Earlier quoted context omitted.
Usernames aren't considered to be privileged data. If you're relying on your usernames being secret, then you're making a big mistake and you should rethink things. Alternatively, generic names. For search, just use grep. "pass | grep whatever" has worked pretty well for me when the tab completion did not. Or would you suggest an alternative approach? I'm open to ideas.
You're right usernames aren't considered privileged, but the list of services and associated usernames is not the kind of information I would want to necessarily make public. The names alone would be more revealing that I care to share. Yeah, 'pass | grep foo' would work for search. I missed the default behaviour.
Pass: The Standard Unix Password Manager
31–40 of 48 posts
Re: Pass: The Standard Unix Password Manager
#32This looks more elegant than the hacked-together system I'm using for my passwords, but I don't see a way to store any metadata about the passwords other than the name. If you're looking for a command-line interface to a cross-platform password database, there's kpcli for keepassx. http://kpcli.sourceforge.net/ http://www.keepassx.org/ http://search.cpan.org/~rhandom/File-KeePass-0.03/lib/File/K...
I also use my own homebrew system that stores the password encrypted in the format of: ~/.passdb/username@site.com I have a number of alises setup that will generate new passwords or retrieve a password for a domain. for eg. $ p news.ycombinator.com Will decrypt the password and store it in the clipboard. I don't see any added benefit of having a complete application to manage this process, the ~20 lines of shell scr…
Anyway, perhaps this is appealing to you: alias p="pass"
Check out the source of pass -- it's probably pretty similar to your bash aliases. In fact, pass for me used to be a bash alias too.
Re: Pass: The Standard Unix Password Manager
#33Earlier quoted context omitted.
Single username isn't privileged data. But a set of usernames and realnames can be. It's better to lose a pendrive with encrypted block256.dat than Passwords\HackerNews\dfcsd.gpg, Passwords\Bank\34457356.gpg, Passwords\Mail\name.gmail.gpg etc.
It shouldn't be considered secret, period. If you're worried about non-secret data being used to attack you (the kind of data people can acquire by digging through your trash when you bring it out to the curb, for example), then your likely-to-be-lost USB key should be using some encryption of its own. This encryption doesn't defeat the purpose of using pass, either, because pass uses gpg agent, where the key nicely…
There's the difference, I think; I shred all my personally identifiable trash (well, recycling, actually).
Re: Pass: The Standard Unix Password Manager
#34I was just recently looking for a simple password manager for Ubuntu, and Seahorse is so close . It unlocks with your login key so if you're logged in you don't have to keep entering a master password each time you need to retrieve a password; it stores everything in one easily-copyable encrypted file; and it's a core part of GNOME. But you can't store any metadata about the password, like a username! And that makes…
If you're still looking for a password manager for Ubuntu, I really liked using KeepassX. It has password categories, lots of metadata. However, it doesn't unlock with the system.. :(
Re: Pass: The Standard Unix Password Manager
#35Earlier quoted context omitted.
Pass seems excellent but for me is also almost-there, because it doesn't unlock when I log in and I have to mess around with public/private keypairs. I prefer using passphrases because I travel a lot and if I lose my private key, it would be a monstrous hassle to get a backup private key in my hands securely. `gpg -c` is my go-to. For me, unlock on login is essential. If someone beats me unconscious and steals my com…
If you want to unlock on log-in, just have your gpg key unlocked by your login password. Gnome keychain is capable of this. Your request is a definite possibility. I prefer having the key + passphrase over just a passphrase. It makes it more difficult for the information to leak. That said, if you'd like a pass with a gpg -c mode, it shouldn't be hard to add. I could do this, or you could send a nice git formatted pa…
(Although as a CLI program I suppose the argument could be made that non-techies will ignore it on principle anyway...)
Re: Pass: The Standard Unix Password Manager
#36Earlier quoted context omitted.
It shouldn't be considered secret, period. If you're worried about non-secret data being used to attack you (the kind of data people can acquire by digging through your trash when you bring it out to the curb, for example), then your likely-to-be-lost USB key should be using some encryption of its own. This encryption doesn't defeat the purpose of using pass, either, because pass uses gpg agent, where the key nicely…
> the kind of data people can acquire by digging through your trash when you bring it out to the curb, for example There's the difference, I think; I shred all my personally identifiable trash (well, recycling, actually).
Re: Pass: The Standard Unix Password Manager
#37Earlier quoted context omitted.
If you want to unlock on log-in, just have your gpg key unlocked by your login password. Gnome keychain is capable of this. Your request is a definite possibility. I prefer having the key + passphrase over just a passphrase. It makes it more difficult for the information to leak. That said, if you'd like a pass with a gpg -c mode, it shouldn't be hard to add. I could do this, or you could send a nice git formatted pa…
Anything is possible ... but a program has to make it easy for us, i.e. anticipate potentially popular use-cases and cater to them. Otherwise non-techies will ignore the program and techies will roll our own simple solution instead of taking the time to explore and customize someone else's--just like I already have :) (Although as a CLI program I suppose the argument could be made that non-techies will ignore it on p…
Re: Pass: The Standard Unix Password Manager
#38Earlier quoted context omitted.
I also use my own homebrew system that stores the password encrypted in the format of: ~/.passdb/username@site.com I have a number of alises setup that will generate new passwords or retrieve a password for a domain. for eg. $ p news.ycombinator.com Will decrypt the password and store it in the clipboard. I don't see any added benefit of having a complete application to manage this process, the ~20 lines of shell scr…
Your system is basically the same. pass is not a "complete application", but it's actually just a tiny shellscript. (RTFA...). You have to reenter the master password if that's the way GPG is setup. Or you don't have to reenter it, if it's set up that way instead. Anyway, perhaps this is appealing to you: alias p="pass" Check out the source of pass -- it's probably pretty similar to your bash aliases. In fact, pass f…
That is the headline feature IMO (rather than 'standard')
edit: I should add that what gave me the impression of this being an application rather than something I would really use was the way it was presented with 'install', makefiles etc. rather than 'here are 30 lines of bash you can dump into your rc file'
Re: Pass: The Standard Unix Password Manager
#39Earlier quoted context omitted.
Your system is basically the same. pass is not a "complete application", but it's actually just a tiny shellscript. (RTFA...). You have to reenter the master password if that's the way GPG is setup. Or you don't have to reenter it, if it's set up that way instead. Anyway, perhaps this is appealing to you: alias p="pass" Check out the source of pass -- it's probably pretty similar to your bash aliases. In fact, pass f…
Scanned the article twice and it wasn't until I read the source that I saw that it was a shell script. That is the headline feature IMO (rather than 'standard') edit: I should add that what gave me the impression of this being an application rather than something I would really use was the way it was presented with 'install', makefiles etc. rather than 'here are 30 lines of bash you can dump into your rc file'
I already say " It is a very short and simple shell script. " in the first paragraph. Maybe I should say something else too. Thinking...
Edit: responding to your edit: Yea, there's a lot of cruft that gets added to a source directory when you try and make anything on Linux into something suitable for /usr/bin and /usr/share/man. C'est la vie.
Re: Pass: The Standard Unix Password Manager
#40I'm not sure I see how this is in-keeping with any Unix philosophy I've encountered. "Everything's a file" is good, yes, but this program is needlessly-specific when what it does need not be. This is just a tool for browsing a file hierarchy in which the files happen to be GPG encrypted, right? Which one thing is this doing and doing well? Merely being command-line and somewhat file-oriented does not make Unix orient…
Lotta facets of unix philosophy. It manages passwords and it does that well. "pass -c HN/ralphtinner", and then my password is on the clipboard for 45 seconds. That's nice. From TFA, the password generation is via pwgen. Encrypted filesystems often require root privs or SUID helpers and don't have straight-forward ways to do key management and key expiration. This tool relies on gpg's already working agent.
Seems strange to have the password generation "on the inside", though. That essentially means that `pwgen` is a strict dependency. Instead of writing something like
pass generate Email/jasondonenfeld.com 15
the user should just type something like pwgen 15 1 | pass insert Email/jasondonenfeld.com
That way they don't need `pwgen` to install `pass`. It also means that all of the options to `pwgen` can be used without special effort or documentation.I'd say the same thing about `xclip`, but it's probably not worth having to write something like
pass -c Email/zx2c4.com | xclip -selection clipboard -l 1
(or however xclip is supposed to work).