Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android "Password Store" client for pass discontinued

github.com

Post reply on HN
Print view View original

41–50 of 60 posts

Re: Android "Password Store" client for pass discontinued

#41

Post by blop »

grouchypumpkin wrote: post #20

I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…

yes, it's my biggest worry too.

At least with keepassDX on android there is no internet access permission needed by default, but if a compromised update suddenly required it I don't know if Android would prompt about it since all apps have internet access granted without prompting :(

I also wish it was possible to block automatic updates of specific apps on the play store... So at least we could be in control over updating critical apps such as these without having to micromanage updates for all apps.

Re: Android "Password Store" client for pass discontinued

#42

Post by [deleted] »

rvense wrote: post #35
mid-kid wrote: post #22

Earlier quoted context omitted.

The point of `pass` is to offload the security aspect to gpg, so unless something goes wrong with that, I don't believe continued use, even if unmaintained, is very insecure.

The Android app will by necessity receive the decrypted passwords from GPG to display and copy them to the clipboard. It could do whatever else it wants with them.

[deleted]

Re: Android "Password Store" client for pass discontinued

#43

Post by zinekeller »

kreyenborgi wrote: post #38
too_damn_fast wrote: post #6

In the past two days, the official Syncthing Android client has been discontinued, making the use of KeePass harder. Bitwarden has been trying to move away from a fully FOSS system. And now this?

At least the Play Store version has: https://github.com/syncthing/syncthing-android/issues/2064 But isn't https://f-droid.org/en/packages/com.nutomic.syncthingandroid... still being kept up-to-date? I switched to f-droid at least, remember to Backup your config before uninstalling the Play Store version.

It's discontinued, period (https://github.com/syncthing/syncthing-android/issues/2064#i...). The fork seems to be fine currently though.

Re: Android "Password Store" client for pass discontinued

#44

Post by KeePassium »

grouchypumpkin wrote: post #20

I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…

> Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families?

The more I think about it, the better I understand TrueCrypt's sudden demise.

Re: Android "Password Store" client for pass discontinued

#45

Post by wvh »

grouchypumpkin wrote: post #20

I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…

Does that not apply to anything in life? How difficult is it to get code into any open-source software package or distribution really? I work in high-security environments, and I'm always wondering how you can really guarantee that any Debian, Ubuntu or Arch developer is honest and not compromised themselves, any software package installed is 100% clean, and any software library module and container image is fully checked. And that's not getting into tin foil hat assumptions about a shady government agency having access to the major app stores, Github, common distributions or email hosters.

There simply is no way anymore to check the several million lines of code even a minimal setup requires somewhere in the stack. Even an in-depth code review of a medium sized web application – with deps – has already become a gargantuan task most companies simply can't afford.

Re: Android "Password Store" client for pass discontinued

#46

Post by pjmlp »

prmoustache wrote: post #28
pjmlp wrote: post #19

Earlier quoted context omitted.

Turns out living the FOSS dream is kind of hard.

Tbh the same struggle affect proprietary software. It is more about individual developpers/small teams versus large companies.

Indeed, but it more acute when people don't give anything back, and hobbies don't last forever.

Re: Android "Password Store" client for pass discontinued

#47

Post by wvh »

mr_mitm wrote: post #7

This seems to happen more and more often, or at least it feels that way to me. FLOSS projects that aren't highly critical but very useful are maintained by only one person which loses interest, burns out or simply has other priorities. Sometimes they don't even make an announcement like here and just ghost the project. Very sad, even though understandable.

A lot of FOSS projects are started by young people, often students. At some point, life hits, with spouses and children and real jobs demanding lots of time. Slowly people burn out, and most of the time, other people want to scratch their own itch and don't necessarily continue what already exists.

I guess password managers are relatively simple at the core but have to fulfil very different requirements so there isn't one obvious piece of software that everybody can focus on. See also bike-shedding vs building a nuclear reactor.

A better philosophy on how to herd cats would be useful in the FOSS world, though. It's a formidable force, but terribly scattered.

Re: Android "Password Store" client for pass discontinued

#49

Post by blahlabs »

blop wrote: post #41
grouchypumpkin wrote: post #20

I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…

yes, it's my biggest worry too. At least with keepassDX on android there is no internet access permission needed by default, but if a compromised update suddenly required it I don't know if Android would prompt about it since all apps have internet access granted without prompting :( I also wish it was possible to block automatic updates of specific apps on the play store... So at least we could be in control over up…

On GrapheneOS there is a prompt when installing an app that asks if you would like to grant network access. I am not sure if that pop up displays if network access is added later in an app update though.

Re: Android "Password Store" client for pass discontinued

#50

Post by jasonm23 »

grouchypumpkin wrote: post #20

I worry a lot about password managers on mobile. Such as: * if an app has a single developer (keepassium? strongbox?), how much money would it take them to add a back door? 1M USD? 10M USD? Let’s say they are exceptionally honest, and won’t take money. How about threats to their lives or families? * if an app has a small number of engineers with commit access (bitwarden? 1paasword?) could any one of them be compromis…

I'm really confused. How do you think that would work with an opensource password manager like pass / password-store.org

- The data is stored in Git at a location of your choosing and security level

- The data encryption is provided by GnuPG using your personal key

This is why I use it, there's no potential for anyone to add a back door, except me.

BitWarden, LastPass, etc etc... you have a point, and I would not trust these companies one iota.

Apple, Google etc...uhm... not in a million years.

Post reply on HN