Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: The standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

81–90 of 213 posts

Re: Pass: The standard Unix password manager

#81

Post by nulbyte »

Isognoviastoma wrote: post #61
spicybright wrote: post #36

Earlier quoted context omitted.

I've only used keypassx on windows, but the auto fill feature was amazing. You would push a key shortcut, then based on the window title of whatever window has focus, it would simulate key presses into it. So I could type secure credentials into any program on my computer with one key stroke.

That's how I use pass on Linux. A key shortcut is bind to script that calls "xdotool getwindowfocus getwindowname", selects credentials set based on it, asks for master password with pinentry-qt if needed, then types with "xdotool type --file -". It works and is better than placing password in clipboard and than "xdotool type $pass". Likely worse than proper integration with password consumer.

Interesting. I just have a keyboard shortcut in i3 that uses dmenu to let you select a credential. Very handy as I have multiple accounts for some sites/apps. Plus, the browser extension has its own keyboard shortcut.

Re: Pass: The standard Unix password manager

#82

Post by [deleted] »

aborsy wrote: post #52
PureParadigm wrote: post #14

Earlier quoted context omitted.

git push. The Android app works with git repos from SSH. I also use Wireguard since I run my SSH server behind the VPN, but this is obviously optional since you can just expose your SSH server to the internet.

Do phone apps support Yubikey?

[deleted]

Re: Pass: The standard Unix password manager

#83

Post by kame3d »

teawrecks wrote: post #79
aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

I want a tool like this, but I don't think I can ever be ok with leaking meta data.

There's the pass-code extension for that:

https://github.com/alpernebbi/pass-code

> A pass extension that obscures the filenames and folder hierarchy within your password store.

> pass-code generates random filenames for each file in the password store and keeps the mapping in an encrypted file. This way, no valuable information is accessible even if your password store is leaked to the public (unless your GPG private keys were also leaked). Nevertheless, you should always ensure proper protection of your password store.

Re: Pass: The standard Unix password manager

#84

Post by eptcyka »

spicybright wrote: post #11
PureParadigm wrote: post #4

I've been using pass for several years now and I recommend it to my friends, but I usually get weird looks when I say I store my passwords in a git repo (it's not as bad as it sounds!). Here's why: - I host my git repo on my desktop computer (through SSH), so it's not exposed anywhere except if you have SSH access to my computer. (A lot of people seem to think git = GitHub which is not true). So if your git repo is n…

How do you get your passwords out of the repo on your phone?

The android app allows one to use OprnKeychain, so I can use my gpg key on my yubikey to both authenticate the SSH session to do git pulls and decrypt individual secrets.

Re: Pass: The standard Unix password manager

#85

Post by gen220 »

nextstep wrote: post #13

Is there a way to synchronize this with 1Password via a plug-in? I would like to use pass as another backup of my 1Password database.

There are plugins for importing into pass from all kinds of password managers. (https://github.com/roddhjav/pass-import#readme)

You could setup a cron job that polls 1Pass for your password CSV, imports the CSV into to pass, and commits the diff.

Caveat that I don’t know how robust 1Password’s API is, or indeed if they have one. You might need to do the “gimme all my passwords in a CSV” step through a GUI, or a very hacky puppeteer script.

Re: Pass: The standard Unix password manager

#86

Post by eptcyka »

aborsy wrote: post #52
PureParadigm wrote: post #14

Earlier quoted context omitted.

git push. The Android app works with git repos from SSH. I also use Wireguard since I run my SSH server behind the VPN, but this is obviously optional since you can just expose your SSH server to the internet.

Do phone apps support Yubikey?

It supports PGP keys stored on yubikeys via OpenKeychain. There's talks of removing support for OpenKeychain in lieu of a homegrown implementation since OKC develoent has lost velocity. And their library interface can be a bit cumbersome.

Re: Pass: The standard Unix password manager

#87

Post by ufo »

woodruffw wrote: post #57
ufo wrote: post #51

Earlier quoted context omitted.

It can be a problem if you want to back up the password database to the cloud. That's part of the threat model for most other password managers, which use a single encrypted file for the database. Pass is the only popular one I know that stores part of the information in plaintext.

I don't actually use pass, but as an idle thought: if you're concerned about this sort of metadata when syncing your `pass` store to a cloud provider, why not take advantage of the GPG key you already have and encrypt everything as a single blob in one shot? You pay a little more with each synchronization, but probably not enough to worry about for reasonably sized stores.

There are pass extensions that encrypt the metadata but I don't know why they are not the default.

Re: Pass: The standard Unix password manager

#88

Post by iudqnolq »

PureParadigm wrote: post #4

I've been using pass for several years now and I recommend it to my friends, but I usually get weird looks when I say I store my passwords in a git repo (it's not as bad as it sounds!). Here's why: - I host my git repo on my desktop computer (through SSH), so it's not exposed anywhere except if you have SSH access to my computer. (A lot of people seem to think git = GitHub which is not true). So if your git repo is n…

I'm glad it's working well for you. I used to use pass, but when I lost my gpg key I was able to recover most of my passwords through a mistake I'd made. After that I decided to switch to something where I wouldn't be able to screw up as easily, and bought 1password.

I still had an earlier gpg key, and had not reset all my passwords when I switched keys. I'd just re-encrypted them. This let me check out an old commit and decrypt all the passwords in it. A dumb mistake, but it showed me I'm not smart enough to use something that doesn't hold my hand more.

Re: Pass: The standard Unix password manager

#89

Post by nyolfen »

kame3d wrote: post #83
teawrecks wrote: post #79

Earlier quoted context omitted.

I want a tool like this, but I don't think I can ever be ok with leaking meta data.

There's the pass-code extension for that: https://github.com/alpernebbi/pass-code > A pass extension that obscures the filenames and folder hierarchy within your password store. > pass-code generates random filenames for each file in the password store and keeps the mapping in an encrypted file. This way, no valuable information is accessible even if your password store is leaked to the public (unless your GPG privat…

pass-tomb as well: https://github.com/roddhjav/pass-tomb

Re: Pass: The standard Unix password manager

#90

Post by mumblemumble »

tlackemann wrote: post #9

Pass user for many years, always loved it. There are a number of ways to integrate it into rofi too, so with the press of a few keys I can navigate to any site and login instantly. To squash a few concerns: - Leaking data - If someone types "pass" in your terminal it will show a list of sites that you've stored. I don't find this any less obvious than if someone had LastPass installed on their machine. - Trusting dif…

> If someone types "pass" in your terminal it will show a list of sites that you've stored.

This is not really any different from Keychain on a Mac. I don't really see it as a major downside.

If someone's logged into the computer as you, you're already hosed, and this is hardly the first place they're going to look to get a list of websites you've visited.

Post reply on HN