Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Clever uses of pass, the Unix password manager

vitalyparnas.com

Post reply on HN
Print view View original

141–150 of 154 posts

Re: Clever uses of pass, the Unix password manager

#141

Post by C4K3 »

fooqux wrote: post #30
crawl_soever wrote: post #8

I use pass along with passff and my yubikey for gpg decryption of the password store and gpg-ssh syncing from my home git pass db. Works great

passff and other tools like them scare me too much. That browser extension has too much power. All it would take is the author to sell it to some bad actors (or turn into one) and a lot of people will be having a very bad day. Pasting my password into a form isn't that bad, and it feels far safer.

Some distros package browser extensions, so you can install them via your regular package manager. For example arch packages firefox-extension-passff (I haven't personally used it though)

Re: Clever uses of pass, the Unix password manager

#142

Post by rectang »

tialaramex wrote: post #135
rectang wrote: post #79

Earlier quoted context omitted.

I wish someone would mint a user-friendly GPG wrapper for signing releases and quorum-based publishing. Dealing with raw GPG to sign releases is doable but a pain. And we need quorum publishing to guard against supply-chain attacks. But simple and user-friendly UX design is hard. As a user of `pass`, I'm grateful for what I have.

For the signing problem, both signify (and its clones) and modern OpenSSH (ssh-keygen -Y) do what you want today without all the baggage of OpenPGP, obviously that would mean explicitly choosing to migrate off OpenPGP signatures, but that does not seem unreasonable.

I just looked into signify, and I read this:

https://www.openbsd.org/papers/bsdcan-signify.html

> There are no key servers for signify. No web of trust. Just keys.

I'm not sure how that would work for quorum publishing, which guards against any single set of credentials being compromised by requiring multiple trusted signatories. The idea is that packages are signed by multiple identities, and if as a downstream user, you trust enough of those identities to form a quorum (2, or 3, or some score-based criteria), then you consider the release trustworthy enough to accept automatically. (The underlying theory is just multifactor auth.)

Downstream users need some way of determining how to trust keys, and that mechanism should be decentralized. This seems to be at odds with the priority the BSD authors place on key rotation:

> After each release of OpenBSD, we generate a new key pair for the release after next. That's plus two. For example, after 5.6 was released, keys for 5.8 were generated. This way, the 5.8 keys are then included in the 5.7 release. So, if you upgrade every release, you will have an unbroken chain of keys back to your initial installation.

So it sounds like there's a single set of keys for each release, which has to be kept safe. I'm sure that the OpenBSD folks take great care, but the idea of quorum publishing is to require multiple factors so that an attacker has to compromise multiple identities to spoof a release.

Re: Clever uses of pass, the Unix password manager

#143

Post by kdtsh »

rkeene2 wrote: post #47
loudmax wrote: post #15

`pass` was written by Jason Donenfeld, the developer who gave us WireGuard. It's is a bash script that makes it convenient and easy to use gpg2, the OpenPGP encryption tool. Frankly, I'm kind of shocked at how difficult it is to use the gpg2 command line utility. Clearly it's an extremely powerful tool, but it's written with the assumption that the user has a very deep understanding of how encryption and key signing…

I wrote a tool called hunter2 [0][1] which is very similar but uses PKCS#11 modules, which may be more common than GPG since the entire US Government uses them. [0] https://chiselapp.com/user/rkeene/repository/hunter2/ [1] https://github.com/rkeene/hunter2 (mirror)

Haha, nice. I’m a happy Password Store user of some 2-3 years, but I starred your repository - very cool idea to use PKCS#11 modules.

Re: Clever uses of pass, the Unix password manager

#144

Post by karlding »

vngzs wrote: post #123
jamal-kumar wrote: post #45

Earlier quoted context omitted.

As much as I love Jason Donenfeld's work, I tried to use pass and the gpg requirement just rubbed me the wrong way. It's basically just gpg-encrpyting a text file and unlocking that along with some wrappers for basic password manager functionality (I guess most important is clipboard functionality and clearing it automatically after some seconds), but somehow that seems like a weak point to me. It's a whole lot of re…

Besides that, pass leaks metadata. If your passwords are the only part of your password manager you think are secret, then you're probably not considering the utility of an enumeration of all your network handles. Mine aren't very interesting, but I wouldn't post that on GitHub, even in a private repo. I love pass and use it. But when I need to carry my password database around, I don't rely on pass alone - I throw t…

There's also the pass-tomb extension [0] which stores the directory in a tomb [1].

[0] https://github.com/roddhjav/pass-tomb

[1] https://www.dyne.org/software/tomb/

Re: Clever uses of pass, the Unix password manager

#145

Post by upofadown »

HotHotLava wrote: post #139
upofadown wrote: post #126

Earlier quoted context omitted.

>like the need to "ultimately trust" keys before they become usable Did you have to do that manually at one time? All the keypairs that I make start out that way when created. When creating a keypair for pass all you have to do is generate the key using defaults while remembering a bit of the user ID to give to pass.

Yes, every time I want to set it up on a new device I have to import and trust all public keys that it should encode to; and if that device gets its own gpg key then that key also has to be distributed to and trusted at all prior sites. Which isn't very often, but still somewhat regularly (ie. new laptop, new yubikey, formatted hard drive, etc.) I think it would be a great addition if pass could actually automate thi…

Ah, yes that is a nuisance. GPG has the "--export-ownertrust" and "--import-ownertrust" commands to make that sort of thing less tedious.

In general I think you are supposed to only have a one or a few "ultimately trusted" keys and then distribute that trust by signing the rest. So once you change the trust on one key the trust distributes automatically.

Re: Clever uses of pass, the Unix password manager

#146

Post by ayushnix »

jamal-kumar wrote: post #45
loudmax wrote: post #15

`pass` was written by Jason Donenfeld, the developer who gave us WireGuard. It's is a bash script that makes it convenient and easy to use gpg2, the OpenPGP encryption tool. Frankly, I'm kind of shocked at how difficult it is to use the gpg2 command line utility. Clearly it's an extremely powerful tool, but it's written with the assumption that the user has a very deep understanding of how encryption and key signing…

As much as I love Jason Donenfeld's work, I tried to use pass and the gpg requirement just rubbed me the wrong way. It's basically just gpg-encrpyting a text file and unlocking that along with some wrappers for basic password manager functionality (I guess most important is clipboard functionality and clearing it automatically after some seconds), but somehow that seems like a weak point to me. It's a whole lot of re…

FWIW, adding support for age in pass is listed as one of the goals of age. I'm considering sending an upstream patch in pass to support age and signify as well.

Re: Clever uses of pass, the Unix password manager

#147

Post by ayushnix »

vngzs wrote: post #123
jamal-kumar wrote: post #45

Earlier quoted context omitted.

As much as I love Jason Donenfeld's work, I tried to use pass and the gpg requirement just rubbed me the wrong way. It's basically just gpg-encrpyting a text file and unlocking that along with some wrappers for basic password manager functionality (I guess most important is clipboard functionality and clearing it automatically after some seconds), but somehow that seems like a weak point to me. It's a whole lot of re…

Besides that, pass leaks metadata. If your passwords are the only part of your password manager you think are secret, then you're probably not considering the utility of an enumeration of all your network handles. Mine aren't very interesting, but I wouldn't post that on GitHub, even in a private repo. I love pass and use it. But when I need to carry my password database around, I don't rely on pass alone - I throw t…

Besides pass-tomb, there's also pass-coffin which doesn't need to rely on a 3k+ line ZSH script. I'll add support for using age and signify in pass-coffin soon.

https://github.com/ayushnix/pass-coffin

Re: Clever uses of pass, the Unix password manager

#148

Post by an6n »

zikduruqe wrote: post #13
hestefisk wrote: post #9

Looks very neat; nice Unix’y solution. Would love this to integrate with Bitwarden which I use on my phone.

Are you referring to Pass? There is... https://mssun.github.io/passforios/ Works wonderfully and with OTPauth also. Run a bare git repo on your own network and there is no reason to use Bitwarden. Edit - and for those that are in AWS, you can use pass along with aws-vault to keep your ~/.aws creds in check. https://github.com/99designs/aws-vault

Sadly no yubikey support though - https://github.com/mssun/passforios/issues/42

Re: Clever uses of pass, the Unix password manager

#149

Post by tialaramex »

wizzwizz4 wrote: post #127
tialaramex wrote: post #98

Earlier quoted context omitted.

No, you don't need a perfect RNG. You need anything that's not completely horrible . Remember, we're not trying to read a whole password from the device, just one matching byte at a time. So, even if our password character set is a single character (pass will let you do that, but obviously you should not use such passwords in real life) we're talking about statistically 1 out of 256 bytes matches or else our PRNG is…

> You correctly observe that the PRNG has finite state, but its state isn't so tiny that it only emits a handful of the 256 possible bytes before getting back to where it started, nobody would use such a busted algorithm. If the PRNG always loops through all possible states, then sure. But if there's a possibility, however small, of it getting stuck in a small loop, very rarely?

> But if there's a possibility, however small, of it getting stuck in a small loop, very rarely?

We already went around this particular "small loop" so I'm guessing you aren't learning anything from repeating it. That would be a lousy design for a PRNG, so, nobody does that.

Re: Clever uses of pass, the Unix password manager

#150

Post by pqb »

yepguy wrote: post #92
pqb wrote: post #88

Earlier quoted context omitted.

Oh dammit. I have stopped using Gopass and rewrote pass just for that reason - missing AGE encryption. At least I have learned something new and I feel I have better UI - fuzzy finder instead of their TUI. However, big kudos to Gopass team for awesome work and really useful tool. Before I start working on next project... Do you recognize any mobile app, which could replace PasswordStore app for Android [0] but with A…

Android Password Store itself is keen to add age support[1], but I don't know of anything usable right now. You could probably use gopass in termux in the mean time. [1]: https://github.com/android-password-store/Android-Password-S...

Oh, that's an awesome news. Thank you!
Post reply on HN