101–110 of 186 posts
Best practice question for syncing pass across devices: Since exporting and re-importing the private key to a phone seems risky, is the recommended approach to generate a separate GPG key pair on the mobile device and re-encrypt secrets to it?
This is fun if you never leave yourself, but be wary with whom you share it. As a company password manager, there is no way to know who's accessed which secret across their lifetime at the firm so you get to change all the passwords constantly. (Or none, if you can't be bothered.) (Don't ask.) Or if someone newly needs access, there's no standard way of re-encrypting the files you're guessing they need. You need to h…
Earlier quoted context omitted.
My current employer uses 1password and it has a couple of nifty features like "vaults" shared with a group of people, an "op run" command to inject secrets using a .env file, service accounts to fetch passwords in CI, etc.
It has dev environments now too! https://developer.1password.com/docs/environments/
So adding a new collaborator to the project would involve adding them to the vault, then there is a shell script in the project that uses the CLI to write a new `.env` depending on the values from `op`.
Seems like this new environment stuff wouldn't add anything compared to such setup, at least today, is that fair? Seems to be even more manual and require copy-pasting, unless I misunderstand what the feature actually is.
This is interesting for CLI lovers, but I feel KeepassXC on desktop + KeepassDX on Android (with the password DB stored on my own machine and accessed remotely via Wireguard) is a better solution for normies.
Happy pass user for ~8 years now, have ~1300 passwords stored. No issues whatsoever. Use git to sync it across devices, totally awesome.
How do you have 1300 passwords? Sounds like a lot. Come to think of it though, I have no idea how many I have.
There's a ton of positivity here, but on the balance there are some significant issues with pass that I think bear mention: - The fact that it's essentially unstructured data makes it hard to work with generically. If you have a username + password and need to use those in a script, you'll need to implement your own parser in your shell language in every script you need it in. - `pass generate` to generate new passwo…
If you blat your password with generate, it can be recovered because it is in git. A nice to have for pass might be a flag to autoinsert only on the first line, but in lieu of that, pwgen should do the job and is what pass uses under the hood.
Browser password managers with passkeys are more convenient for me, but a pass vault can still be useful for recovery codes and API keys. I used pass for a while but couldn’t see what threat model it actually solves: If you let GPG agent cache your key, any script (e.g. an npm post-install) can just run `pass ls` or `pass my/secrets` and dump all your credentials. At that point it’s basically just full-disk encryptio…
Earlier quoted context omitted.
Memory isolation doesn't really help, though. If you have a malicious process running under the same user account as your password manager, it's still game over since that process could e.g. - capture keyboard input - capture your screen - silently install browser extensions to capture your credentials - modify your shell config, .desktop files, $PATH, … to have you e.g. call a backdoored version of your password man…
For modern operating systems capturing keyboard input is locked down to avoid keyloggers. Capturing your screen requires explicit user permission to do so, popping up a dialog. Apps are isolated so another app can't interfere and install a browser extention or modify shell configs, etc.
Two main reasons:
1. This laptop up was set up with flatpak versions of all GUI applications, including Firefox, and the browser plugin just doesn't work. I persisted with the work-around of `pass -c ` from the run command prompt for a while to paste into the browser, but its not ideal.
2. I realised that the Android app was archived. There's at least one fork, but who knows how that will be maintained going forward. https://github.com/android-password-store/Android-Password-S...
For now I'm content with hosting vaultwarden and using various Bitwarden clients.
Earlier quoted context omitted.
"Normies"? Everything is relative, I guess. I use 1Password and just hope for the best.
Right. Having an own machine 24/7 online and setting up wireguard to it does not sound very typical. I use pass myself and I don't care about mobile. But I really don't know what to recommend family members.