internet.

Do phone apps support Yubikey?

Re: Pass: The standard Unix password manager

#53

Post by yakubin »

taeric wrote: post #44
yakubin wrote: post #34

It is a file-based key-value store, where only the values are encrypted[1], with GPG to make it worse. For these reasons, I moved to KeePassXC. It is cross-platform, has a nice Qt GUI and you don't have to resort to hacks to have several values associated with a single key (i.e. not just password, but also username and others). [1]: Keys and Git history are not encrypted.

I get why folks don't like gpg for securing email. What makes this use of it bad?

Because you still need to manage your GPG keys with an obscure CLI. When I last switched computers, I tried just copying my "~/.gpg" directory. Didn't work. GPG was confused, produced even more confusing messages, which didn't really help me understand what the problem was. I needed to google for the right incantation of commands to export my keys from one computer and import them on another. Compare that to what you have with KeePassXC: switching computers? Just copy this single file and everything will just work.

And I don't want to know if I'm holding GPG right. I just want the tool to work for my specific case. But GPG wasn't designed specifically with this case in mind, so, as usual, it will be terrible. It tries to be too many things.

Re: Pass: The standard Unix password manager

#54

Post by aborsy »

RcouF1uZ4gsC wrote: post #42
PureParadigm wrote: post #4

I've been using pass for several years now and I recommend it to my friends, but I usually get weird looks when I say I store my passwords in a git repo (it's not as bad as it sounds!). Here's why: - I host my git repo on my desktop computer (through SSH), so it's not exposed anywhere except if you have SSH access to my computer. (A lot of people seem to think git = GitHub which is not true). So if your git repo is n…

> I used a browser extension for awhile, but I haven't gotten around to reinstalling since the copy/paste works fine for me. One danger of doing just copy and paste is that you are more exposed to phishing attacks. The browser extension for the password managers check that the site that they are filling in is indeed the site that they stored the password for.

But extensions bring their own security concerns too.

You can use auto type. But you need to make each entry identifiable and sometimes it doesn’t work because page and login titles change.

Re: Pass: The standard Unix password manager

#55

Post by netflixandkill »

yakubin wrote: post #34

It is a file-based key-value store, where only the values are encrypted[1], with GPG to make it worse. For these reasons, I moved to KeePassXC. It is cross-platform, has a nice Qt GUI and you don't have to resort to hacks to have several values associated with a single key (i.e. not just password, but also username and others). [1]: Keys and Git history are not encrypted.

Unless you need multiple concurrent writers or some kind of RBAC it's going to be really hard for anything to beat the KP database just because it already takes into things like that into account, along with optional entry history, arbitrary associated values, etc.

Been using it both with computers/phones and via programmatic access on cloud storage for years.

Re: Pass: The standard Unix password manager

#57

Post by woodruffw »

ufo wrote: post #51
woodruffw wrote: post #25

Earlier quoted context omitted.

I think this is outside of the threat model of most password managers -- your desktop search history (whether in your shell, Spotlight, or whatever) is leaking equivalent and probably more detailed information.

It can be a problem if you want to back up the password database to the cloud. That's part of the threat model for most other password managers, which use a single encrypted file for the database. Pass is the only popular one I know that stores part of the information in plaintext.

I don't actually use pass, but as an idle thought: if you're concerned about this sort of metadata when syncing your `pass` store to a cloud provider, why not take advantage of the GPG key you already have and encrypt everything as a single blob in one shot? You pay a little more with each synchronization, but probably not enough to worry about for reasonably sized stores.

Re: Pass: The standard Unix password manager

#58

Post by PureParadigm »

aborsy wrote: post #52
PureParadigm wrote: post #14

Earlier quoted context omitted.

git push. The Android app works with git repos from SSH. I also use Wireguard since I run my SSH server behind the VPN, but this is obviously optional since you can just expose your SSH server to the internet.

Do phone apps support Yubikey?

The Password Store app delegates key management to another app. I use OpenKeychain [1] for this. I believe OpenKeychain supports Yubikeys, but I haven't used that feature myself so I can't speak about how well it works.

[1] https://www.openkeychain.org/

Re: Pass: The standard Unix password manager

#59

Post by smegcicle »

aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

> For example, if you store your database on a cloud, say, Dropbox, Dropbox could switch your Dropbox.com file with google.com file

That's sad- could we include a hash to detect stuff like this?

Re: Pass: The standard Unix password manager

#60

Post by aborsy »

xrisk wrote: post #19

I used to use this, and then I moved to a real password manager. Like seriously, this doesn’t hold a candle to an actual well-engineered password manager. I use Keepass right now, with MacPass and Keepassium; both excellent apps.

Careful: KeePassium only shares a similar name with keepass, that happens to read keepass format; its not associated with the same brand!
Post reply on HN