Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: The standard Unix password manager

passwordstore.org

Post reply on HN
Print view View original

141–150 of 213 posts

Re: Pass: The standard Unix password manager

#141

Post by dopidopHN »

teawrecks wrote: post #79
aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

I want a tool like this, but I don't think I can ever be ok with leaking meta data.

I don’t really see the implication. Also, it’s would be trivial ( or not too hard ) to wrap the whole thing in another layer of encryption. Like a Vera crypt.

But wait, actually I don’t really see what’s leaking. The name of the file that store the encrypted password ?

How so?

Re: Pass: The standard Unix password manager

#143

Post by dopidopHN »

Evidlo wrote: post #103
teawrecks wrote: post #79

Earlier quoted context omitted.

I want a tool like this, but I don't think I can ever be ok with leaking meta data.

I wrote a pass equivalent for KeePass for this very reason [0]. It doesn't leak any metadata because everything is contained in a single file and it's compatible with the rest of the KeePass ecosystem. [0]: https://github.com/Evidlo/passhole/

Hi,

I keep reading that argument in that thread about the metadata being leaked and I feel left out of the party.

How is it leaking? Why do we have to care and could some mapping of the file name to a encrypted key on map-table solve that ?

Re: Pass: The standard Unix password manager

#144

Post by dopidopHN »

iudqnolq wrote: post #91
tlackemann wrote: post #9

Pass user for many years, always loved it. There are a number of ways to integrate it into rofi too, so with the press of a few keys I can navigate to any site and login instantly. To squash a few concerns: - Leaking data - If someone types "pass" in your terminal it will show a list of sites that you've stored. I don't find this any less obvious than if someone had LastPass installed on their machine. - Trusting dif…

What people mean by leaking metadata is if you sync over git or dropbox you also leak the metadata to them. Whereas with 1password or something like it the sync server only sees an opaque blob.

I use a private git repo that I own on a machine I configured. Does that mitigate it

Re: Pass: The standard Unix password manager

#145

Post by TeddyDD »

aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

> It’s secure, because it’s a short bash script

There is also POSIX sh implementation available that is even shorter: https://github.com/dylanaraps/pash

Re: Pass: The standard Unix password manager

#146

Post by coolpanda0 »

might be weird, i use this app to encrypt things to a file and use google drive to the store encrypted file. it work well for me as i constantly switch computers and do not trust cloud vendors. So even google account might leak out, without password, data wont be compromised

https://github.com/privapps/notebook

Re: Pass: The standard Unix password manager

#147

Post by zaik »

bobbylarrybobby wrote: post #130
aborsy wrote: post #37

Here are some of the pros of the Pass: * It leaks meta-data. That might sound a con, but in exchange you get the ability to extract a password without decrypting and thus exposing other passwords. There is isolation. * It’s more convenient than a single file password manager. You type ‘’pass -c goo’’ for your Google account, instead of clicking on your password manager, typing password, searching in data base, findin…

Can you use it on mobile?

On Android you can access your passwords using https://f-droid.org/packages/dev.msfjarvis.aps .

Re: Pass: The standard Unix password manager

#148

Post by stonecharioteer »

PureParadigm wrote: post #38
spicybright wrote: post #30

Earlier quoted context omitted.

Sorry, I meant more on the UI side. Like if I'm on a website that needs a login, do I run a pass command in a local terminal, then copy and paste?

Ah, there is an Android app [1] which you sync the passwords to and it basically presents a list of all your websites. To use a password: tap on the website name, unlock your GPG key, and then see your password and put it in your phone's copy/paste buffer. [1] https://play.google.com/store/apps/details?id=dev.msfjarvis....

Thank you. I wish OP could have linked what Android app he was using

Re: Pass: The standard Unix password manager

#149

Post by merlincorey »

dopidopHN wrote: post #143
Evidlo wrote: post #103

Earlier quoted context omitted.

I wrote a pass equivalent for KeePass for this very reason [0]. It doesn't leak any metadata because everything is contained in a single file and it's compatible with the rest of the KeePass ecosystem. [0]: https://github.com/Evidlo/passhole/

Hi, I keep reading that argument in that thread about the metadata being leaked and I feel left out of the party. How is it leaking? Why do we have to care and could some mapping of the file name to a encrypted key on map-table solve that ?

A common way to use `pass` is to store things like `organization/domain/username` so for example it might be `goldmansachs/github.com/alphacoder` which is telling us that you do some work for Goldman Sachs who store stuff on Github and your username is alphacoder.
Post reply on HN