Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: Unix Password Manager

passwordstore.org

Post reply on HN
Print view View original

181–186 of 186 posts

Re: Pass: Unix Password Manager

#181

Post by saleCz »

conception wrote: post #42
supriyo-biswas wrote: post #32

Earlier quoted context omitted.

My current employer uses 1password and it has a couple of nifty features like "vaults" shared with a group of people, an "op run" command to inject secrets using a .env file, service accounts to fetch passwords in CI, etc.

It has dev environments now too! https://developer.1password.com/docs/environments/

for a complete solution to dev envs and production secret management I use Envie https://github.com/ilmari-h/envie it's like a drop in replacement for traditional env files

Re: Pass: Unix Password Manager

#182

Post by codethief »

johnisgood wrote: post #150
codethief wrote: post #138

Earlier quoted context omitted.

Yeah. Personally, I'm crossing my fingers for SpectrumOS[0] to make things a bit easier. As the developer notes on her website[1]: I have embarked on the ultimate yak shave it started with "I wish I could securely store passwords on my computer" And now I am at the "I have funding to build my own operating system" level [0]: https://spectrum-os.org/ [1]: https://alyssa.is/about/

What else can you tell me about Spectrum OS? Is it actively maintained? Is it usable? How does it compare to Qubes OS? Also what do you think about Subgraph OS[1]? Although I think it is not maintained anymore, or is it? [1] https://subgraph.com/img/sgos.png (old image which I remembered it by) ( https://web.archive.org/web/20241206072718/https://subgraph.... )

I don't know how usable SpectrumOS is so far – I guess we'd have to compile it ourselves in order to find out. Either way, it is being developed quite actively, see https://spectrum-os.org/git/

As for how it compares to Qubes, I don't think I'll be able to tell you more than https://spectrum-os.org/design.html & friends. I suppose the upshot is:

- KVM instead of Xen

- One VM per application

- Single file system for user data (to which users can grant VMs access on a folder-by-folder basis)

- Package system from NixOS (nixpkgs) for reproducibility & immutability

Re: Pass: Unix Password Manager

#183

Post by bborud »

wkat4242 wrote: post #177
bborud wrote: post #124

If only chip makers and computer manufacturers could agree on some useful common interface for managing keys so we could get more people to use these solutions.

No please, I don't want my keys locked into Google or Apple. They can block your account on a whim with no recourse. At least bit warden can do it now but the fido association seems to have beef with them because it's possible to extract the private key. This is exactly what I want though, to store it somewhere safe. But for now I simply don't use passkeys. It needs to be 100% open and cloud independent.

I was talking about availability of hardware capabilities. And having a common interface to them so they are actually useful. Several of the machines I work on have a SAM, TPM, HSM chip or similar. But they’re not always present and they don’t necessarily have nice interfaces that makes writing software that works everywhere easy.

Re: Pass: Unix Password Manager

#184

Post by lucb1e »

jolmg wrote: post #135
lucb1e wrote: post #23

This is fun if you never leave yourself, but be wary with whom you share it. As a company password manager, there is no way to know who's accessed which secret across their lifetime at the firm so you get to change all the passwords constantly. (Or none, if you can't be bothered.) (Don't ask.) Or if someone newly needs access, there's no standard way of re-encrypting the files you're guessing they need. You need to h…

> As a company password manager, there is no way to know who's accessed which secret across their lifetime at the firm so you get to change all the passwords constantly. You can setup different directories to use different keys, and you don't need to limit yourself to a single key for each password either. You can use multiple. So you can setup structures like: - admins/.gpg-id "admin\n" - techs/.gpg-id "admin\ntech\…

"having access to" is not the same as having opened it, though. A server could log which files were retrieved without knowing what the contents are

By having such audit logging, we could see that we e.g. don't need to call the alarm company to change the phone password. Most people don't work in the office outside of business hours and so never need to call them, but since it's the only way of proving you're an employee if you accidentally set off the alarm, we give everyone access to that password. There's at least a dozen examples like that

Re: Pass: Unix Password Manager

#186

Post by pabs3 »

bborud wrote: post #183
wkat4242 wrote: post #177

Earlier quoted context omitted.

No please, I don't want my keys locked into Google or Apple. They can block your account on a whim with no recourse. At least bit warden can do it now but the fido association seems to have beef with them because it's possible to extract the private key. This is exactly what I want though, to store it somewhere safe. But for now I simply don't use passkeys. It needs to be 100% open and cloud independent.

I was talking about availability of hardware capabilities. And having a common interface to them so they are actually useful. Several of the machines I work on have a SAM, TPM, HSM chip or similar. But they’re not always present and they don’t necessarily have nice interfaces that makes writing software that works everywhere easy.

These are all running proprietary software that you can't upgrade. As an example, Yubikey had a bug a while ago where they were generating weak keys, which could be recreated from a bunch of signatures.
Post reply on HN