Recently used pass to share passwords between colleagues (3 in total). Files are encrypted against three different GPG public keys and shared via Git.
Works well enough for us.
Clever uses of pass, the Unix password manager
11–20 of 154 posts
Re: Clever uses of pass, the Unix password manager
#12Using single file for single password entry is very good idea. It's far better than any tools that opens the whole password database at once (KeePass, LastPass, Bitwarden etc).
Reason is that you can use e.g. YubiKey to unlock individual entries on touch, this means that you can't lose whole password database on ransomware attack, (unless the ransomware has been there for a very long time).
Filippo Valsorda wrote about this: https://blog.filippo.io/touch-to-operate-password-store-yubi...
Re: Clever uses of pass, the Unix password manager
#13Looks very neat; nice Unix’y solution. Would love this to integrate with Bitwarden which I use on my phone.
Are you referring to Pass? There is... https://mssun.github.io/passforios/
Works wonderfully and with OTPauth also.
Run a bare git repo on your own network and there is no reason to use Bitwarden.
Edit - and for those that are in AWS, you can use pass along with aws-vault to keep your ~/.aws creds in check. https://github.com/99designs/aws-vault
Re: Clever uses of pass, the Unix password manager
#14been using pass for more than 3 years now never had an issue, great CLI tool
Yeah. I think it might be the tool that's given me the most quality of life per line of code :-)
Stellar. Absolutely stellar piece of software. Always does exactly what I want it to, never gets in my way ever!
Re: Clever uses of pass, the Unix password manager
#15`pass` was written by Jason Donenfeld, the developer who gave us WireGuard.
It's is a bash script that makes it convenient and easy to use gpg2, the OpenPGP encryption tool. Frankly, I'm kind of shocked at how difficult it is to use the gpg2 command line utility. Clearly it's an extremely powerful tool, but it's written with the assumption that the user has a very deep understanding of how encryption and key signing work. To use `pass` effectively you should have a basic understanding of encryption, but unlike gpg2 you don't need to dedicate a week to grok the manpage.
Re: Clever uses of pass, the Unix password manager
#16For the curl command though written like it won't show up in history, this will still show up in process parameters To fix this as well pass it into curl as a config via eg: curl [...] -K- <<< "--header auth:$(pass mysecret)"
And this matters a lot because history is normally only accessible to the current user (and root), but process command line arguments are normally accessible to all users.
I've long thought that was a general problem. Why should I see the command line arguments from other users' processes?
What if non-root could see their own processes in detail, but only the program name for other users' processes?
Would that break a lot of other things?
Re: Clever uses of pass, the Unix password manager
#17been using pass for more than 3 years now never had an issue, great CLI tool
I still really like how it makes random passwords given a permitted character set. It uses tr -cd to read only matching character bytes - discarding any others - from the random device. If you instead try to be less wasteful in turning random bytes into characters from the chosen set, you are in a sticky situation very quickly where your passwords might be less random than they should be, whereas bytes from the random device are cheap, so just throw away all the ones that aren't suitable and get more. So simple and yet I'm sure it wouldn't have occurred to me.
Re: Clever uses of pass, the Unix password manager
#18Looks very neat; nice Unix’y solution. Would love this to integrate with Bitwarden which I use on my phone.
there is a pass import pluging allowing you to import bitwardn csv
https://github.com/roddhjav/pass-import
maybe you can "bridge it" with bitwarden-cli via some export/import commands or may as well use bitwarden-cli directly (but i find the pass ui much bettwer than bw cli command)
Re: Clever uses of pass, the Unix password manager
#19Looks very neat; nice Unix’y solution. Would love this to integrate with Bitwarden which I use on my phone.
Are you referring to Pass? There is... https://mssun.github.io/passforios/ Works wonderfully and with OTPauth also. Run a bare git repo on your own network and there is no reason to use Bitwarden. Edit - and for those that are in AWS, you can use pass along with aws-vault to keep your ~/.aws creds in check. https://github.com/99designs/aws-vault
Is there an equivalent for Android?
Re: Clever uses of pass, the Unix password manager
#20For the curl command though written like it won't show up in history, this will still show up in process parameters To fix this as well pass it into curl as a config via eg: curl [...] -K- <<< "--header auth:$(pass mysecret)"
curl -H/--header itself also takes a file name prefixed by @, including - for stdin. So you could go curl -H@- <<<'API-Key: Foobar', or if you need to specify multiple sensitive headers, curl -H@<(echo API-Key: Foo) -H@<(echo Pre-Shared: Bar)
<() is a bash extension and won't work in another `sh` like dash.