Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: Unix Password Manager

passwordstore.org

Post reply on HN
Print view View original

111–120 of 186 posts

Re: Pass: Unix Password Manager

#111

Post by upofadown »

rendaw wrote: post #58

There's a ton of positivity here, but on the balance there are some significant issues with pass that I think bear mention: - The fact that it's essentially unstructured data makes it hard to work with generically. If you have a username + password and need to use those in a script, you'll need to implement your own parser in your shell language in every script you need it in. - `pass generate` to generate new passwo…

There is a bit of structure imposed if you want to use the provided automation for inserting passwords in the clipboard. The password comes as the first line. Then you are going to end up with the user name on the second line. Everything past that point is gloriously unstructured. I have a pass entry floating around here with an entire onboarding email in it...

Re: Pass: Unix Password Manager

#112

Post by integralid »

stevekemp wrote: post #73
rendaw wrote: post #58

There's a ton of positivity here, but on the balance there are some significant issues with pass that I think bear mention: - The fact that it's essentially unstructured data makes it hard to work with generically. If you have a username + password and need to use those in a script, you'll need to implement your own parser in your shell language in every script you need it in. - `pass generate` to generate new passwo…

For the structure I "solved" that problem by creating folders with three main files: Websites/foo.com/username Websites/foo.com/password Websites/foo.com/email Sometimes I add "/notes" with unstructured text contents, and for a few special cases I created a file "/json" with some machine-readable things in JSON format. It's not perfect, and I do dislike the way that the metadata isn't encrypted, but on the whole I'm…

Yeah, but that's just your convention. I, for example, store password in

private/foo.com/foo-com-login

The first line of that file is password, the rest are optional notes. I think using first line for password and the rest for metadata was intended originally.

I love pass, but I agree that it would be nice to have an established standard of where to put username etc.

Re: Pass: Unix Password Manager

#113

Post by oguz-ismail »

rendaw wrote: post #58

There's a ton of positivity here, but on the balance there are some significant issues with pass that I think bear mention: - The fact that it's essentially unstructured data makes it hard to work with generically. If you have a username + password and need to use those in a script, you'll need to implement your own parser in your shell language in every script you need it in. - `pass generate` to generate new passwo…

> I've been working on something similar...

but this is not a shell script...

Re: Pass: Unix Password Manager

#114

Post by jeduardo »

denismi wrote: post #109

I recently moved away from pass after a decade or so. Two main reasons: 1. This laptop up was set up with flatpak versions of all GUI applications, including Firefox, and the browser plugin just doesn't work. I persisted with the work-around of `pass -c ` from the run command prompt for a while to paste into the browser, but its not ideal. 2. I realised that the Android app was archived. There's at least one fork, bu…

How has it been working for you so far?

I'm in a similar situation and considering doing the same thing as you, for the same reasons, but I'm curious about how the offline experience is.

I'm often facing periods of bad to no connectivity, and I find the ability to lookup or even update a credential offline very useful. Not sure how much of it is possible with Vaulwarden and I couldn't find the time to try it yet.

Re: Pass: Unix Password Manager

#115

Post by fooqux »

denismi wrote: post #109

I recently moved away from pass after a decade or so. Two main reasons: 1. This laptop up was set up with flatpak versions of all GUI applications, including Firefox, and the browser plugin just doesn't work. I persisted with the work-around of `pass -c ` from the run command prompt for a while to paste into the browser, but its not ideal. 2. I realised that the Android app was archived. There's at least one fork, bu…

Well shit, I didn't realize the Android app was shelved. I checked out the fork and it looks like they're doing good work there. I'm a bit surprised that the maintainers of both didn't work out a transfer; who else better to take over the project than a active fork?

Makes me wonder if something else was the issue, such as disagreeing over security practices or the like.

> I persisted with the work-around of `pass -c ` from the run command prompt for a while to paste into the browser, but its not ideal.

I actually do this on purpose. The last time I checked into the plugin, it looked like it unlocked your gpg key at Firefox launch rather than at password prompt time. Also, I didn't like the fact that the plugin creator could simply send my passwords to themselves without my knowledge. Firefox and pass are big/trusted enough to not do this. But some random guy? That was outside my risk tolerance.

Re: Pass: Unix Password Manager

#116

Post by fooqux »

4k93n2 wrote: post #96
drnick1 wrote: post #21

This is interesting for CLI lovers, but I feel KeepassXC on desktop + KeepassDX on Android (with the password DB stored on my own machine and accessed remotely via Wireguard) is a better solution for normies.

keepass has a very underrated feature i never see much talk about where you can have multiple vaults and have them open and search both at the same time (or at least the two apps you mentioned support that anyway). most password managers are based around the idea of one single vault which creates the problem of having to treat every password like it needs the maximum amount of security. in my own case i would guess m…

Pass actually has a similar feature: different directories in your git repo can have different gpg keys, effectively doing the same thing you like.

Re: Pass: Unix Password Manager

#117

Post by LtWorf »

charcircuit wrote: post #85
codethief wrote: post #80

Earlier quoted context omitted.

Memory isolation doesn't really help, though. If you have a malicious process running under the same user account as your password manager, it's still game over since that process could e.g. - capture keyboard input - capture your screen - silently install browser extensions to capture your credentials - modify your shell config, .desktop files, $PATH, … to have you e.g. call a backdoored version of your password man…

For modern operating systems capturing keyboard input is locked down to avoid keyloggers. Capturing your screen requires explicit user permission to do so, popping up a dialog. Apps are isolated so another app can't interfere and install a browser extention or modify shell configs, etc.

Can you name one of these modern operating systems?

Re: Pass: Unix Password Manager

#118

Post by nickjj »

denismi wrote: post #109

I recently moved away from pass after a decade or so. Two main reasons: 1. This laptop up was set up with flatpak versions of all GUI applications, including Firefox, and the browser plugin just doesn't work. I persisted with the work-around of `pass -c ` from the run command prompt for a while to paste into the browser, but its not ideal. 2. I realised that the Android app was archived. There's at least one fork, bu…

I made the switch from pass recently too. I had ~400 secrets stored in it for almost the same time as you.

Ultimately I wanted something easier to sync between multiple devices. Now that I am traveling more seriously I can't get away with only having a few important passwords saved on my phone and laptop.

It was a lot easier to sync (1) file with KeePassXC and it has 2 well supported Android apps to choose from. It took me around 3 hours one day to manually move everything over, I took that as an opportunity to prune and refactor everything which is why I didn't use the CSV import feature.

Password managers for me are a "write occasionally, read frequently" app so it's pretty painless to shoot over 1 file over my local network to keep 3 devices in sync.

Re: Pass: Unix Password Manager

#119

Post by [deleted] »

denismi wrote: post #109

I recently moved away from pass after a decade or so. Two main reasons: 1. This laptop up was set up with flatpak versions of all GUI applications, including Firefox, and the browser plugin just doesn't work. I persisted with the work-around of `pass -c ` from the run command prompt for a while to paste into the browser, but its not ideal. 2. I realised that the Android app was archived. There's at least one fork, bu…

[deleted]

Re: Pass: Unix Password Manager

#120

Post by integralid »

commandersaki wrote: post #88

I love Jason Donenfeld’s work, but I don’t really see the point of pass compared to using an encrypted text file, the latter being far more ergonomic.

pass is easier for me - it enforces some reasonable structure, works well with other Unix tools, and has a built-in git support. You don't have to use "pass" command for everything, for example for getting passwords interactively I just combine fzf and gpg directly.

If encrypted file works for you, that's great! But thinks like syncing it across devices, accessing entries programmatically, a mobile app all require rolling something on your own - pass solves this for you (while still being very simple).

Post reply on HN