Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: The Standard Unix Password Manager

zx2c4.com

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Pass: The Standard Unix Password Manager

#41

Post by zx2c4 »

repsilat wrote: post #40
ralphtinner wrote: post #7

Earlier quoted context omitted.

Lotta facets of unix philosophy. It manages passwords and it does that well. "pass -c HN/ralphtinner", and then my password is on the clipboard for 45 seconds. That's nice. From TFA, the password generation is via pwgen. Encrypted filesystems often require root privs or SUID helpers and don't have straight-forward ways to do key management and key expiration. This tool relies on gpg's already working agent.

> From TFA, the password generation is via pwgen. Seems strange to have the password generation "on the inside", though. That essentially means that `pwgen` is a strict dependency. Instead of writing something like pass generate Email/jasondonenfeld.com 15 the user should just type something like pwgen 15 1 | pass insert Email/jasondonenfeld.com That way they don't need `pwgen` to install `pass`. It also means that a…

Well, since pass is a shell script, and thus has no compilation, you don't need pwgen, and then you can just use "some-generator-program | pass insert blah" as you mentioned. For me, though pass generate Cheese 20 is a lot easier to remember than having to think about the options to pwgen. Pwgen, by default, makes passwords that are easy to remember, and there's some flag you have to hit to make them "truely random". I can't ever remember what this flag is.

With xclip, it's actually a bit more nuanced. You want this to be internal because I have some logic for removing the password from the clipboard after 45 seconds and putting the old clipboard contents back (if nothing else has replaced it in the meanwhile).

Re: Pass: The Standard Unix Password Manager

#42

Post by akldfgj »

ralphtinner wrote: post #7
caladri wrote: post #5

I'm not sure I see how this is in-keeping with any Unix philosophy I've encountered. "Everything's a file" is good, yes, but this program is needlessly-specific when what it does need not be. This is just a tool for browsing a file hierarchy in which the files happen to be GPG encrypted, right? Which one thing is this doing and doing well? Merely being command-line and somewhat file-oriented does not make Unix orient…

Lotta facets of unix philosophy. It manages passwords and it does that well. "pass -c HN/ralphtinner", and then my password is on the clipboard for 45 seconds. That's nice. From TFA, the password generation is via pwgen. Encrypted filesystems often require root privs or SUID helpers and don't have straight-forward ways to do key management and key expiration. This tool relies on gpg's already working agent.

> my password is on the clipboard for 45 seconds.

That's not very secure. Why not send the password directly to the input manager (as keyboard events or what-have-you), so the password only is seen by the app that needs it, instead of every app the user is running?

Re: Pass: The Standard Unix Password Manager

#43

Post by zx2c4 »

akldfgj wrote: post #42
ralphtinner wrote: post #7

Earlier quoted context omitted.

Lotta facets of unix philosophy. It manages passwords and it does that well. "pass -c HN/ralphtinner", and then my password is on the clipboard for 45 seconds. That's nice. From TFA, the password generation is via pwgen. Encrypted filesystems often require root privs or SUID helpers and don't have straight-forward ways to do key management and key expiration. This tool relies on gpg's already working agent.

> my password is on the clipboard for 45 seconds. That's not very secure. Why not send the password directly to the input manager (as keyboard events or what-have-you), so the password only is seen by the app that needs it, instead of every app the user is running?

Yea that sounds quite nice. Any suggestion on the best way to do this? I suppose there could be browser plugins that call out to pass, but what about a generic system? What would you recommend?

Re: Pass: The Standard Unix Password Manager

#44

Post by yason »

Coincidentally, I've also been using a GPG based password manager called 'pass' for about ten years or so. I publish its source code here, straight from my version control system called .bashrc:

    alias pass='gpg -o - ~/Important/passwords.gpg'
The gpg command will automagically use the relevant askpass dialog of the desktop of my choice, which I've set to expire after fifteen minutes. The above command will print a sorted list of entries in this format:

    site: username
    site: password
also known as a text file and extracting specific passwords goes by eyeballing the printed output or alternatively applying grep to only extract the stored data for a specific site. The final copying to the web browser happens via manual operation of mouse selection and the clipboard. I get rid of the plaintext passwords by actuating an operation called closing the terminal window.

Works just fine! And I got to choose the format of the datastore myself, too!

Re: Pass: The Standard Unix Password Manager

#45

Post by zx2c4 »

yason wrote: post #44

Coincidentally, I've also been using a GPG based password manager called 'pass' for about ten years or so. I publish its source code here, straight from my version control system called .bashrc : alias pass='gpg -o - ~/Important/passwords.gpg' The gpg command will automagically use the relevant askpass dialog of the desktop of my choice, which I've set to expire after fifteen minutes. The above command will print a s…

Yes, this is how mine started, and it works alright, except you don't have the niceties of clipboard management, password generation, really easy insertions, or revision logging. Mine started out as basically identical to yours though.

Re: Pass: The Standard Unix Password Manager

#46

Post by yason »

zx2c4 wrote: post #45
yason wrote: post #44

Coincidentally, I've also been using a GPG based password manager called 'pass' for about ten years or so. I publish its source code here, straight from my version control system called .bashrc : alias pass='gpg -o - ~/Important/passwords.gpg' The gpg command will automagically use the relevant askpass dialog of the desktop of my choice, which I've set to expire after fifteen minutes. The above command will print a s…

Yes, this is how mine started, and it works alright, except you don't have the niceties of clipboard management, password generation, really easy insertions, or revision logging. Mine started out as basically identical to yours though.

I could've guessed :) I've been resisting the urge to develop the text file further for ten years—it's been a valuable lesson of what's good enough when it comes to me.

Re: Pass: The Standard Unix Password Manager

#47

Post by joshka »

zx2c4 wrote: post #8
sciurus wrote: post #6

This looks more elegant than the hacked-together system I'm using for my passwords, but I don't see a way to store any metadata about the passwords other than the name. If you're looking for a command-line interface to a cross-platform password database, there's kpcli for keepassx. http://kpcli.sourceforge.net/ http://www.keepassx.org/ http://search.cpan.org/~rhandom/File-KeePass-0.03/lib/File/K...

This was exactly what I was trying to avoid. I don't want this big behemoth. I want something small and easy and simple. A file for each password. If I want additional data, I can just use multiline. Or, I can establish a .meta convention if I please. Or this, or that, or whatever. It's simple, and can be used in a million different mashups.

mbox vs maildir...
Post reply on HN