Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Clever uses of pass, the Unix password manager

vitalyparnas.com

Post reply on HN
Print view View original

81–90 of 154 posts

Re: Clever uses of pass, the Unix password manager

#81

Post by doubled112 »

jehteh wrote: post #59
Xylakant wrote: post #32

Earlier quoted context omitted.

It also has a few downsides: Adding a new key requires re-encrypting every entry. Touching your yubikey hundreds of times gets old, fast.

If you are using GPG keys and have the master key backed up somewhere you can fairly easily use that on an offline machine to add the new key to the full batch of password files without needing to perform a million button presses.

Been there and done that. People are backing up those keys, right?

Could also disable the touch to decrypt feature while you performed the rekey?

Re: Clever uses of pass, the Unix password manager

#82

Post by SpaceManNabs »

rkeene2 wrote: post #47
loudmax wrote: post #15

`pass` was written by Jason Donenfeld, the developer who gave us WireGuard. It's is a bash script that makes it convenient and easy to use gpg2, the OpenPGP encryption tool. Frankly, I'm kind of shocked at how difficult it is to use the gpg2 command line utility. Clearly it's an extremely powerful tool, but it's written with the assumption that the user has a very deep understanding of how encryption and key signing…

I wrote a tool called hunter2 [0][1] which is very similar but uses PKCS#11 modules, which may be more common than GPG since the entire US Government uses them. [0] https://chiselapp.com/user/rkeene/repository/hunter2/ [1] https://github.com/rkeene/hunter2 (mirror)

How do you know my password?

Re: Clever uses of pass, the Unix password manager

#85

Post by taeric »

Xylakant wrote: post #32
Ciantic wrote: post #12

Using single file for single password entry is very good idea. It's far better than any tools that opens the whole password database at once (KeePass, LastPass, Bitwarden etc). Reason is that you can use e.g. YubiKey to unlock individual entries on touch , this means that you can't lose whole password database on ransomware attack, (unless the ransomware has been there for a very long time). Filippo Valsorda wrote ab…

It also has a few downsides: Adding a new key requires re-encrypting every entry. Touching your yubikey hundreds of times gets old, fast.

I'm not sure I follow. Adding a secret is done with your public key, so no need to even touch the yubikey to do that. And the idea is each one is a separate file. So, adding does not impact any other file.

Edit: oh. Adding a new key, not password. I see how I misread.

Re: Clever uses of pass, the Unix password manager

#86

Post by invokestatic »

Ciantic wrote: post #74
invokestatic wrote: post #31

Earlier quoted context omitted.

This is still susceptible to ransomware. Ransomware will simply encrypt over each file with its own key, regardless of if the file is already encrypted or not.

Backups is of course required. I was talking about Ransomware which also enters your password database and steals the passwords in order to do more harm. With YubiKey you can make the GPG private key on offline machine and upload it to YubiKey. This way you can always have a offline backup of your private key, and thus you can backup your password database too.

The term “ransomware” is never used to describe malware that steals passwords, thats the point of confusion.

Re: Clever uses of pass, the Unix password manager

#87

Post by tyingq »

chrisweekly wrote: post #10
RMPR wrote: post #4

That's quite ... Clever. Now I can version my mbsyncrc and even my shell history without worrying about secrets leak.

Be sure to protect those secrets though -- see eg peer comments about process params (made shortly after yours)

Regular gpg does have a --passphrase-fd argument that's nice for this sort of thing. Where you can specify which file descriptor the passphrase/password is coming from. Very handy for integrating with scripts.

Re: Clever uses of pass, the Unix password manager

#88

Post by pqb »

tex0 wrote: post #77
yepguy wrote: post #57

Earlier quoted context omitted.

A few pass-related projects are working on an age[1] backend in addition to gpg. I think gopass already has support for it. [1]: https://age-encryption.org/

Correct. Gopass has very early age support. It fully works but the UX is not great (yet).

Oh dammit. I have stopped using Gopass and rewrote pass just for that reason - missing AGE encryption. At least I have learned something new and I feel I have better UI - fuzzy finder instead of their TUI. However, big kudos to Gopass team for awesome work and really useful tool.

Before I start working on next project... Do you recognize any mobile app, which could replace PasswordStore app for Android [0] but with AGE support?

[0]: https://github.com/android-password-store/Android-Password-S...

Re: Clever uses of pass, the Unix password manager

#89

Post by VTimofeenko »

mike-cardwell wrote: post #84

In my ansible.cfg I have: vault_password_file = tools/vault.sh In my tools/vault.sh I have: echo -n $(pass infrastructure/ansible-vault) This lets me store my ansible vault master password for managing my personal infrastructure inside pass. I like it.

Ansible also has a collection that allows to work with pass's password store directly[1]. Have been using it with a dedicated pass repo for a while now, the PASSWORD_STORE_DIR variable can be loaded through direnv when entering directory with ansible playbooks to separate infrastructure credentials from user ones.

[1]: https://docs.ansible.com/ansible/latest/collections/communit...

Re: Clever uses of pass, the Unix password manager

#90

Post by INTPenis »

assbuttbuttass wrote: post #33

I'm shocked no one mentioned passmenu, a secret script that comes with pass located in usr/share/doc/pass/examples/dmenu/passmenu Bind this script to a keybinding, and it will load all your passwords into dmenu and let you type the first few characters of a website name, then copy the password to the clipboard. No CLI needed.

It's actually a separate package on Fedora called passmenu. Maybe because dmenu is not standard for Fedora users by default.
Post reply on HN