Pass: Unix Password Manager • Hacker News Board

Re: Pass: Unix Password Manager

#11

Post by mjd » Sun, Sep 14, 2025, 1:47 AM UTC

I've been doing basically this for many years now.

Each password file is AES-encrypted with my master password.

I copy the whole vault around between machines with rsync.

When I run 'password bank' a shell script searches ~/private/Passwords for files that contain ‘bank’ and offers a menu, then gpg-decrypts the file I selected.

I also use this for scans of my passport, recording my bank account numbers, and anything else I want to keep around.

I thought I was the only one, and now I've found out there are thousands of us!

Re: Pass: Unix Password Manager

#12

Post by braincat31415 » Sun, Sep 14, 2025, 1:50 AM UTC

obk0943t wrote: post #8

There is still no just-download clients for pass on mobile which I think is why it's not a good option

I use it inside termux on android. There is a termux pass package. But it might be hard to input a complex decryption password on the phone keyboard.

Re: Pass: Unix Password Manager

#13

Post by andrewrn » Sun, Sep 14, 2025, 1:52 AM UTC

Growing tired of Bitwarden in the browser, so this is pretty intriguing. But its hard to forgo mobile compatibility.

Re: Pass: Unix Password Manager

#14

Post by hyperpl » Sun, Sep 14, 2025, 1:53 AM UTC

I used pass for many years and loved it. I sync'd my password store between 3+ devices including my Android phone using a git remote. I don't recall the exact reason - maybe the pass android client I had used for years went away? I decided to find the next best option and settled on keepassxc and KeePassDX. The backing store is a binary blob but it does surprisingly well via syncthing: autoupdate works and in the event of a conflict the db merge feature hasn't yet failed me.

Granted on the desktop I find using a (qt especially) GUI more invasive than a terminal but at least on the Android side the app is quite good.

Re: Pass: Unix Password Manager

#15

Post by gmuslera » Sun, Sep 14, 2025, 1:53 AM UTC

sgsjchs wrote: post #3

Why would you want to store arbitrary individual passwords instead of deriving them with on demand from the service name/domain and a common secret?

Not all sites are safe, either by design or by people running them. Having a common secret+service name as password AND having at least one of those sites leaking your plaintext password could mean that your derivation may go public and all your other passwords and services fall because of that.

Re: Pass: Unix Password Manager

#16

Post by awaymazdacx5 » Sun, Sep 14, 2025, 1:53 AM UTC

I have twelve ISBNs that I encrypt for passwords.

Depending on which genre, managing key-rings has element of physical security to encrypt signatures in terminal and bash shell.

For full disk encryption, genfstab and /boot/grub/grub.cfg should contain sigs for partitions.

Re: Pass: Unix Password Manager

#17

Post by [deleted] » Sun, Sep 14, 2025, 1:56 AM UTC

ragnot wrote: post #2

If you are using age instead of GPG for encryption purposes, I've found this to be useful: https://github.com/FiloSottile/passage

[deleted]

Re: Pass: Unix Password Manager

#18

Post by rasengan » Sun, Sep 14, 2025, 1:57 AM UTC

Another great software contribution to the world by Jason Donenfeld, creator of WireGuard!

Re: Pass: Unix Password Manager

#19

Post by lucb1e » Sun, Sep 14, 2025, 1:57 AM UTC

snailmailman wrote: post #4

sgsjchs wrote: post #3

Why would you want to store arbitrary individual passwords instead of deriving them with on demand from the service name/domain and a common secret?

If you are doing that, - what if some site has weird password requirements and the derived password doesn’t work - what if a site gets hacked and you need to rotate one password. If you have to store data per-site anyway because of those cases, may as well just store passwords. You can (and should) still generate extremely high entropy passwords.

indeed. Additionally:

- if your secret leaks and you don't know it (or you do know, but you need some time to change it), the attacker not only gets the snapshot of your password manager but also can derive all future passwords you'll generate, or past ones you long forgot about

- there's no way to know what you've entered before, since it's stateless. With data stored in a manager, I know what username I used and can associate other data. If your uniqueifying input is the domain, and let's say HN would become hn.yc or whatever and you visit it again in ten years, you'd have to remember that hn.yc accepts the password of what you entered as news.ycombinator.com

I have to admit though, hash(name+secret)=password is so simple and beautiful that it draws IT people like a fine artwork draws visitors. But for me, that doesn't outweigh the practical issues

Re: Pass: Unix Password Manager

#20

Post by notpushkin » Sun, Sep 14, 2025, 1:58 AM UTC

obk0943t wrote: post #8

There is still no just-download clients for pass on mobile which I think is why it's not a good option

There’s one for Android, though it has been looking for a new maintainer for a while now: https://github.com/android-password-store/Android-Password-S...

Edit: looks like there’s a community fork now! https://github.com/agrahn/Android-Password-Store