Pass: The Standard Unix Password Manager
1–10 of 48 posts
Re: Pass: The Standard Unix Password Manager
#2I've written a number of filesystem-based databases, and the problem that always comes up is keeping the entries consistent. You don't want a password database where the master password is different between entries, but with this system, you can't enforce that invariant until it's too late.
A better idea might be a system where the canonical source of truth is an application-controlled database, but where you can export entries to a directory tree and import entries from a directory tree. This makes syncing more difficult (export to directory tree on both sides, rsync, import on both sides), but it ensures that invariants are checked at sync time rather than use time.
I suppose you can write a validation command that you always run after sync, but how many people are going to run that? You don't realized you've been burned by having an extra password for an obscure site until that happens.
Re: Pass: The Standard Unix Password Manager
#3w00t a simple password manager that isn't totally bloated that I can use from the commandline. gpg is awesome too
Re: Pass: The Standard Unix Password Manager
#4I've written a number of filesystem-based databases, and the problem that always comes up is keeping the entries consistent. You don't want a password database where the master password is different between entries, but with this system, you can't enforce that invariant until it's too late. A better idea might be a system where the canonical source of truth is an application-controlled database, but where you can exp…
This seems really complicated. The whole point is to keep things simple and easy and not bloated with lots of applications and database formats and whatnot.
In any case, the GPG files have the ID of the key needed to decrypt them, so you can encrypt files with different keys, and so long as you have that key in your keychain still, you're good.
I guess I could add a simple convenience command "pass normalize" that decrypts everything and re-encrypts it using a single key. This would be a pretty simple way of doing it.
Re: Pass: The Standard Unix Password Manager
#5I'm not sure I see how this is in-keeping with any Unix philosophy I've encountered. "Everything's a file" is good, yes, but this program is needlessly-specific when what it does need not be. This is just a tool for browsing a file hierarchy in which the files happen to be GPG encrypted, right?
Which one thing is this doing and doing well? Merely being command-line and somewhat file-oriented does not make Unix orientation. The utility has numerous sub-commands, many of which are simply wrappers for other commands, like find(1) or tree(1). An encrypted file-system or some other way of encrypting the password hierarchy would seem to be exactly all the value this adds over simply using the extant set of Unix command-line tools. Most of this functionality simply duplicates the shell and cat(1).
It doesn't do one thing and well, it seems to do a small number of very general tasks in needlessly-specialized ways requiring arcane and unfamiliar incantations. The password generation stuff makes a fine stand-alone Unix utility. But git integration in the same program?
This is a front-end which brings with it a considerable number of ideas about policy, rather than simply providing a tool. Most of what it does could be handled much more simply by the filesystem and the extant tools it leverages or reimplements.
Re: Pass: The Standard Unix Password Manager
#6This looks more elegant than the hacked-together system I'm using for my passwords, but I don't see a way to store any metadata about the passwords other than the name.
If you're looking for a command-line interface to a cross-platform password database, there's kpcli for keepassx.
http://search.cpan.org/~rhandom/File-KeePass-0.03/lib/File/K...
Re: Pass: The Standard Unix Password Manager
#7I'm not sure I see how this is in-keeping with any Unix philosophy I've encountered. "Everything's a file" is good, yes, but this program is needlessly-specific when what it does need not be. This is just a tool for browsing a file hierarchy in which the files happen to be GPG encrypted, right? Which one thing is this doing and doing well? Merely being command-line and somewhat file-oriented does not make Unix orient…
Lotta facets of unix philosophy.
It manages passwords and it does that well. "pass -c HN/ralphtinner", and then my password is on the clipboard for 45 seconds. That's nice.
From TFA, the password generation is via pwgen.
Encrypted filesystems often require root privs or SUID helpers and don't have straight-forward ways to do key management and key expiration. This tool relies on gpg's already working agent.
Re: Pass: The Standard Unix Password Manager
#8This looks more elegant than the hacked-together system I'm using for my passwords, but I don't see a way to store any metadata about the passwords other than the name. If you're looking for a command-line interface to a cross-platform password database, there's kpcli for keepassx. http://kpcli.sourceforge.net/ http://www.keepassx.org/ http://search.cpan.org/~rhandom/File-KeePass-0.03/lib/File/K...
This was exactly what I was trying to avoid. I don't want this big behemoth. I want something small and easy and simple. A file for each password. If I want additional data, I can just use multiline. Or, I can establish a .meta convention if I please. Or this, or that, or whatever. It's simple, and can be used in a million different mashups.
Re: Pass: The Standard Unix Password Manager
#9I was just recently looking for a simple password manager for Ubuntu, and Seahorse is so close. It unlocks with your login key so if you're logged in you don't have to keep entering a master password each time you need to retrieve a password; it stores everything in one easily-copyable encrypted file; and it's a core part of GNOME. But you can't store any metadata about the password, like a username! And that makes it completely useless as a serious password storage interface. What good is a password if you can't easily store the username along with it?
If only someone would update Seahorse to store optional metadata along with passwords...
Re: Pass: The Standard Unix Password Manager
#10I've written a number of filesystem-based databases, and the problem that always comes up is keeping the entries consistent. You don't want a password database where the master password is different between entries, but with this system, you can't enforce that invariant until it's too late. A better idea might be a system where the canonical source of truth is an application-controlled database, but where you can exp…
That issue is solved here using GPG. Presuming you know how GPG works, your golden. Groking GPG is an issue, however -- it's an app that is not exactly user friendly.
For me, I love this, because I can secure passwords using my private key, stored on a GPG card. Of course, there are probably less than 250 people on earth doing that. :)