Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Clever uses of pass, the Unix password manager

vitalyparnas.com

Post reply on HN
Print view View original

31–40 of 154 posts

Re: Clever uses of pass, the Unix password manager

#31

Post by invokestatic »

Ciantic wrote: post #12

Using single file for single password entry is very good idea. It's far better than any tools that opens the whole password database at once (KeePass, LastPass, Bitwarden etc). Reason is that you can use e.g. YubiKey to unlock individual entries on touch , this means that you can't lose whole password database on ransomware attack, (unless the ransomware has been there for a very long time). Filippo Valsorda wrote ab…

This is still susceptible to ransomware. Ransomware will simply encrypt over each file with its own key, regardless of if the file is already encrypted or not.

Re: Clever uses of pass, the Unix password manager

#32

Post by Xylakant »

Ciantic wrote: post #12

Using single file for single password entry is very good idea. It's far better than any tools that opens the whole password database at once (KeePass, LastPass, Bitwarden etc). Reason is that you can use e.g. YubiKey to unlock individual entries on touch , this means that you can't lose whole password database on ransomware attack, (unless the ransomware has been there for a very long time). Filippo Valsorda wrote ab…

It also has a few downsides: Adding a new key requires re-encrypting every entry. Touching your yubikey hundreds of times gets old, fast.

Re: Clever uses of pass, the Unix password manager

#33

Post by assbuttbuttass »

I'm shocked no one mentioned passmenu, a secret script that comes with pass located in usr/share/doc/pass/examples/dmenu/passmenu

Bind this script to a keybinding, and it will load all your passwords into dmenu and let you type the first few characters of a website name, then copy the password to the clipboard. No CLI needed.

Re: Clever uses of pass, the Unix password manager

#34

Post by wizzwizz4 »

tialaramex wrote: post #17
syx wrote: post #5

been using pass for more than 3 years now never had an issue, great CLI tool

I still really like how it makes random passwords given a permitted character set. It uses tr -cd to read only matching character bytes - discarding any others - from the random device. If you instead try to be less wasteful in turning random bytes into characters from the chosen set, you are in a sticky situation very quickly where your passwords might be less random than they should be, whereas bytes from the rando…

It means password generation takes variable time; this:

• opens you up to timing attacks on your PRNG (unlikely to be a problem in real life, but you never know)

• might run forever

Re: Clever uses of pass, the Unix password manager

#35

Post by [deleted] »

tialaramex wrote: post #17
syx wrote: post #5

been using pass for more than 3 years now never had an issue, great CLI tool

I still really like how it makes random passwords given a permitted character set. It uses tr -cd to read only matching character bytes - discarding any others - from the random device. If you instead try to be less wasteful in turning random bytes into characters from the chosen set, you are in a sticky situation very quickly where your passwords might be less random than they should be, whereas bytes from the rando…

[deleted]

Re: Clever uses of pass, the Unix password manager

#36

Post by assbuttbuttass »

wizzwizz4 wrote: post #34
tialaramex wrote: post #17

Earlier quoted context omitted.

I still really like how it makes random passwords given a permitted character set. It uses tr -cd to read only matching character bytes - discarding any others - from the random device. If you instead try to be less wasteful in turning random bytes into characters from the chosen set, you are in a sticky situation very quickly where your passwords might be less random than they should be, whereas bytes from the rando…

It means password generation takes variable time; this: • opens you up to timing attacks on your PRNG (unlikely to be a problem in real life, but you never know) • might run forever

It has probability 0 of running forever

Re: Clever uses of pass, the Unix password manager

#39

Post by jhgb »

tialaramex wrote: post #17
syx wrote: post #5

been using pass for more than 3 years now never had an issue, great CLI tool

I still really like how it makes random passwords given a permitted character set. It uses tr -cd to read only matching character bytes - discarding any others - from the random device. If you instead try to be less wasteful in turning random bytes into characters from the chosen set, you are in a sticky situation very quickly where your passwords might be less random than they should be, whereas bytes from the rando…

If you have an M-sized alphabet and you need an n-character password, why not just take ⌈log₂ Mⁿ⌉ bits and interpret it as a number in base M? That seems even simpler to me.
Post reply on HN