(In)Security of the “Pass” password manager
1–10 of 87 posts
Re: (In)Security of the “Pass” password manager
#2Is a better alternative to store passwords in an encrypted SQLite database? That would address the problems with the directory structure and Git.
Re: (In)Security of the “Pass” password manager
#3Just use KeePass. It allows you to encrypt with a key, if that's your thing.
Edit: just noticed they recommend KeePass at the end. Damn I'm good.
Re: (In)Security of the “Pass” password manager
#4I like the command line capabilities of "pass", and I also agree with the author about some of its security issues and complexity.
I created "passable" to do what I believe is a bit better (IMHO) for command line usage: symmetric encryption, and files do not use any particular in-the-clear directory structure.
The code is POSIX shell, short,and easy to audit. MIT & Apache & GPL license. Constructive feedback welcome.
Re: (In)Security of the “Pass” password manager
#5I am researching password books at the moment https://passwordbook.org/7-benefits-of-using-a-password-book...
Re: (In)Security of the “Pass” password manager
#6The KeePass format has been around for years. I don't really understand why people keep using pass, or why it bills itself as the "standard" Unix password manager.
There are also already command line KeePass utilities, like passhole [0] (mine) and keepassxc-cli.
[0]: https://github.com/evidlo/passhole [1]: https://keepassxc.org/docs/KeePassXC_UserGuide.html
Re: (In)Security of the “Pass” password manager
#7While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal?
I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway.
As long as you understand its limitations pass is nice precisely because it's simple and basically just a wrapper around git + gnupg.
In comparison, most cloud password managers don't have these specific issues, but they are also very likely less secure in other ways.
Re: (In)Security of the “Pass” password manager
#8I've never understood the "complexity" of PGP/GNuPG. Granted the man page is dozens of pages long, but I find it no more complicated than any other command line tool. Maybe it is because I have used it professionally and personally forever.
The author of Age has ported Pass to use Age as the encryption scheme if one needs a modern solution.
As for reading the directory structure, you don't have to put your passwords in a directory structure and just do security by obscurity.... But, if some has access to my local machine, I have bigger issues.
Re: (In)Security of the “Pass” password manager
#9Is a better alternative to store passwords in an encrypted SQLite database? That would address the problems with the directory structure and Git.
I think KeePass is better than a bespoke format just because there are already clients written for it on every platform.
Re: (In)Security of the “Pass” password manager
#10I like the command line capabilities of "pass", and I also agree with the author about some of its security issues and complexity. I created "passable" to do what I believe is a bit better (IMHO) for command line usage: symmetric encryption, and files do not use any particular in-the-clear directory structure. The code is POSIX shell, short,and easy to audit. MIT & Apache & GPL license. Constructive feedback welcome.…
Nice work. I know this is just a simple shell wrapper around gpg (which I appreciate), but if I was going to rely on this, I'd like to see:
Prefer just a simple MIT over GPL (and properly license your repo on Github)
Unit tests
Build it with CI/CD
Releases with tags
Available on a package manager (brew/apt/...)