I know it's not FOSS but 1Password does have a decently fully-featured CLI client
(In)Security of the “Pass” password manager
21–30 of 87 posts
Re: (In)Security of the “Pass” password manager
#22Yeah, yeah, but if an adversary can do things like > replace the contents of ./Personal/malicious-site.com with the contents of ./Work/id_ed25519 then it's pretty much game over anyway.
1. presumably people using pass are using some sort of syncing system, which might be cloud based or otherwise compromised. 2. if that's "game over anyway", you might as well store your passwords in an unencrypted .txt file :^)
I probably could since I have my filesystem encrypted anyway and de facto do since my GPG keys are unlocked on login.
Re: (In)Security of the “Pass” password manager
#23Re: (In)Security of the “Pass” password manager
#24While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. As long as you understand its limitations…
>While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? >I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. How are people using pass then? Do they…
I said github, not git. You don't need to use a cloud service to use git for synchronization.
Re: (In)Security of the “Pass” password manager
#25I wonder what OP would think of this password manager recently mentioned on HN? https://news.ycombinator.com/item?id=34159631
Re: (In)Security of the “Pass” password manager
#26I like the command line capabilities of "pass", and I also agree with the author about some of its security issues and complexity. I created "passable" to do what I believe is a bit better (IMHO) for command line usage: symmetric encryption, and files do not use any particular in-the-clear directory structure. The code is POSIX shell, short,and easy to audit. MIT & Apache & GPL license. Constructive feedback welcome.…
Nice work. I know this is just a simple shell wrapper around gpg (which I appreciate), but if I was going to rely on this, I'd like to see: Prefer just a simple MIT over GPL (and properly license your repo on Github) Unit tests Build it with CI/CD Releases with tags Available on a package manager (brew/apt/...)
What is the problem with GPL if you’re a user and not trying to reuse the code in a closed-source product for sale?
Re: (In)Security of the “Pass” password manager
#27While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. As long as you understand its limitations…
>While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? >I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. How are people using pass then? Do they…
Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. Uploading your whole password tree to a public repository is a bad idea for reasons explicitly mentioned in the article (i.e. pass does not encrypt metadata about the file/directory names, git stores all creation/modification/deletion dates and times).
Re: (In)Security of the “Pass” password manager
#28Earlier quoted context omitted.
>While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? >I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. How are people using pass then? Do they…
I said github, not git. You don't need to use a cloud service to use git for synchronization.
You don't, but are people really manually running "git pull" between their various devices, or are they using a (self) hosted git service? Even in the self hosted case, I wouldn't want the security of all my passwords to be dependent on my $5/month VPS not being compromised.
Re: (In)Security of the “Pass” password manager
#29Earlier quoted context omitted.
Nice work. I know this is just a simple shell wrapper around gpg (which I appreciate), but if I was going to rely on this, I'd like to see: Prefer just a simple MIT over GPL (and properly license your repo on Github) Unit tests Build it with CI/CD Releases with tags Available on a package manager (brew/apt/...)
What is the problem with GPL if you’re a user and not trying to reuse the code in a closed-source product for sale?
KISS
This is a simple script, it deserves a simple license.
Nobody is going to 'sell' just a simple one page script and nothing prevents me from looking at the arguments it uses and putting them into my own commercial product. You don't 'license' arguments to gpg.
Re: (In)Security of the “Pass” password manager
#30While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. As long as you understand its limitations…
>While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? >I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. How are people using pass then? Do they…
When I used `pass`, I synced the password store between all my personal devices with Syncthing (non-centralized file syncing tool) and kept the store history with git. This worked surprisingly well and was even pleasantly usable on my phone with a third-party android app I found.