Clever uses of pass, the Unix password manager • Hacker News Board

Re: Clever uses of pass, the Unix password manager

#151

Post by pqb » Fri, Dec 17, 2021, 11:46 AM UTC

cobby wrote: post #114

pqb wrote: post #88

Earlier quoted context omitted.

Oh dammit. I have stopped using Gopass and rewrote pass just for that reason - missing AGE encryption. At least I have learned something new and I feel I have better UI - fuzzy finder instead of their TUI. However, big kudos to Gopass team for awesome work and really useful tool. Before I start working on next project... Do you recognize any mobile app, which could replace PasswordStore app for Android [0] but with A…

> missing AGE encryption I am just curious. What makes AGE backend better than GPG one?

As yepguy mentioned AGE is simpler. I can also mention few things:

- It works smoothly with SSH keys (generated from ssh-keygen), which are perfectly recognized by possibly any developer.

- No need for external client, such as GpgWin/Kleopatra for Windows.

- Embed-able in Rust[0] and Go[1] (there are libraries), no need to call `gpg --decrypt ...` from the command line.

- Encrypted files by pass and keys are smaller. I guess it is thanks to ecliptic-curve encryption.

[0]: https://github.com/str4d/rage

[1]: https://github.com/FiloSottile/age

Re: Clever uses of pass, the Unix password manager

#152

Post by GoblinSlayer » Fri, Dec 17, 2021, 3:46 PM UTC

wizzwizz4 wrote: post #66

assbuttbuttass wrote: post #36

Earlier quoted context omitted.

It has probability 0 of running forever

Assuming a perfect RNG, but PRNGs don't have infinite state. So it's either impossible, or has a finite probability, with a finite probability for each of those cases, for an overall finite (non-zero) subjective probability of it running forever (in ideal program-space; obviously it will never run forever in real life).

/dev/urandom isn't pure mathematics, it consumes hardware entropy.

Re: Clever uses of pass, the Unix password manager

#153

Post by beagle3 » Sat, Dec 18, 2021, 6:52 AM UTC

tialaramex wrote: post #112

beagle3 wrote: post #107

Earlier quoted context omitted.

SSH has included file encryption for a few versions now, and iirc supports yubikeys — probably would be more useful a backend than age.

> SSH has included file encryption for a few versions now Mmm. I don't think so. Recent OpenSSH includes file signatures not encryption.

Ahh, you are correct, I misremembered.

Re: Clever uses of pass, the Unix password manager

#154

Post by jhgb » Sun, Dec 19, 2021, 1:41 PM UTC

tialaramex wrote: post #140

jhgb wrote: post #124

Earlier quoted context omitted.

> Under 'pass' all passwords conforming to chosen rules are equally likely, under your approach some are twice as likely as others. But they're passwords. At most half of the passwords will have different probability than the rest which means that you're still left with a staggering number of un-brute-forceable passwords. Two to the power of ninety nine is practically indistinguishable from two to the power of one hu…

> another consumes much less entropy To the extent that it could mean something to "consume" entropy from the random device they're both outputting the same size of password and so they're consuming roughly the same amount of entropy. Assuming the random device works as intended this would be a distinction that makes no difference anyway. > a binary that I might not have on some computers A binary that's included in…

> A binary that's included in the Linux Standard Base. Which computers don't you have it on?

I'm using some Windows computers. But for example I can use (and often do) a dumped SBCL binary on them just fine, even on those where I can't install anything.