Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: Unix Password Manager

passwordstore.org

Post reply on HN
Print view View original

71–80 of 186 posts

Re: Pass: Unix Password Manager

#71

Post by usr1106 »

laszlojamf wrote: post #56
drnick1 wrote: post #21

This is interesting for CLI lovers, but I feel KeepassXC on desktop + KeepassDX on Android (with the password DB stored on my own machine and accessed remotely via Wireguard) is a better solution for normies.

"Normies"? Everything is relative, I guess. I use 1Password and just hope for the best.

Right. Having an own machine 24/7 online and setting up wireguard to it does not sound very typical.

I use pass myself and I don't care about mobile. But I really don't know what to recommend family members.

Re: Pass: Unix Password Manager

#72

Post by yehoshuapw »

enkrs wrote: post #45

Browser password managers with passkeys are more convenient for me, but a pass vault can still be useful for recovery codes and API keys. I used pass for a while but couldn’t see what threat model it actually solves: If you let GPG agent cache your key, any script (e.g. an npm post-install) can just run `pass ls` or `pass my/secrets` and dump all your credentials. At that point it’s basically just full-disk encryptio…

it took a while to get it to work well, but I use yubikey here, and recommend it. I do need to find and pulg it in sometimes, but overall might leave it plugged in. and I have it configured to require a touch for every operation

Re: Pass: Unix Password Manager

#73

Post by stevekemp »

rendaw wrote: post #58

There's a ton of positivity here, but on the balance there are some significant issues with pass that I think bear mention: - The fact that it's essentially unstructured data makes it hard to work with generically. If you have a username + password and need to use those in a script, you'll need to implement your own parser in your shell language in every script you need it in. - `pass generate` to generate new passwo…

For the structure I "solved" that problem by creating folders with three main files:

    Websites/foo.com/username
    Websites/foo.com/password
    Websites/foo.com/email
Sometimes I add "/notes" with unstructured text contents, and for a few special cases I created a file "/json" with some machine-readable things in JSON format.

It's not perfect, and I do dislike the way that the metadata isn't encrypted, but on the whole I'm happy with the solution.

Re: Pass: Unix Password Manager

#74

Post by echo42null »

Best practice question for syncing pass across devices: Since exporting and re-importing the private key to a phone seems risky, is the recommended approach to generate a separate GPG key pair on the mobile device and re-encrypt secrets to it?

Re: Pass: Unix Password Manager

#76

Post by mid-kid »

drnick1 wrote: post #21

This is interesting for CLI lovers, but I feel KeepassXC on desktop + KeepassDX on Android (with the password DB stored on my own machine and accessed remotely via Wireguard) is a better solution for normies.

The only use case of mine that's not solved by keepass is creating passwords on two separate machines without a direct connection, and merging them later.

Re: Pass: Unix Password Manager

#77

Post by Kwpolska »

msravi wrote: post #25

There's also the pass-otp extension that generates OTPs! https://github.com/tadfisher/pass-otp The pass android app is really nice too https://play.google.com/store/apps/details?id=dev.msfjarvis.... It also works in termux

> This app isn't available for your device because it was made for an older version of Android.

And no, those apps don't work great, because they involve some clunky GPG app.

Re: Pass: Unix Password Manager

#78

Post by realusername »

Kwpolska wrote: post #75

Pass might work if you really like terminals and only use computers with a Unix-like OS. But if you use a phone, or Windows, pass is just too clunky to use.

I'm using pass on a phone with Termux.

Sure it's a bit clunky but it's been working since 2014 without any interrution or privacy leak. I can't say the same about most password manager.

Re: Pass: Unix Password Manager

#79

Post by aborsy »

charcircuit wrote: post #69
aborsy wrote: post #48

Earlier quoted context omitted.

That’s true for any password manager. If the database/store is unlocked (so the master password is cached or available in RAM), all passwords can be extracted. You have to lock the password manager when you don’t need it. In fact, with Bitwarden, the cached password is exposed to the browser that has a large attack surface (including interacting with random remote servers). There was just a vulnerability in most brow…

>That’s true for any password manager Modern operating systems isolate individual apps such that a malicous app can not access the RAM of another app. There is a difference between not making an effort to protect passwords and requiring an OS exploit to do so.

The OS protections apply to all applications. In addition, the job of agents like gpg-agent or ssh-agent is to protect secret keys while they are cached (like preventing OS writing keys to swaps). You can configure them to erase keys after a certain time, require user’s confirmation for each key operation, store gpg keys in internal TPM or external hsm, and would talk to the agent through specific sockets.

Unlike browser-based password managers, the agents don’t continuously interact with the browser code and remote elements (probably don’t have network access at all).

One area that matters that I forgot to mention in my comment below is that, as a result of all above, Pass doesn’t check the domains and doesn’t protect against phishing. There might be extensions, but at that point, you might as well use keepassxc.

Re: Pass: Unix Password Manager

#80

Post by codethief »

charcircuit wrote: post #69
aborsy wrote: post #48

Earlier quoted context omitted.

That’s true for any password manager. If the database/store is unlocked (so the master password is cached or available in RAM), all passwords can be extracted. You have to lock the password manager when you don’t need it. In fact, with Bitwarden, the cached password is exposed to the browser that has a large attack surface (including interacting with random remote servers). There was just a vulnerability in most brow…

>That’s true for any password manager Modern operating systems isolate individual apps such that a malicous app can not access the RAM of another app. There is a difference between not making an effort to protect passwords and requiring an OS exploit to do so.

Memory isolation doesn't really help, though. If you have a malicious process running under the same user account as your password manager, it's still game over since that process could e.g.

- capture keyboard input - capture your screen - silently install browser extensions to capture your credentials - modify your shell config, .desktop files, $PATH, … to have you e.g. call a backdoored version of your password manager, or put a modified version of sudo on your $PATH that logs your password (=> root access => full memory access) - …

Post reply on HN