Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: The standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

131–140 of 213 posts

Re: Pass: The standard Unix password manager

#131

Post by [deleted] »

woodruffw wrote: post #57
ufo wrote: post #51

Earlier quoted context omitted.

It can be a problem if you want to back up the password database to the cloud. That's part of the threat model for most other password managers, which use a single encrypted file for the database. Pass is the only popular one I know that stores part of the information in plaintext.

I don't actually use pass, but as an idle thought: if you're concerned about this sort of metadata when syncing your `pass` store to a cloud provider, why not take advantage of the GPG key you already have and encrypt everything as a single blob in one shot? You pay a little more with each synchronization, but probably not enough to worry about for reasonably sized stores.

[deleted]

Re: Pass: The standard Unix password manager

#132

Post by jari_mustonen »

bobbylarrybobby wrote: post #130
aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

Can you use it on mobile?

Yes. There’s an iPhone app for Pass. Setting it up is a hassle but it works.

Re: Pass: The standard Unix password manager

#133

Post by captn3m0 »

efiecho wrote: post #124

To backup the passwords a copy of ~/.password-store/ is enough, but to completely recover, a backup of the gpg keys is also required. What's your strategy for this? Do you just backup the entire ~/.gnupg/ directory?

Hardware Yubikeys (2 for daily use, one as backup) with a paperkey backup.

If my main key breaks, I can switch to the backup key which gives me a buffer to setup a new key from my backup.

The ArchWiki has a decent guide: https://wiki.archlinux.org/index.php/Paperkey

Re: Pass: The standard Unix password manager

#134

Post by jaredsohn »

voidfunc wrote: post #114

I love pass but I have been having very weird issues lately with gpg agent taking ages to ask me my password to decrypt the database. Really annoying and googling has not yielded fixes. Worse the dev doesn’t use GitHub so getting in touch is a giant pain in the ass.

I've had this problem and would solve by killing gpg-agent as described at https://unix.stackexchange.com/questions/382279/gpg-hangs-wh...

Ideally there would be a better solution.

Re: Pass: The standard Unix password manager

#135

Post by tex0 »

encryptluks2 wrote: post #62
PureParadigm wrote: post #4

I've been using pass for several years now and I recommend it to my friends, but I usually get weird looks when I say I store my passwords in a git repo (it's not as bad as it sounds!). Here's why: - I host my git repo on my desktop computer (through SSH), so it's not exposed anywhere except if you have SSH access to my computer. (A lot of people seem to think git = GitHub which is not true). So if your git repo is n…

There is gopass for Windows which is compatible last time I checked. It also works on Linux and Mac too: https://github.com/gopasspw/gopass

gopass is primarily targeted at Linux. But it's reported to work very well on Windows, too.

Re: Pass: The standard Unix password manager

#136

Post by beagle3 »

SamuelAdams wrote: post #118
PureParadigm wrote: post #4

I've been using pass for several years now and I recommend it to my friends, but I usually get weird looks when I say I store my passwords in a git repo (it's not as bad as it sounds!). Here's why: - I host my git repo on my desktop computer (through SSH), so it's not exposed anywhere except if you have SSH access to my computer. (A lot of people seem to think git = GitHub which is not true). So if your git repo is n…

So your git repo and GPG key are stored on the same device? What happens when that device is stolen?

Yubikeys that can do gpg are $40 or so and have lots of other uses.

Iirc, ssh can now do file encryption with FIDO2 keys; these are $10 or so.

Definitely worth buying a pair if you are worried about security (both Trojans, where local encryption at rest can be defeated, and losing your device where it is not)

Re: Pass: The standard Unix password manager

#137

Post by dopidopHN »

spicybright wrote: post #30
PureParadigm wrote: post #14

Earlier quoted context omitted.

git push. The Android app works with git repos from SSH. I also use Wireguard since I run my SSH server behind the VPN, but this is obviously optional since you can just expose your SSH server to the internet.

Sorry, I meant more on the UI side. Like if I'm on a website that needs a login, do I run a pass command in a local terminal, then copy and paste?

This is correct. Pass can only copy it in the paste buffer for 45s.

The command has a nice auto completion and search feature. And calling it without arguing give you a list of all the name of the key you have in a tree view.

I really enjoy using that little utility since I would say 4 or 5 years.

Re: Pass: The standard Unix password manager

#138

Post by dopidopHN »

taeric wrote: post #43
aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

The asymmetric point is surprisingly useful.

And convenient. The only minor road block I sometimes encounter is when a website has dumb rules for password. I have to generate a auto one. Then edit it manually to make it comply to « no @ in password » or whatever dumb stuff like that

Re: Pass: The standard Unix password manager

#139

Post by dejj »

woodruffw wrote: post #39

I don't use pass myself (I have severe NIH[1]), but its design has inspired me many times over: very, very few tools rise to the challenge of adhering to the Unix philosophy without cargo-culting it, and pass is one of them. I highly recommend that people looking to write engineer-friendly tools study its manpage[2]. [1]: https://github.com/woodruffw/kbs2 [2]: https://git.zx2c4.com/password-store/about/

> kbs2 uses the rage[1] implementation of age[2].

Symmetric encryption with an actually comprehensible CLI; thank you!

[1]: https://github.com/str4d/rage

[2]: https://github.com/FiloSottile/age

Re: Pass: The standard Unix password manager

#140

Post by bvrmn »

oxplot wrote: post #113

I've just recently started to use 1password and here're my thoughts: - Amazing support and fast response on their forums from the reps - Works across Linux (my desktop), Mac and iPhone and Safari and Chrome browsers - Has CLI - Syncs instantly (unlike Chrome and iCloud Keychain) - Supports TOTP (no - it does not completely defeat the purpose of 2FA, there are multiple aspects to it) I am also aware of the risk I'm ta…

I also use it for TOTP. Main reason: storing totp-key on a mobile device is too insecure.
Post reply on HN