Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: Unix Password Manager

passwordstore.org

Post reply on HN
Print view View original

51–60 of 186 posts

Re: Pass: Unix Password Manager

#51

Post by ggiesen »

lucb1e wrote: post #23

This is fun if you never leave yourself, but be wary with whom you share it. As a company password manager, there is no way to know who's accessed which secret across their lifetime at the firm so you get to change all the passwords constantly. (Or none, if you can't be bothered.) (Don't ask.) Or if someone newly needs access, there's no standard way of re-encrypting the files you're guessing they need. You need to h…

Bitwarden is pretty usable, we use it at our org, and while still has a rough edge or two for corporate use, gets better all the time.

Re: Pass: Unix Password Manager

#53

Post by drnick1 »

hyperpl wrote: post #27
drnick1 wrote: post #21

This is interesting for CLI lovers, but I feel KeepassXC on desktop + KeepassDX on Android (with the password DB stored on my own machine and accessed remotely via Wireguard) is a better solution for normies.

Any particular reason for remote access via wg and not via syncthing? I'm also curious how you access it via wg on Android?

I already use WG to access other services running on my LAN. The DB is on a Samba share, and I use KeePassDX as a client on my phone (GrapheneOS).

Re: Pass: Unix Password Manager

#54

Post by komali2 »

enkrs wrote: post #45

Browser password managers with passkeys are more convenient for me, but a pass vault can still be useful for recovery codes and API keys. I used pass for a while but couldn’t see what threat model it actually solves: If you let GPG agent cache your key, any script (e.g. an npm post-install) can just run `pass ls` or `pass my/secrets` and dump all your credentials. At that point it’s basically just full-disk encryptio…

I can't remember how but pass for me works in brave browser and Firefox, as well as on mobile. It's my only password manager. I'm assuming some browser plugin.

Re: Pass: Unix Password Manager

#55

Post by PhilipRoman »

drnick1 wrote: post #21

This is interesting for CLI lovers, but I feel KeepassXC on desktop + KeepassDX on Android (with the password DB stored on my own machine and accessed remotely via Wireguard) is a better solution for normies.

FYI for desktop there is a "passmenu" script that you can bind to a key in your DE/WM.

Re: Pass: Unix Password Manager

#56

Post by laszlojamf »

drnick1 wrote: post #21

This is interesting for CLI lovers, but I feel KeepassXC on desktop + KeepassDX on Android (with the password DB stored on my own machine and accessed remotely via Wireguard) is a better solution for normies.

"Normies"? Everything is relative, I guess. I use 1Password and just hope for the best.

Re: Pass: Unix Password Manager

#57

Post by puffybuf »

enkrs wrote: post #45

Browser password managers with passkeys are more convenient for me, but a pass vault can still be useful for recovery codes and API keys. I used pass for a while but couldn’t see what threat model it actually solves: If you let GPG agent cache your key, any script (e.g. an npm post-install) can just run `pass ls` or `pass my/secrets` and dump all your credentials. At that point it’s basically just full-disk encryptio…

I store my passwords on an encrypted file partition sqlite database. My script grabs the pass and immediately closes the partition afterwards.

You can also just encrypt your passwords into individual encrypted files (one for each password) and have your script clear the gpg agent after a passfile is decrypted.

Re: Pass: Unix Password Manager

#58

Post by rendaw »

There's a ton of positivity here, but on the balance there are some significant issues with pass that I think bear mention:

- The fact that it's essentially unstructured data makes it hard to work with generically. If you have a username + password and need to use those in a script, you'll need to implement your own parser in your shell language in every script you need it in.

- `pass generate` to generate new passwords, maybe thanks to the above, replaces everything in the pass value by default. So if you had e.g. a password + secret question answers, if you use `generate` to get a new password it'll wipe out your secret question answers.

- It's very difficult to review history. I stopped using it a while ago, but since everything's encrypted `git diff` won't give you anything useful and IIRC the command line tools were very hard to use for reviewing/restoring passwords when you mess up updates, etc.

- The name makes it nearly impossible to search for

I've been working on something similar... although with slightly larger scope (intended to be used within containers/sandboxes) https://github.com/andrewbaxter/passworth

Re: Pass: Unix Password Manager

#59

Post by tretiy3 »

notpushkin wrote: post #20
obk0943t wrote: post #8

There is still no just-download clients for pass on mobile which I think is why it's not a good option

There’s one for Android, though it has been looking for a new maintainer for a while now: https://github.com/android-password-store/Android-Password-S... Edit: looks like there’s a community fork now! https://github.com/agrahn/Android-Password-Store

Life saver! New version lacks OpenKeychain integration (they discuss in issues that it is also no longer maintained). Abandoned version of Android Password Store had some issues with embedded PGP manager and was not working for me. But this fork works!

Re: Pass: Unix Password Manager

#60

Post by ganomi »

lucb1e wrote: post #23

This is fun if you never leave yourself, but be wary with whom you share it. As a company password manager, there is no way to know who's accessed which secret across their lifetime at the firm so you get to change all the passwords constantly. (Or none, if you can't be bothered.) (Don't ask.) Or if someone newly needs access, there's no standard way of re-encrypting the files you're guessing they need. You need to h…

I have no practical experience yet, but i evaluated the market for a password sharing solution for a team with similar requirements within an enterprise.

Another option in that area is https://www.passbolt.com/

It uses a public/private key approach, where the plain passwords never leave the local machine and shared passwords are re-encrypted with each users public key.

Post reply on HN