Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: The Standard Unix Password Manager

zx2c4.com

Post reply on HN
Print view View original

21–30 of 48 posts

Re: Pass: The Standard Unix Password Manager

#21

Post by dfcsd »

zx2c4 wrote: post #18
dfcsd wrote: post #16

It stores entries names in plaintext? Not very secure. I'll rather have log.tmp file container (with all encrypted passwords inside) than passwords\gmail.gpg

Usernames aren't considered to be privileged data. If you're relying on your usernames being secret, then you're making a big mistake and you should rethink things.

Single username isn't privileged data. But a set of usernames and realnames can be. It's better to lose a pendrive with encrypted block256.dat than Passwords\HackerNews\dfcsd.gpg, Passwords\Bank\34457356.gpg, Passwords\Mail\name.gmail.gpg etc.

Re: Pass: The Standard Unix Password Manager

#22

Post by zx2c4 »

dfcsd wrote: post #21
zx2c4 wrote: post #18

Earlier quoted context omitted.

Usernames aren't considered to be privileged data. If you're relying on your usernames being secret, then you're making a big mistake and you should rethink things.

Single username isn't privileged data. But a set of usernames and realnames can be. It's better to lose a pendrive with encrypted block256.dat than Passwords\HackerNews\dfcsd.gpg, Passwords\Bank\34457356.gpg, Passwords\Mail\name.gmail.gpg etc.

It shouldn't be considered secret, period. If you're worried about non-secret data being used to attack you (the kind of data people can acquire by digging through your trash when you bring it out to the curb, for example), then your likely-to-be-lost USB key should be using some encryption of its own. This encryption doesn't defeat the purpose of using pass, either, because pass uses gpg agent, where the key nicely times out after a while, whereas disk encryption is somewhat persistent. Regardless, username data isn't private, even when you have multiple in once place; all that data can be put together through other means.

Re: Pass: The Standard Unix Password Manager

#23

Post by mangodrunk »

zx2c4 wrote: post #18
dfcsd wrote: post #16

It stores entries names in plaintext? Not very secure. I'll rather have log.tmp file container (with all encrypted passwords inside) than passwords\gmail.gpg

Usernames aren't considered to be privileged data. If you're relying on your usernames being secret, then you're making a big mistake and you should rethink things.

Why is that the case? It seems to give someone a lot of information. It's not just relying on the username to be secret, but it gives info to someone that you may want to be secret, like a password to a pornographic site.

Nice app by the way.

Re: Pass: The Standard Unix Password Manager

#24

Post by zx2c4 »

mangodrunk wrote: post #23
zx2c4 wrote: post #18

Earlier quoted context omitted.

Usernames aren't considered to be privileged data. If you're relying on your usernames being secret, then you're making a big mistake and you should rethink things.

Why is that the case? It seems to give someone a lot of information. It's not just relying on the username to be secret, but it gives info to someone that you may want to be secret, like a password to a pornographic site. Nice app by the way.

Because this information is stored elsewhere, unencrypted almost always.

Re: Pass: The Standard Unix Password Manager

#25

Post by acabal »

zx2c4 wrote: post #11
acabal wrote: post #9

I was just recently looking for a simple password manager for Ubuntu, and Seahorse is so close . It unlocks with your login key so if you're logged in you don't have to keep entering a master password each time you need to retrieve a password; it stores everything in one easily-copyable encrypted file; and it's a core part of GNOME. But you can't store any metadata about the password, like a username! And that makes…

Hopefully you're able to fashion pass into storing the data you want? I don't like using my login key as a passphrase; seems flimsy, and I don't like having to use PAM tie-ins and whatnot when I change the system password. GPG has gpg-agent, so that it will keep the key decrypted for a set amount of time (or until logout, if you prefer), so this has pretty much the same function. Most importantly, a simple GPG file i…

Pass seems excellent but for me is also almost-there, because it doesn't unlock when I log in and I have to mess around with public/private keypairs. I prefer using passphrases because I travel a lot and if I lose my private key, it would be a monstrous hassle to get a backup private key in my hands securely. `gpg -c` is my go-to.

For me, unlock on login is essential. If someone beats me unconscious and steals my computer while I'm in a logged-in session, I have bigger things to worry about than a potentially lost password database.

On a tangential note, we as a hacker community really have to work on de-mystifying public/private keypair encryption. It gives me a headache to think about it and I've been a programmer for over a decade. If it does that to me then it's utterly unfathomable to laypeople and they're the ones who could make the most use out of strong encryption, and who could become the champions of privacy and security in the NSA-snooping age. But it's just too hard to explain and use.

Re: Pass: The Standard Unix Password Manager

#27

Post by gyepi »

zx2c4 wrote: post #20
gyepi wrote: post #19

I've been using (and updating) kedpm (python based FPM compatible password manager with GTK and CLI interfaces. found on sourceforce and github) for a few years now... This looks like a nice addition to the growing menagerie of password managers. All kedpm data, including entry names, are stored in an encrypted file. I think unencrypted filenames is a kind of information leakage; I may not want an attacker to know th…

Usernames aren't considered to be privileged data. If you're relying on your usernames being secret, then you're making a big mistake and you should rethink things. Alternatively, generic names. For search, just use grep. "pass | grep whatever" has worked pretty well for me when the tab completion did not. Or would you suggest an alternative approach? I'm open to ideas.

You're right usernames aren't considered privileged, but the list of services and associated usernames is not the kind of information I would want to necessarily make public. The names alone would be more revealing that I care to share.

Yeah, 'pass | grep foo' would work for search. I missed the default behaviour.

Re: Pass: The Standard Unix Password Manager

#28

Post by zx2c4 »

acabal wrote: post #25
zx2c4 wrote: post #11

Earlier quoted context omitted.

Hopefully you're able to fashion pass into storing the data you want? I don't like using my login key as a passphrase; seems flimsy, and I don't like having to use PAM tie-ins and whatnot when I change the system password. GPG has gpg-agent, so that it will keep the key decrypted for a set amount of time (or until logout, if you prefer), so this has pretty much the same function. Most importantly, a simple GPG file i…

Pass seems excellent but for me is also almost-there, because it doesn't unlock when I log in and I have to mess around with public/private keypairs. I prefer using passphrases because I travel a lot and if I lose my private key, it would be a monstrous hassle to get a backup private key in my hands securely. `gpg -c` is my go-to. For me, unlock on login is essential. If someone beats me unconscious and steals my com…

If you want to unlock on log-in, just have your gpg key unlocked by your login password. Gnome keychain is capable of this. Your request is a definite possibility.

I prefer having the key + passphrase over just a passphrase. It makes it more difficult for the information to leak.

That said, if you'd like a pass with a gpg -c mode, it shouldn't be hard to add. I could do this, or you could send a nice git formatted patch. Let me know.

Re: Pass: The Standard Unix Password Manager

#29

Post by maxs »

acabal wrote: post #9

I was just recently looking for a simple password manager for Ubuntu, and Seahorse is so close . It unlocks with your login key so if you're logged in you don't have to keep entering a master password each time you need to retrieve a password; it stores everything in one easily-copyable encrypted file; and it's a core part of GNOME. But you can't store any metadata about the password, like a username! And that makes…

If you're still looking for a password manager for Ubuntu, I really liked using KeepassX. It has password categories, lots of metadata. However, it doesn't unlock with the system.. :(

Re: Pass: The Standard Unix Password Manager

#30

Post by nikcub »

sciurus wrote: post #6

This looks more elegant than the hacked-together system I'm using for my passwords, but I don't see a way to store any metadata about the passwords other than the name. If you're looking for a command-line interface to a cross-platform password database, there's kpcli for keepassx. http://kpcli.sourceforge.net/ http://www.keepassx.org/ http://search.cpan.org/~rhandom/File-KeePass-0.03/lib/File/K...

I also use my own homebrew system that stores the password encrypted in the format of:

    ~/.passdb/username@site.com
I have a number of alises setup that will generate new passwords or retrieve a password for a domain. for eg.

    $ p news.ycombinator.com
Will decrypt the password and store it in the clipboard. I don't see any added benefit of having a complete application to manage this process, the ~20 lines of shell script is just fine and I consider having to re-enter the master password a feature.

Edit: I see now that this is just a shell script as well[1]. Nice. I might take some ideas from it such as auto completion

[1] http://git.zx2c4.com/password-store/tree/src/password-store....

Post reply on HN