Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

(In)Security of the “Pass” password manager

rot256.dev

Post reply on HN
Print view View original

31–40 of 87 posts

Re: (In)Security of the “Pass” password manager

#31

Post by eptcyka »

gruez wrote: post #28
resoluteteeth wrote: post #24

Earlier quoted context omitted.

I said github, not git. You don't need to use a cloud service to use git for synchronization.

You don't, but are people really manually running "git pull" between their various devices, or are they using a (self) hosted git service? Even in the self hosted case, I wouldn't want the security of all my passwords to be dependent on my $5/month VPS not being compromised.

I believe that people do just sync got repos between machines. 5$ VPSes, Raspberry Pi's, laptops from 2009. Why not?

Also, what is there to compromise on a machine that basically runs just sshd with password authentication disabled?

Re: (In)Security of the “Pass” password manager

#32

Post by [deleted] »

nixpulvis wrote: post #12
resoluteteeth wrote: post #7

While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. As long as you understand its limitations…

I know there are people who wrap their entire PASSWORD_STORE in another layer of encryption (ideally through the filesystem) to solve this. But it can be cumbersome to maintain wrappers.

[deleted]

Re: (In)Security of the “Pass” password manager

#33

Post by gnoack »

gruez wrote: post #19
resoluteteeth wrote: post #7

While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. As long as you understand its limitations…

>While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? >I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. How are people using pass then? Do they…

Git over SSH to the Raspberry Pi.

You do not need a "hosted" git environment to keep a repo in a central location; a simple Unix account is enough.

Re: (In)Security of the “Pass” password manager

#34

Post by monopoliessuck »

resoluteteeth wrote: post #7

While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. As long as you understand its limitations…

> except for the site names not being encrypted

I just use ctmg authored by the same guy and a simple script to open and close both. If you want, you can then throw this anywhere.

https://git.zx2c4.com/ctmg/about/

Re: (In)Security of the “Pass” password manager

#35

Post by forgotpwd16 »

>RSA (and all other public key crypto systems supported by PGP) will be broken by Shor’s algorithm

Seems there's work going towards, or at least the idea is being explored, adding PQC to OpenPGP.

https://www.ietf.org/id/draft-wussler-openpgp-pqc-00.html

https://datatracker.ietf.org/meeting/113/materials/slides-11...

>If you insist on using Pass, I highly recommend using a separate PGP key just for Pass.

Will guess that's how most people use it already. Separating keys for usage is afterall something core in PGP.

Re: (In)Security of the “Pass” password manager

#36

Post by avgcorrection »

resoluteteeth wrote: post #7

While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. As long as you understand its limitations…

> but pass also isn't a cloud service [...] In comparison, most cloud ... cloud cloud cloud

The authors recommends KeepassXC instead.

Re: (In)Security of the “Pass” password manager

#37

Post by gruez »

phoe-krk wrote: post #27
gruez wrote: post #19

Earlier quoted context omitted.

>While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? >I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. How are people using pass then? Do they…

Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. Uploading your whole password tree to a public repository is a bad idea for reasons explicitly mentioned in the article (i.e. pass does not encrypt metadata about the file/directory names, git stores all creation/modification/deletion dates and times).

>Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there.

I'm not sure whether that's actually better than storing it on github (or any other professionally managed git instance). Sure, you gain some security by obscurity (because your VPS isn't a juicy target like github is), but that's about it. If the FBI is after you, they can send a letter to your VPS provider just like they can send a letter to github. I probably also expect github to do a better job at keeping their systems secure than an amateur sysadmin. In both cases the chance of getting hacked is fairly low, but the whole point of a password manager is that you don't have to rely on the storage service being secure to keep your passwords safe. If you need to rely on the storage service (eg. git server) to be not compromised for your passwords to be safe, then that kills a large benefit of using a password manager.

Re: (In)Security of the “Pass” password manager

#39

Post by gruez »

eptcyka wrote: post #31
gruez wrote: post #28

Earlier quoted context omitted.

You don't, but are people really manually running "git pull" between their various devices, or are they using a (self) hosted git service? Even in the self hosted case, I wouldn't want the security of all my passwords to be dependent on my $5/month VPS not being compromised.

I believe that people do just sync got repos between machines. 5$ VPSes, Raspberry Pi's, laptops from 2009. Why not? Also, what is there to compromise on a machine that basically runs just sshd with password authentication disabled?

> I believe that people do just sync got repos between machines. 5$ VPSes, Raspberry Pi's, laptops from 2009. Why not?

it's a pain because of NAT/port forwarding, not to mention the chore of making sure every device is up to date. You can get around the NAT/port forwarding issue by having a $5 VPS, but then you're essentially storing your password database on dropbox.

>Also, what is there to compromise on a machine that basically runs just sshd with password authentication disabled?

1. Same way that dropbox can be compromised: your account gets hacked or the provider gets hacked.

2. While I agree that a server with only sshd and auto-updates enabled would be pretty hard to compromise (foregoing the above), I doubt that's the typical setup. Most people probably have a "general purpose" VPS that they use to host all sorts of stuff, which means there's lots blindly typing in "npm install ..." or even "curl ... | sh" going on.

Re: (In)Security of the “Pass” password manager

#40

Post by captn3m0 »

zikduruqe wrote: post #8

I've never understood the "complexity" of PGP/GNuPG. Granted the man page is dozens of pages long, but I find it no more complicated than any other command line tool. Maybe it is because I have used it professionally and personally forever. The author of Age has ported Pass to use Age as the encryption scheme if one needs a modern solution. As for reading the directory structure, you don't have to put your passwords…

The agent-driven nature of PGP, along with the encoding itself (which was primarily meant for emails) adds a lot of complexity, and makes it much harder to setup, configure, and use safely compared to other tools.

It is a tool trying to securely manage keys in an insecure environment, and even offloading some parts (such as to a yubikey) doesn't make it any easier to use.

Post reply on HN