Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Clever uses of pass, the Unix password manager

vitalyparnas.com

Post reply on HN
Print view View original

51–60 of 154 posts

Re: Clever uses of pass, the Unix password manager

#51

Post by assbuttbuttass »

jhgb wrote: post #39
tialaramex wrote: post #17

Earlier quoted context omitted.

I still really like how it makes random passwords given a permitted character set. It uses tr -cd to read only matching character bytes - discarding any others - from the random device. If you instead try to be less wasteful in turning random bytes into characters from the chosen set, you are in a sticky situation very quickly where your passwords might be less random than they should be, whereas bytes from the rando…

If you have an M-sized alphabet and you need an n-character password, why not just take ⌈log₂ Mⁿ⌉ bits and interpret it as a number in base M? That seems even simpler to me.

This is "simpler" because it's a one line shell snippet:

    tr -dc "0-z"

Re: Clever uses of pass, the Unix password manager

#52

Post by twp »

With chezmoi you can use pass to store secrets in your dotfiles, for example if you want to set a secret API token in your ~/.bashrc you can use:

  export SECRET_API_TOKEN={{ pass "api/token" | quote }}
For more info see https://github.com/twpayne/chezmoi/blob/master/docs/HOWTO.md... and https://github.com/twpayne/chezmoi/blob/master/README.md.

Re: Clever uses of pass, the Unix password manager

#53

Post by cycomanic »

twp wrote: post #52

With chezmoi you can use pass to store secrets in your dotfiles, for example if you want to set a secret API token in your ~/.bashrc you can use: export SECRET_API_TOKEN={{ pass "api/token" | quote }} For more info see https://github.com/twpayne/chezmoi/blob/master/docs/HOWTO.md... and https://github.com/twpayne/chezmoi/blob/master/README.md .

You could also use secret-tool for this, which is compatible with many tools that support the secret tool, I use keepassxc for example.

Re: Clever uses of pass, the Unix password manager

#54

Post by OJFord »

fooqux wrote: post #30
crawl_soever wrote: post #8

I use pass along with passff and my yubikey for gpg decryption of the password store and gpg-ssh syncing from my home git pass db. Works great

passff and other tools like them scare me too much. That browser extension has too much power. All it would take is the author to sell it to some bad actors (or turn into one) and a lot of people will be having a very bad day. Pasting my password into a form isn't that bad, and it feels far safer.

I use a couple of little scripts to do something somewhere in the middle that I'm happy with:

`fzf-dmenu` spawns an alacritty window running fzf over given input.

`pass-dmenu` calls the former with available password names; takes the result (if any) and decrypts & types it with `pass show $result | xdotool type --file -`.

Re: Clever uses of pass, the Unix password manager

#55

Post by mehdix »

throwawayboise wrote: post #16
hvdijk wrote: post #7

Earlier quoted context omitted.

And this matters a lot because history is normally only accessible to the current user (and root), but process command line arguments are normally accessible to all users.

I've long thought that was a general problem. Why should I see the command line arguments from other users' processes? What if non-root could see their own processes in detail, but only the program name for other users' processes? Would that break a lot of other things?

Most other users nowadays are likely to be your webserver, your application process, your database, your crawler, and a myriad of other long-running processes.

Re: Clever uses of pass, the Unix password manager

#56

Post by konschubert »

assbuttbuttass wrote: post #36
wizzwizz4 wrote: post #34

Earlier quoted context omitted.

It means password generation takes variable time; this: • opens you up to timing attacks on your PRNG (unlikely to be a problem in real life, but you never know) • might run forever

It has probability 0 of running forever

But a nonzero possibility of running longer than x for any x>0

;)

In practice, it doesn't matter, I agree.

Re: Clever uses of pass, the Unix password manager

#57

Post by yepguy »

jamal-kumar wrote: post #45
loudmax wrote: post #15

`pass` was written by Jason Donenfeld, the developer who gave us WireGuard. It's is a bash script that makes it convenient and easy to use gpg2, the OpenPGP encryption tool. Frankly, I'm kind of shocked at how difficult it is to use the gpg2 command line utility. Clearly it's an extremely powerful tool, but it's written with the assumption that the user has a very deep understanding of how encryption and key signing…

As much as I love Jason Donenfeld's work, I tried to use pass and the gpg requirement just rubbed me the wrong way. It's basically just gpg-encrpyting a text file and unlocking that along with some wrappers for basic password manager functionality (I guess most important is clipboard functionality and clearing it automatically after some seconds), but somehow that seems like a weak point to me. It's a whole lot of re…

A few pass-related projects are working on an age[1] backend in addition to gpg. I think gopass already has support for it.

[1]: https://age-encryption.org/

Re: Clever uses of pass, the Unix password manager

#58

Post by ryanianian »

twp wrote: post #52

With chezmoi you can use pass to store secrets in your dotfiles, for example if you want to set a secret API token in your ~/.bashrc you can use: export SECRET_API_TOKEN={{ pass "api/token" | quote }} For more info see https://github.com/twpayne/chezmoi/blob/master/docs/HOWTO.md... and https://github.com/twpayne/chezmoi/blob/master/README.md .

What is the `quote` command that example pipes to? Seems handy but unsurprisingly hard to search for.

Re: Clever uses of pass, the Unix password manager

#59

Post by jehteh »

Xylakant wrote: post #32
Ciantic wrote: post #12

Using single file for single password entry is very good idea. It's far better than any tools that opens the whole password database at once (KeePass, LastPass, Bitwarden etc). Reason is that you can use e.g. YubiKey to unlock individual entries on touch , this means that you can't lose whole password database on ransomware attack, (unless the ransomware has been there for a very long time). Filippo Valsorda wrote ab…

It also has a few downsides: Adding a new key requires re-encrypting every entry. Touching your yubikey hundreds of times gets old, fast.

If you are using GPG keys and have the master key backed up somewhere you can fairly easily use that on an offline machine to add the new key to the full batch of password files without needing to perform a million button presses.

Re: Clever uses of pass, the Unix password manager

#60

Post by hnlmorg »

rkeene2 wrote: post #47
loudmax wrote: post #15

`pass` was written by Jason Donenfeld, the developer who gave us WireGuard. It's is a bash script that makes it convenient and easy to use gpg2, the OpenPGP encryption tool. Frankly, I'm kind of shocked at how difficult it is to use the gpg2 command line utility. Clearly it's an extremely powerful tool, but it's written with the assumption that the user has a very deep understanding of how encryption and key signing…

I wrote a tool called hunter2 [0][1] which is very similar but uses PKCS#11 modules, which may be more common than GPG since the entire US Government uses them. [0] https://chiselapp.com/user/rkeene/repository/hunter2/ [1] https://github.com/rkeene/hunter2 (mirror)

Love the name. That alone is genius, never mind all the work you've put into the tool itself.
Post reply on HN