Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: The standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

101–110 of 213 posts

Re: Pass: The standard Unix password manager

#101

Post by progval »

teawrecks wrote: post #79
aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

I want a tool like this, but I don't think I can ever be ok with leaking meta data.

It only leaks metadata to people/systems with read access to your password folder, which is very limited.

Unless you share it with someone else or publicly (eg. Dropbox or Github), but then you're leaking a lot more metadata anyway.

Re: Pass: The standard Unix password manager

#102

Post by jedimastert »

taeric wrote: post #43
aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

The asymmetric point is surprisingly useful.

It makes me slightly weary, as those sorts of things can have unintended consequences. For example, there was a soc

al engineering exploit where someone would call into Amazon and add a credit card to an account they didn't own. They would then call right back and request a new email added to the account and use the freshly added credit card as authentication.

They could then use your Amazon account, or use the real card associated with the account as authentication for something else

Re: Pass: The standard Unix password manager

#103

Post by Evidlo »

teawrecks wrote: post #79
aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

I want a tool like this, but I don't think I can ever be ok with leaking meta data.

I wrote a pass equivalent for KeePass for this very reason [0].

It doesn't leak any metadata because everything is contained in a single file and it's compatible with the rest of the KeePass ecosystem.

[0]: https://github.com/Evidlo/passhole/

Re: Pass: The standard Unix password manager

#104

Post by cipherboy »

teawrecks wrote: post #79
aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

I want a tool like this, but I don't think I can ever be ok with leaking meta data.

I'm thinking about adding encrypted file support to my pass wrapper, p, but I've not really found a good argument to support breaking mobile apps (such as https://github.com/android-password-store/Android-Password-S...).

You'd have to manually look up the entries in a lookup table to resolve obfuscated names back to readable names... Or upstream support for whatever format is devised. I dunno.

Re: Pass: The standard Unix password manager

#105

Post by FrenchyJiby »

aborsy wrote: post #52
PureParadigm wrote: post #14

Earlier quoted context omitted.

git push. The Android app works with git repos from SSH. I also use Wireguard since I run my SSH server behind the VPN, but this is obviously optional since you can just expose your SSH server to the internet.

Do phone apps support Yubikey?

Yes!

Termux[0] does supports gpg and pass but no yubikey by default, but okc-agent[1] is a third party binding of OpenKeyChain, providing barebones gpg via yubikey. I use this to decrypt passwords via NFC:

[0]: https://termux.org [1]: https://github.com/DDoSolitary/OkcAgent

Simple password decrypt: okc-gpg -d ~/.password-store/mypass.gpg

I made a termux shortcut (button on homescreen) to emulate pass-dmenu via this ( store in ~/.shortcuts):

  #!/data/data/com.termux/files/usr/bin/env bash

  # Lists passwords in termux dialog, decrypting selection to clipboard for 45s

  # http://redsymbol.net/articles/unofficial-bash-strict-mode/
  set -euo pipefail

  # Inspired by https://git.zx2c4.com/password-store/tree/contrib/dmenu/passmenu
  shopt -s nullglob globstar

  prefix=${PASSWORD_STORE_DIR-~/.password-store}
  password_files=( "$prefix"/**/*.gpg )
  password_files=( "${password_files[@]#"$prefix"/}" )
  password_files=( "${password_files[@]%.gpg}" )

  password_files_csv=$(printf '%s,' "${password_files[@]}")
  choice_json=$(termux-dialog sheet -t "Select password" -v "$password_files_csv")

  choice_exit=$(echo "$choice_json" | jq .code)
  [[ "$choice_exit" == 0 ]] ||  exit

  password=$(echo "$choice_json" | jq .text | tr -d '"')

  okc-gpg -d ~/.password-store/"$password".gpg 2>/dev/null | head -n 1 | termux-clipboard-set
  # pass show -c "$password" 2>/dev/null
  termux-toast -s "Password copied to clipboard"
  sleep 46
  termux-clipboard-set ""
  termux-toast -s "Password remove from clipboard"

Re: Pass: The standard Unix password manager

#106

Post by spicybright »

Isognoviastoma wrote: post #61
spicybright wrote: post #36

Earlier quoted context omitted.

I've only used keypassx on windows, but the auto fill feature was amazing. You would push a key shortcut, then based on the window title of whatever window has focus, it would simulate key presses into it. So I could type secure credentials into any program on my computer with one key stroke.

That's how I use pass on Linux. A key shortcut is bind to script that calls "xdotool getwindowfocus getwindowname", selects credentials set based on it, asks for master password with pinentry-qt if needed, then types with "xdotool type --file -". It works and is better than placing password in clipboard and than "xdotool type $pass". Likely worse than proper integration with password consumer.

Ohhh, now that's a really clever way to do it! Never ceases to amaze me how flexible xdotool can be.

Re: Pass: The standard Unix password manager

#107

Post by GekkePrutser »

PureParadigm wrote: post #4

I've been using pass for several years now and I recommend it to my friends, but I usually get weird looks when I say I store my passwords in a git repo (it's not as bad as it sounds!). Here's why: - I host my git repo on my desktop computer (through SSH), so it's not exposed anywhere except if you have SSH access to my computer. (A lot of people seem to think git = GitHub which is not true). So if your git repo is n…

QtPass works great for me on all platforms including Windows

Re: Pass: The standard Unix password manager

#108

Post by GekkePrutser »

PureParadigm wrote: post #58
aborsy wrote: post #52

Earlier quoted context omitted.

Do phone apps support Yubikey?

The Password Store app delegates key management to another app. I use OpenKeychain [1] for this. I believe OpenKeychain supports Yubikeys, but I haven't used that feature myself so I can't speak about how well it works. [1] https://www.openkeychain.org/

It works perfectly both over NFC and USB either OTG micro USB or USB-C.

I only use hardware keys now.

Re: Pass: The standard Unix password manager

#109

Post by taeric »

jedimastert wrote: post #102
taeric wrote: post #43

Earlier quoted context omitted.

The asymmetric point is surprisingly useful.

It makes me slightly weary, as those sorts of things can have unintended consequences. For example, there was a soc al engineering exploit where someone would call into Amazon and add a credit card to an account they didn't own. They would then call right back and request a new email added to the account and use the freshly added credit card as authentication. They could then use your Amazon account, or use the real…

Not clear how that has any relevance here. If the encryption is broken, pretty sure most encryption is busted.

Re: Pass: The standard Unix password manager

#110

Post by GekkePrutser »

NullUsr wrote: post #71

I love the simplicity of Pass, but I wanted just a few more features, like being able to store (and retrieve) extra data easily. Unstructured data below the initial password wasn't really enough for me. I ended up taking huge inspiration from Pass, but writing my own implementation[1] with a few more features that increased it's usefulness for my use cases. I posted it a while ago on here[2] and Reddit[3], but it bas…

It's not all that unstructured. Most apps support using Login: or URL: prefixes. Like browserpass and the Android app
Post reply on HN