Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: The Standard Unix Password Manager

zx2c4.com

Post reply on HN
Print view View original

11–20 of 48 posts

Re: Pass: The Standard Unix Password Manager

#11

Post by zx2c4 »

acabal wrote: post #9

I was just recently looking for a simple password manager for Ubuntu, and Seahorse is so close . It unlocks with your login key so if you're logged in you don't have to keep entering a master password each time you need to retrieve a password; it stores everything in one easily-copyable encrypted file; and it's a core part of GNOME. But you can't store any metadata about the password, like a username! And that makes…

Hopefully you're able to fashion pass into storing the data you want? I don't like using my login key as a passphrase; seems flimsy, and I don't like having to use PAM tie-ins and whatnot when I change the system password. GPG has gpg-agent, so that it will keep the key decrypted for a set amount of time (or until logout, if you prefer), so this has pretty much the same function.

Most importantly, a simple GPG file is not an obscure file format.

Re: Pass: The Standard Unix Password Manager

#12

Post by zx2c4 »

Spooky23 wrote: post #10
jrockway wrote: post #2

I've written a number of filesystem-based databases, and the problem that always comes up is keeping the entries consistent. You don't want a password database where the master password is different between entries, but with this system, you can't enforce that invariant until it's too late. A better idea might be a system where the canonical source of truth is an application-controlled database, but where you can exp…

That issue is solved here using GPG. Presuming you know how GPG works, your golden. Groking GPG is an issue, however -- it's an app that is not exactly user friendly. For me, I love this, because I can secure passwords using my private key, stored on a GPG card. Of course, there are probably less than 250 people on earth doing that. :)

Whoa nice you have a GPG smart card? Very cool. There were some people giving out USB tokens at FOSDEM which looked sort of neat but I haven't gotten it working reliably.

GPG is mostly easy to use -- gpg -e -r someone@somewhere.com file.txt -- will encrypt that file for that recipient. Most of the basic stuff are easy. For creating a key and setting that up, I suppose this isn't super intuitive and nobody has those commands memorized, but there are so many guides out there for doing this. I think I started with the gentoo gpg guide [http://www.gentoo.org/doc/en/gnupg-user.xml].

Anyway, you're correct -- this is one of the reasons pass uses GPG.

Re: Pass: The Standard Unix Password Manager

#13

Post by zx2c4 »

ralphtinner wrote: post #7
caladri wrote: post #5

I'm not sure I see how this is in-keeping with any Unix philosophy I've encountered. "Everything's a file" is good, yes, but this program is needlessly-specific when what it does need not be. This is just a tool for browsing a file hierarchy in which the files happen to be GPG encrypted, right? Which one thing is this doing and doing well? Merely being command-line and somewhat file-oriented does not make Unix orient…

Lotta facets of unix philosophy. It manages passwords and it does that well. "pass -c HN/ralphtinner", and then my password is on the clipboard for 45 seconds. That's nice. From TFA, the password generation is via pwgen. Encrypted filesystems often require root privs or SUID helpers and don't have straight-forward ways to do key management and key expiration. This tool relies on gpg's already working agent.

Exactly.

Re: Pass: The Standard Unix Password Manager

#14

Post by jrockway »

Spooky23 wrote: post #10
jrockway wrote: post #2

I've written a number of filesystem-based databases, and the problem that always comes up is keeping the entries consistent. You don't want a password database where the master password is different between entries, but with this system, you can't enforce that invariant until it's too late. A better idea might be a system where the canonical source of truth is an application-controlled database, but where you can exp…

That issue is solved here using GPG. Presuming you know how GPG works, your golden. Groking GPG is an issue, however -- it's an app that is not exactly user friendly. For me, I love this, because I can secure passwords using my private key, stored on a GPG card. Of course, there are probably less than 250 people on earth doing that. :)

I have a GPG smartcard. The problem is that no readily-available card readers work under Linux. I had one on a Dell laptop of Core Duo vintage many years ago; after I got a new machine, I could never find a working card reader.

Re: Pass: The Standard Unix Password Manager

#15

Post by morpher »

This looks nice. I've been doing something similar by hand for e.g offlineimap and msmtp passwords that I didn't want to store in plain text. I had planned on writing a similar utility to manage things, and it looks like now I won't have to. Thanks for sharing.

Re: Pass: The Standard Unix Password Manager

#17

Post by zx2c4 »

morpher wrote: post #15

This looks nice. I've been doing something similar by hand for e.g offlineimap and msmtp passwords that I didn't want to store in plain text. I had planned on writing a similar utility to manage things, and it looks like now I won't have to. Thanks for sharing.

Great! Glad you like it. Let me know if you have any suggestions or feature requests.

Re: Pass: The Standard Unix Password Manager

#18

Post by zx2c4 »

dfcsd wrote: post #16

It stores entries names in plaintext? Not very secure. I'll rather have log.tmp file container (with all encrypted passwords inside) than passwords\gmail.gpg

Usernames aren't considered to be privileged data. If you're relying on your usernames being secret, then you're making a big mistake and you should rethink things.

Re: Pass: The Standard Unix Password Manager

#19

Post by gyepi »

I've been using (and updating) kedpm (python based FPM compatible password manager with GTK and CLI interfaces. found on sourceforce and github) for a few years now...

This looks like a nice addition to the growing menagerie of password managers.

All kedpm data, including entry names, are stored in an encrypted file. I think unencrypted filenames is a kind of information leakage; I may not want an attacker to know that I even a password to a specific service.

Also, I don't see a mechanism to search for entries. I have hundreds of password entries so search (on any field) is critical for me.

With the ability to search (assuming it's fast), the first problem could be mitigated by using generated file names.

Re: Pass: The Standard Unix Password Manager

#20

Post by zx2c4 »

gyepi wrote: post #19

I've been using (and updating) kedpm (python based FPM compatible password manager with GTK and CLI interfaces. found on sourceforce and github) for a few years now... This looks like a nice addition to the growing menagerie of password managers. All kedpm data, including entry names, are stored in an encrypted file. I think unencrypted filenames is a kind of information leakage; I may not want an attacker to know th…

Usernames aren't considered to be privileged data. If you're relying on your usernames being secret, then you're making a big mistake and you should rethink things. Alternatively, generic names.

For search, just use grep. "pass | grep whatever" has worked pretty well for me when the tab completion did not. Or would you suggest an alternative approach? I'm open to ideas.

Post reply on HN