This is such a great application. I feel like it's complete already and would be happy if it just continued to exist without much or any maintenance.
There is always need for maintenance on Android.
Android "Password Store" client for pass discontinued
21–30 of 60 posts
Re: Android "Password Store" client for pass discontinued
#22This is actually a better outcome than finding out one day the app have a serious security problem. While i like `pass` and that Android app looked really good, this is just not serious. Because the fact that most people will end up trusting a random app as their password manager because it has 2k star on Github is crazy. If you want to use `pass` on Android you should tinker something with termux .
The point of `pass` is to offload the security aspect to gpg, so unless something goes wrong with that, I don't believe continued use, even if unmaintained, is very insecure.
Re: Android "Password Store" client for pass discontinued
#23I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…
> add a back door?
What's your threat model here? Some kind of mass hacking attempt? It would be easier to attack the service providers, rather than steal legitimate logins.
A targeted attack on a specific person? It would be easier to, as the famous XKCD suggests, drug and/or hit them with a wrench until they voluntarily hand over whatever information you want.
It's difficult to conceive of a situation where hacking password managers is the path of least resistance.
Re: Android "Password Store" client for pass discontinued
#24This is actually a better outcome than finding out one day the app have a serious security problem. While i like `pass` and that Android app looked really good, this is just not serious. Because the fact that most people will end up trusting a random app as their password manager because it has 2k star on Github is crazy. If you want to use `pass` on Android you should tinker something with termux .
I think termux has some limitations here (due to missing libraries), namely gpg decryption via hardware keys.
Re: Android "Password Store" client for pass discontinued
#25I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…
> add a back door? What's your threat model here? Some kind of mass hacking attempt? It would be easier to attack the service providers, rather than steal legitimate logins. A targeted attack on a specific person? It would be easier to, as the famous XKCD suggests, drug and/or hit them with a wrench until they voluntarily hand over whatever information you want. It's difficult to conceive of a situation where hacking…
Isn’t it the same threat model as Lastpass breach? Login credentials seem to be worth money, and crypto keys even more.
Re: Android "Password Store" client for pass discontinued
#26I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…
> Or maybe not?
This.
It is just slightly more difficult and longer to target it in a large company because you usually have to actually be hired by that company and do not necessarily have the choice of the team/products you will be working on.
But adding backdoors and vuln, yes totally possible on random products that person would be affected to. There is review fatigue the same way there is fatigue in a lot of processes.
Re: Android "Password Store" client for pass discontinued
#27I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…
> add a back door? What's your threat model here? Some kind of mass hacking attempt? It would be easier to attack the service providers, rather than steal legitimate logins. A targeted attack on a specific person? It would be easier to, as the famous XKCD suggests, drug and/or hit them with a wrench until they voluntarily hand over whatever information you want. It's difficult to conceive of a situation where hacking…
The idea is to sell the dump, this is the case for nearly every dataset you see reported on Have I Been Pwned. I'm not really sure how there is even any question about oh why would anyone do this?
Re: Android "Password Store" client for pass discontinued
#28In the past two days, the official Syncthing Android client has been discontinued, making the use of KeePass harder. Bitwarden has been trying to move away from a fully FOSS system. And now this?
Turns out living the FOSS dream is kind of hard.
Tbh the same struggle affect proprietary software.
It is more about individual developpers/small teams versus large companies.
Re: Android "Password Store" client for pass discontinued
#29I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…
> Or maybe not? This. It is just slightly more difficult and longer to target it in a large company because you usually have to actually be hired by that company and do not necessarily have the choice of the team/products you will be working on. But adding backdoors and vuln, yes totally possible on random products that person would be affected to. There is review fatigue the same way there is fatigue in a lot of pro…
Adding a backdoor is not the difficult part, leaving no trace is.
People don't know who you are on github, but it's easy for top name companies to track who created the backdoor in great detail. Actually the power of tracing real person is one of the the best defenses.
Re: Android "Password Store" client for pass discontinued
#30This seems to happen more and more often, or at least it feels that way to me. FLOSS projects that aren't highly critical but very useful are maintained by only one person which loses interest, burns out or simply has other priorities. Sometimes they don't even make an announcement like here and just ghost the project. Very sad, even though understandable.
It happens also to proprietary apps maintained by individual developpers / small teams. At least in this case an open source project is easier to fork even if original dev becomes unresponsive/unreachable.