Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

(In)Security of the “Pass” password manager

rot256.dev

Post reply on HN
Print view View original

61–70 of 87 posts

Re: (In)Security of the “Pass” password manager

#61

Post by zikduruqe »

captn3m0 wrote: post #40
zikduruqe wrote: post #8

I've never understood the "complexity" of PGP/GNuPG. Granted the man page is dozens of pages long, but I find it no more complicated than any other command line tool. Maybe it is because I have used it professionally and personally forever. The author of Age has ported Pass to use Age as the encryption scheme if one needs a modern solution. As for reading the directory structure, you don't have to put your passwords…

The agent-driven nature of PGP, along with the encoding itself (which was primarily meant for emails) adds a lot of complexity, and makes it much harder to setup, configure, and use safely compared to other tools. It is a tool trying to securely manage keys in an insecure environment, and even offloading some parts (such as to a yubikey) doesn't make it any easier to use.

> compared to other tools

Genuinely curious as to what other tools. I don't find PGP terribly too complex to setup or manage.

> It is a tool trying to securely manage keys in an insecure environment

I mean, yea. Isn't that every encryption tool on someone's local machine?

Re: (In)Security of the “Pass” password manager

#62

Post by latchkey »

jph wrote: post #60
latchkey wrote: post #29

Earlier quoted context omitted.

KISS This is a simple script, it deserves a simple license. Nobody is going to 'sell' just a simple one page script and nothing prevents me from looking at the arguments it uses and putting them into my own commercial product. You don't 'license' arguments to gpg.

It turns out that GPL is a much simpler license for very large enterprises. In fact, this GPL license was originally chosen because it's the simplest for one of my Fortune 50 company clients.

Simpler than what, MIT?

Re: (In)Security of the “Pass” password manager

#63

Post by jph »

latchkey wrote: post #62
jph wrote: post #60

Earlier quoted context omitted.

It turns out that GPL is a much simpler license for very large enterprises. In fact, this GPL license was originally chosen because it's the simplest for one of my Fortune 50 company clients.

Simpler than what, MIT?

Yes simpler than MIT.

The Fortune 50's compliance team carefully evaluated many open source licenses, including MIT, BSD, GPL, Apache, etc. and determined that GPL is the best for their company for internal tools such as these, that must be wholly separate from any product offerings.

And when I say carefully, I mean multiple lawyers, for multiple years, considering many worldwide regulatory compliance laws. GPL won over all the other options.

Re: (In)Security of the “Pass” password manager

#64

Post by dwightgunning »

eduction wrote: post #56

This attack makes no sense to me: ————— Active Attack: 1. Adversary replaces the contents of ./Personal/malicious-site.com with the contents of ./Work/id_ed25519 2. Victim decrypts ./Personal/malicious-site.com and the decrypted contents is placed in her clipboard automatically. 3. Victim logs into malicious-site.com. The victim just uploaded her work SSH private key to malicious-site.com ———— If the attacker is on t…

They don’t have access to the ssh private key. They have access to the encrypted password file (and presumably not the password used to encrypt it).

The attack works when the user doesn’t realize they’re sending their SHH private key through the password form of malicious-site.com.

Something like accidentally putting your Google password into the Dropbox login form. Dropbox have now seen your Google password.

Re: (In)Security of the “Pass” password manager

#65

Post by yellowapple »

gruez wrote: post #37
phoe-krk wrote: post #27

Earlier quoted context omitted.

Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. Uploading your whole password tree to a public repository is a bad idea for reasons explicitly mentioned in the article (i.e. pass does not encrypt metadata about the file/directory names, git stores all creation/modification/deletion dates and times).

>Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. I'm not sure whether that's actually better than storing it on github (or any other professionally managed git instance). Sure, you gain some security by obscurity (because your VPS isn't a juicy target like github is), but that's about it. If the FBI is after you, they can send a letter to your VPS provider just like…

> If the FBI is after you, they can send a letter to your VPS provider just like they can send a letter to github.

And unless that VPS is in the US or provided by a US company, it's unlikely the FBI will get much of a useful response to that letter. Some countries' LEAs cooperate with the FBI and other American LEAs, but not all.

Re: (In)Security of the “Pass” password manager

#66

Post by Brian_K_White »

phoe-krk wrote: post #27
gruez wrote: post #19

Earlier quoted context omitted.

>While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? >I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. How are people using pass then? Do they…

Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. Uploading your whole password tree to a public repository is a bad idea for reasons explicitly mentioned in the article (i.e. pass does not encrypt metadata about the file/directory names, git stores all creation/modification/deletion dates and times).

"Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there."

Exactly what I told my Phillipino mother in law to protect her AOL account. I can't imagine why she doesn't do it.

Re: (In)Security of the “Pass” password manager

#67

Post by phoe-krk »

Brian_K_White wrote: post #66
phoe-krk wrote: post #27

Earlier quoted context omitted.

Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. Uploading your whole password tree to a public repository is a bad idea for reasons explicitly mentioned in the article (i.e. pass does not encrypt metadata about the file/directory names, git stores all creation/modification/deletion dates and times).

"Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there." Exactly what I told my Phillipino mother in law to protect her AOL account. I can't imagine why she doesn't do it.

That's a strawman. I'm neither your Phillipino mother nor ever suggested that she should be doing this.

Re: (In)Security of the “Pass” password manager

#69

Post by nequo »

jph wrote: post #63
latchkey wrote: post #62

Earlier quoted context omitted.

Simpler than what, MIT?

Yes simpler than MIT. The Fortune 50's compliance team carefully evaluated many open source licenses, including MIT, BSD, GPL, Apache, etc. and determined that GPL is the best for their company for internal tools such as these, that must be wholly separate from any product offerings. And when I say carefully, I mean multiple lawyers, for multiple years, considering many worldwide regulatory compliance laws. GPL won o…

Do you know what makes MIT and BSD more complicated for internal tools for these companies?

What about MIT or (two-clause) BSD makes it harder to comply with? Would attribution be an excessive burden for them in case such code ended up in their own products?

My understanding is that BSD and Apache were historically favorable licenses for code that was intended to promote a protocol and make it an industry standard. Easy reuse helped achieving this goal. For example, IIRC FreeBSD's TCP/IP code was repurposed for Windows and MacOS X, and the Apache HTTP server also went a long way toward establishing HTTP as a standard.

Edit: Paragraph on standards.

Re: (In)Security of the “Pass” password manager

#70

Post by Brian_K_White »

phoe-krk wrote: post #67
Brian_K_White wrote: post #66

Earlier quoted context omitted.

"Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there." Exactly what I told my Phillipino mother in law to protect her AOL account. I can't imagine why she doesn't do it.

That's a strawman. I'm neither your Phillipino mother nor ever suggested that she should be doing this.

There is nothing invalid about the observation. (not a strawman)
Post reply on HN