Pass: The standard Unix password manager • Hacker News Board

Re: Pass: The standard Unix password manager

#201

Post by jrm4 » Wed, Apr 14, 2021, 8:12 PM UTC

So, just to share the thing I do:

I let Firefox save a lot of passwords, and for those that require more; I have one encrypted Linux volume on my computer. In that volume, name of file is name of service or website, and login and pass are written however.

To speed things up a tad, I have a custom command that points fzf with preview to it, with a little oath2 script in the preview to handle 2FA.

I've been hearing stuff lately about how I should perhaps be concerned when copy-pasting? But for now, these feels pretty good.

Re: Pass: The standard Unix password manager

#202

Post by herewulf » Thu, Apr 15, 2021, 3:03 AM UTC

cipherboy wrote: post #104

teawrecks wrote: post #79

Earlier quoted context omitted.

I want a tool like this, but I don't think I can ever be ok with leaking meta data.

I'm thinking about adding encrypted file support to my pass wrapper, p, but I've not really found a good argument to support breaking mobile apps (such as https://github.com/android-password-store/Android-Password-S... ). You'd have to manually look up the entries in a lookup table to resolve obfuscated names back to readable names... Or upstream support for whatever format is devised. I dunno.

I haven't used this app, but if the issue is a binary file where the app is expecting plain text, you could base64 encode your file. Maybe with some dummy password data. Then your arbitrary encrypted file is just another line in the plain text file.

Re: Pass: The standard Unix password manager

#203

Post by TeddyDD » Thu, Apr 15, 2021, 8:33 AM UTC

efiecho wrote: post #124

To backup the passwords a copy of ~/.password-store/ is enough, but to completely recover, a backup of the gpg keys is also required. What's your strategy for this? Do you just backup the entire ~/.gnupg/ directory?

I use passphrase2pgp[1] so I can recreate my GPG key anywhere. I need to remember three pieces of information:

- passphrase (long sentence, but it's easy to remember) - uid (Name - easy) - timestamp (10 digits - kinda hard to memorize but you can have it noted is plain text since it's not sensitive information)

[1]: https://github.com/skeeto/passphrase2pgp

Re: Pass: The standard Unix password manager

#204

Post by osb » Thu, Apr 15, 2021, 8:47 AM UTC

A well praised password manager that unfortunately will never be useful for the non-tech people, at least for me. I saw so many wonderful reviews, recommendations and reports about the simplicity of using it. And the level of excitement from the reviewers made me think I should try it as soon as possible. But with only basic-medium Linux skills I will never be able to install pass. I looked everywhere for step by step tutorials on how to run it, but there‘s always a „skipped“ step or a small „something“ that will lead me to failure (despite of spending hours in searching how to do this part). Unfortunately I had to give it up and started to use bitwarden. Same with etesync - no way to use it, even the paid version with hosting on the developer‘s server gave me a hard time. I could never use it right: android, iphone or macos. So back to Apple‘s calendar or some other easy alternative. Ah… :-(

Re: Pass: The standard Unix password manager

#205

Post by GoblinSlayer » Thu, Apr 15, 2021, 2:03 PM UTC

taeric wrote: post #192

GoblinSlayer wrote: post #154

Earlier quoted context omitted.

Encryption is broken, just not in all scenarios, that's why security without threat model is meaningless.

My point was that if this model is broken, I'm not sure I would trust any other for storing data at rest, either. Specifically, why would you still trust any other password manager?

Password managers that use authenticated encryption are not vulnerable to such attacks. Well, it's more a hypothetical attack, in practice you're more likely to get a keylogger.

Re: Pass: The standard Unix password manager

#206

Post by taeric » Thu, Apr 15, 2021, 6:53 PM UTC

GoblinSlayer wrote: post #205

taeric wrote: post #192

Earlier quoted context omitted.

My point was that if this model is broken, I'm not sure I would trust any other for storing data at rest, either. Specifically, why would you still trust any other password manager?

Password managers that use authenticated encryption are not vulnerable to such attacks. Well, it's more a hypothetical attack, in practice you're more likely to get a keylogger.

I'm not sure what you mean by authenticated encryption. I'm assuming you just meant single key encryption.

My question is if those are really on a different set of math, as my understanding was that they were not, all told. If you can bust public/private key encryption, you can typically bust all encryption. Is that not necessarily the case?

Re: Pass: The standard Unix password manager

#207

Post by GoblinSlayer » Thu, Apr 15, 2021, 9:22 PM UTC

taeric wrote: post #206

GoblinSlayer wrote: post #205

Earlier quoted context omitted.

Password managers that use authenticated encryption are not vulnerable to such attacks. Well, it's more a hypothetical attack, in practice you're more likely to get a keylogger.

I'm not sure what you mean by authenticated encryption. I'm assuming you just meant single key encryption. My question is if those are really on a different set of math, as my understanding was that they were not, all told. If you can bust public/private key encryption, you can typically bust all encryption. Is that not necessarily the case?

Pass uses public key to encrypt files, an attacker needs to know only the public key to forge pass files, and that public key isn't secret, it's stored in plain, unencrypted, that's why you can create pass files without entering master password that protects private key which is not used to create pass files. That's the catch with asymmetric encryption.

Re: Pass: The standard Unix password manager

#208

Post by taeric » Fri, Apr 16, 2021, 1:58 AM UTC

GoblinSlayer wrote: post #207

taeric wrote: post #206

Earlier quoted context omitted.

I'm not sure what you mean by authenticated encryption. I'm assuming you just meant single key encryption. My question is if those are really on a different set of math, as my understanding was that they were not, all told. If you can bust public/private key encryption, you can typically bust all encryption. Is that not necessarily the case?

Pass uses public key to encrypt files, an attacker needs to know only the public key to forge pass files, and that public key isn't secret, it's stored in plain, unencrypted, that's why you can create pass files without entering master password that protects private key which is not used to create pass files. That's the catch with asymmetric encryption.

But what is the threat vector? I have to pull the attacker's changes into repo. And... I would still have the old passwords.

How does this help an attacker get my passwords?

Re: Pass: The standard Unix password manager

#209

Post by GoblinSlayer » Fri, Apr 16, 2021, 7:42 AM UTC

taeric wrote: post #208

GoblinSlayer wrote: post #207

Earlier quoted context omitted.

Pass uses public key to encrypt files, an attacker needs to know only the public key to forge pass files, and that public key isn't secret, it's stored in plain, unencrypted, that's why you can create pass files without entering master password that protects private key which is not used to create pass files. That's the catch with asymmetric encryption.

But what is the threat vector? I have to pull the attacker's changes into repo. And... I would still have the old passwords. How does this help an attacker get my passwords?

It's not a certainty of abuse, only uneasiness about technical feasibility. Historically abuse of forgery was clever and unpredictable, as a result design of cryptographic systems tries to prevent forgery when possible. A hypothesis: pass prints text from decrypted file to terminal, terminals have rich functionality, legacy features and wide attack surface, so text printed to terminal is an attack vector.

Re: Pass: The standard Unix password manager

#210

Post by dopidopHN » Sat, Apr 17, 2021, 3:45 PM UTC

jayjader wrote: post #176

dopidopHN wrote: post #138

Earlier quoted context omitted.

And convenient. The only minor road block I sometimes encounter is when a website has dumb rules for password. I have to generate a auto one. Then edit it manually to make it comply to « no @ in password » or whatever dumb stuff like that

Just fyi, `pass generate` has a --no-symbols option that should save you some time in the future.

How could have miss that? It’s right there in the doc.

Thank you.