91–100 of 154 posts
Recently used pass to share passwords between colleagues (3 in total). Files are encrypted against three different GPG public keys and shared via Git. Works well enough for us.
1. https://medium.com/@davidpiegza/using-pass-in-a-team-1aa7adf...
Earlier quoted context omitted.
Correct. Gopass has very early age support. It fully works but the UX is not great (yet).
Oh dammit. I have stopped using Gopass and rewrote pass just for that reason - missing AGE encryption. At least I have learned something new and I feel I have better UI - fuzzy finder instead of their TUI. However, big kudos to Gopass team for awesome work and really useful tool. Before I start working on next project... Do you recognize any mobile app, which could replace PasswordStore app for Android [0] but with A…
[1]: https://github.com/android-password-store/Android-Password-S...
Using single file for single password entry is very good idea. It's far better than any tools that opens the whole password database at once (KeePass, LastPass, Bitwarden etc). Reason is that you can use e.g. YubiKey to unlock individual entries on touch , this means that you can't lose whole password database on ransomware attack, (unless the ransomware has been there for a very long time). Filippo Valsorda wrote ab…
It also has a few downsides: Adding a new key requires re-encrypting every entry. Touching your yubikey hundreds of times gets old, fast.
With chezmoi you can use pass to store secrets in your dotfiles, for example if you want to set a secret API token in your ~/.bashrc you can use: export SECRET_API_TOKEN={{ pass "api/token" | quote }} For more info see https://github.com/twpayne/chezmoi/blob/master/docs/HOWTO.md... and https://github.com/twpayne/chezmoi/blob/master/README.md .
What is the `quote` command that example pipes to? Seems handy but unsurprisingly hard to search for.
[1] https://masterminds.github.io/sprig/strings.html [2] https://pkg.go.dev/text/template
I think use of the copy buffer is the weakness of pass. Can't it be read by any process?
In wayland you can pipe the password into wl-copy -o so it will only be pasted once then disappear.
In Xorg you'd need a callback after running pass that runs xclip -i /dev/null some time after the password is copied.
There is no good solution to this in Linux that does not involve discipline.
I think use of the copy buffer is the weakness of pass. Can't it be read by any process?
pass lets you use GPG-smartcards, and many of those (such as Yubikeys) will let you enforce touch-policies for signing/encruption.
As a combination of both these however, I must touch my Yubikey every time I pull a new docker image.
Another cool use-case is that I use the terraform-pass-provider to save secrets for my personal terraform project.
Earlier quoted context omitted.
It has probability 0 of running forever
Assuming a perfect RNG, but PRNGs don't have infinite state. So it's either impossible, or has a finite probability, with a finite probability for each of those cases, for an overall finite (non-zero) subjective probability of it running forever (in ideal program-space; obviously it will never run forever in real life).
Remember, we're not trying to read a whole password from the device, just one matching byte at a time. So, even if our password character set is a single character (pass will let you do that, but obviously you should not use such passwords in real life) we're talking about statistically 1 out of 256 bytes matches or else our PRNG is useless.
You correctly observe that the PRNG has finite state, but its state isn't so tiny that it only emits a handful of the 256 possible bytes before getting back to where it started, nobody would use such a busted algorithm.
RC4 is considered broken and unusable because the keystream is biased and thus distinguishable from random - to the extent that if you read a few million bytes from it you can detect the bias, but you're asking us to imagine that the random device has a PRNG many orders of magnitude worse in order for this to have any effect at all.
Earlier quoted context omitted.
I wrote a tool called hunter2 [0][1] which is very similar but uses PKCS#11 modules, which may be more common than GPG since the entire US Government uses them. [0] https://chiselapp.com/user/rkeene/repository/hunter2/ [1] https://github.com/rkeene/hunter2 (mirror)
How do you know my password?
Instead, stuff the creds into pass, and since dotenv leverages bash, you can put substitutions in your .envrc file. Bonus, now that the creds are in a personal secured repo, you don't have to go hunting for the creds every time you want to spin up a new dev machine. (you do unfortunately still have to migrate your .envrc, I tried writing git tooling to make it easier but I could never find a convenient place to store them. I have ideas to extend git to try out the next time I want to iterate on this)
This does require your app to be properly configurable with environment variables, meaning if an envvar is present, it should override all other settings. Envvars don't get set by accident so they should be treated as the ultimate settings. This is usually the case with most frameworks but I've run into Node apps where this wasn't the case. Maddening.