Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pass: Unix Password Manager

passwordstore.org

Post reply on HN
Print view View original

91–100 of 186 posts

Re: Pass: Unix Password Manager

#91

Post by bramgn »

usr1106 wrote: post #71
laszlojamf wrote: post #56

Earlier quoted context omitted.

"Normies"? Everything is relative, I guess. I use 1Password and just hope for the best.

Right. Having an own machine 24/7 online and setting up wireguard to it does not sound very typical. I use pass myself and I don't care about mobile. But I really don't know what to recommend family members.

I use pass also on my phone in combination with Termux. I keep the passwords stores in sync using git. pass on android also supports copying your password directly into the clipboard, which is especially nice on a mobile device.

Re: Pass: Unix Password Manager

#92

Post by bramgn »

Kwpolska wrote: post #77
msravi wrote: post #25

There's also the pass-otp extension that generates OTPs! https://github.com/tadfisher/pass-otp The pass android app is really nice too https://play.google.com/store/apps/details?id=dev.msfjarvis.... It also works in termux

> This app isn't available for your device because it was made for an older version of Android. And no, those apps don't work great, because they involve some clunky GPG app.

Agreed, GPG is not the most intuitive tool, but once you are familiar enough with it, it opens some doors.

For me termux and pass (from F-droid) have solved my password management for many years. I never have to struggle finding passwords. The security aspect of it is the least I care about, it's the convenience and simplicity of it.

Since the passwords are all just files on a disk inside a directory tree, you can use any old file system tools to find your passwords. Same for MFA. I store the base32 string inside pass and that's the end of it.

Re: Pass: Unix Password Manager

#93

Post by ticoombs »

mid-kid wrote: post #76
drnick1 wrote: post #21

This is interesting for CLI lovers, but I feel KeepassXC on desktop + KeepassDX on Android (with the password DB stored on my own machine and accessed remotely via Wireguard) is a better solution for normies.

The only use case of mine that's not solved by keepass is creating passwords on two separate machines without a direct connection, and merging them later.

I solve this by Syncthing running on all clients. Very rarely do I ever have a problem with conflicts. Only if I add a new pass while my phone is offline and then make another edit on my computer would there be an issue. I think it only happened once, and that was because I did it on purpose to see what happened.

Turns out syncthing creates a .conflict file and then I tell keepassxc to do a merge on the two files and then we are back to normal.

Re: Pass: Unix Password Manager

#94

Post by gourlaysama »

Kwpolska wrote: post #77
msravi wrote: post #25

There's also the pass-otp extension that generates OTPs! https://github.com/tadfisher/pass-otp The pass android app is really nice too https://play.google.com/store/apps/details?id=dev.msfjarvis.... It also works in termux

> This app isn't available for your device because it was made for an older version of Android. And no, those apps don't work great, because they involve some clunky GPG app.

The app in the Google Store is no longer maintained, hence the warning.

It is however available in F-droid [1], and the newer versions don't need the secondary app and do everything internally.

[1]: https://f-droid.org/packages/app.passwordstore.agrahn

Re: Pass: Unix Password Manager

#95

Post by magarnicle »

stabbles wrote: post #67
rendaw wrote: post #58

There's a ton of positivity here, but on the balance there are some significant issues with pass that I think bear mention: - The fact that it's essentially unstructured data makes it hard to work with generically. If you have a username + password and need to use those in a script, you'll need to implement your own parser in your shell language in every script you need it in. - `pass generate` to generate new passwo…

> - The fact that it's essentially unstructured data makes it hard to work with generically. If you have a username + password and need to use those in a script, you'll need to implement your own parser in your shell language in every script you need it in. Fair, but you can use your own conventions. > - `pass generate` to generate new passwords, maybe thanks to the above, replaces everything in the pass value by def…

I assume they mean "search the web for", which is definitely a problem I've faced in the passt.

Re: Pass: Unix Password Manager

#96

Post by 4k93n2 »

drnick1 wrote: post #21

This is interesting for CLI lovers, but I feel KeepassXC on desktop + KeepassDX on Android (with the password DB stored on my own machine and accessed remotely via Wireguard) is a better solution for normies.

keepass has a very underrated feature i never see much talk about where you can have multiple vaults and have them open and search both at the same time (or at least the two apps you mentioned support that anyway).

most password managers are based around the idea of one single vault which creates the problem of having to treat every password like it needs the maximum amount of security. in my own case i would guess maybe 70% of my passwords are for unimportant sites where it wouldnt be a huge issue if someone else got the credentials, but every time i need to log into one of those sites i need to enter my long master password.

with keepass i can put that 70% into a separate vault and use a shorter master password that is quicker to type, and i dont need to worry as much if im opening that vault on a computer where i might not be sure its completely secure

Re: Pass: Unix Password Manager

#97

Post by johnisgood »

codethief wrote: post #80
charcircuit wrote: post #69

Earlier quoted context omitted.

>That’s true for any password manager Modern operating systems isolate individual apps such that a malicous app can not access the RAM of another app. There is a difference between not making an effort to protect passwords and requiring an OS exploit to do so.

Memory isolation doesn't really help, though. If you have a malicious process running under the same user account as your password manager, it's still game over since that process could e.g. - capture keyboard input - capture your screen - silently install browser extensions to capture your credentials - modify your shell config, .desktop files, $PATH, … to have you e.g. call a backdoored version of your password man…

You can use Qubes OS for true VM-level isolation, or use hardware security keys where possible, or run sensitive applications in dedicated VMs.

I think that in general it is game over the moment you have malicious processes running. I use firejail for most applications, which I believe is the bare minimum, or bubblewrap.

Re: Pass: Unix Password Manager

#98

Post by aorth »

msravi wrote: post #25

There's also the pass-otp extension that generates OTPs! https://github.com/tadfisher/pass-otp The pass android app is really nice too https://play.google.com/store/apps/details?id=dev.msfjarvis.... It also works in termux

The Android Password Store application by msfjarvis was archived last year. It was forked and greatly updated by agrahn. There are APKs on GitHub Releases and F-Droid, but not Google Play Store.

https://github.com/agrahn/Android-Password-Store

Re: Pass: Unix Password Manager

#99

Post by rednafi »

GPG is a big detractor, at least for me. Working with the GPG agent is usually a subpar, if not outright confusing, experience. I’d happily take a version that uses ssh-agent instead to achieve the same.

Re: Pass: Unix Password Manager

#100

Post by TiddoLangerak »

echo42null wrote: post #82

How would you build a dead man’s switch for pass? I’d like my family to be able to access my store if I disappear, but not before. The obvious problem: to re-encrypt for their keys I’d need my private GPG key running somewhere, which defeats the point. Has anyone solved this cleanly without leaving a hot key around?

The beauty of pass is that there's a distinction between giving access to the encrypted vault vs giving access to decryption, and you can leverage this.

How I've been doing this is that I have 2 (sets of) backup people. The first set has access to the repo, but can't decrypt. The second set can decrypt (i.e. I have their pubkeys imported), but don't have access to the repo. I've chosen the people such that it's unlikely they collude against me, but in case something happens it's likely they'll be able to get in touch with each other.

There's also other possible approaches: e.g. instead of building a dead man's switch based on the encryption, you can build a dead man's switch based on the data. I.e. you'll use their pubkeys for encryption, but the repo itself is behind a dead man's switch.

Post reply on HN