9 ms·

It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ https://www.passwordstore.org/ which is jus

It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html https://fossdroid.com/a/password-store.html

omtose 10y ago
I'm also a user of pass, but the fact that all the metadata is in clear is a big beef for me. How do you solve that, if at all?
- aban 10y ago
  Fellow pass user here. freepass [0] seems like it could be a potential candidate, somewhere between pass and LessPass, but I haven't tried it out for myself yet. [0]: https://github.com/myfreeweb/freepass https://github.com/myfreeweb/freepass
- JetSpiegel 10y ago
  You could encrypt the password store folder with another gpg container. That would be your master password.
- supergreg 10y ago
  Maybe you can put the whole .pass directory inside an encfs directory. Encryption all the way down.
- adilparvez 10y ago
  You can use a hash of the site appended with a .pass wide pepper as the name of the directory storing credentials for a particular site, then use a wrapper script that hashes its input before passing it to pass. Also full disk encryption.
  - omtose 10y ago
    This is all a lot of effort, if I went down that road I might as well skip "pass" and handle the passwords myself. What I like about pass is that there isn't much setup. Full disk encryption also doesn't prevent a running application from seeing the directory structure. But I guess this is not a very realistic attack vector.
    - adilparvez 10y ago
      Yes, under that threat model you would lose with all of these password managers.
      - omtose 10y ago
        How so? If the entire directory structure is also encrypted then no program can easily know which sites or services I have passwords for.
        adilparvez 10y ago
        I was meaning if your machine was compromised.
lucaspiller 10y ago
I was using this for ~4 years and really liked it, but recently I've been using 1Password. I tried 1Password as it has a family plan, that didn't really work out though (getting non-technical people to use a password manager is hard - so I'll forever keep being asked "What's the Netflix password?"), but I have stuck with it for myself. I really like the browser integration, which there isn't anything comparable for pass. I had a bash script [0] which when run would pull the current URL from my browser, and run pass to generate or copy the password to the clipboard - but the 1Password extension is so much nicer. If I'm on a site with weird requirements I'd have to figure out the params to make pass generate a password which matched it; with the extension I just click a few buttons. I've also got hooked on the iOS app. I didn't know there was one for pass, but it looks rather basic compared to 1Password [1]. 1Password also supports TOTP, so you don't need a seperate app for that - although for security you probably should. Maybe one day I'll get around to writing my own extension and app for pass, but for now paying $60/year is worth it for me. I don't pay for many apps/services, but this I find really worth it. [0] https://github.com/lucaspiller/passosx https://github.com/lucaspiller/passosx [1] https://github.com/davidjb/pass-ios https://github.com/davidjb/pass-ios
- iKlsR 10y ago
  https://www.enpass.io/ https://www.enpass.io/ is a winner for me.
- gr3yh47 10y ago
  >I really like the browser integration, which there isn't anything comparable for pass. people keep saying stuff like this (the one i use because x feature has no real competitor) lastpass. i've used most password managers out there and lastpass hits all these points and more
  - ohstopitu 10y ago
    After lastpass was bought out, I went on a spree to find a different password manager and in that process, I tried almost all of them (free & paid). Nothing came close to Lastpass so I decided to stick with them until they mess up. If the worst comes to worst, I'll probably move to Dashlane (which is significantly more expensive & a bit more work to use - extensions won't work without a desktop app)
atemerev 10y ago
I have lost 4 hardware tokens already. :(
ejcx 10y ago
Not to shamelessly self promote, but if you like pass but hate GPG, then I already built you a command line password manager that is almost exactly the same as pass It can securely save files, generate passwords, save passwords and optionally can sync using git. https://github.com/ejcx/passgo https://github.com/ejcx/passgo
- NickBusey 10y ago
  As someone with basically no experience with encryption, why would someone hate GPG?
  - cyphar 10y ago
    GPG is well known to have a very clunky interface. It also is based on very old crypto (we know it works against the NSA, but we also know that it has problems that other crypto doesn't).
Ajedi32 10y ago
Eh, the UX doesn't look great compared to my current solution (KeePass). No browser integration or auto-type, no InputStick support on mobile, etc. YubiKey support looks pretty nice though; I'm not sure there's an easy way to do what with KeePass.
SippinLean 10y ago
Does it officially support every major browser on my desktop and phone? Anything that doesn't is still less useful to be than LastPass.
- stable-point 10y ago
  I don't think it supports any browsers via plugin. You use a separate app to unlock your keychain, it places the relevant password on your clipboard and then it clears the clipboard 30s later. Very simple and therefore avoids a whole bunch of vulnerabilities other password managers (like LastPass) introduce by integrating with browser plugins.
  - SippinLean 10y ago
    Sounds a lot more complicated than automatically logging me in without need for any action on my part like LastPass
baliex 10y ago
Can you point me in the direction of the iOS client? Nevermind, I think I've got it (https://github.com/davidjb/pass-ios https://github.com/davidjb/pass-ios) but is there a no-jailbreak option?

omtose 10y ago

I'm also a user of pass, but the fact that all the metadata is in clear is a big beef for me. How do you solve that, if at all?

aban 10y ago
Fellow pass user here. freepass [0] seems like it could be a potential candidate, somewhere between pass and LessPass, but I haven't tried it out for myself yet. [0]: https://github.com/myfreeweb/freepass https://github.com/myfreeweb/freepass
JetSpiegel 10y ago
You could encrypt the password store folder with another gpg container. That would be your master password.
supergreg 10y ago
Maybe you can put the whole .pass directory inside an encfs directory. Encryption all the way down.
adilparvez 10y ago
You can use a hash of the site appended with a .pass wide pepper as the name of the directory storing credentials for a particular site, then use a wrapper script that hashes its input before passing it to pass. Also full disk encryption.
- omtose 10y ago
  This is all a lot of effort, if I went down that road I might as well skip "pass" and handle the passwords myself. What I like about pass is that there isn't much setup. Full disk encryption also doesn't prevent a running application from seeing the directory structure. But I guess this is not a very realistic attack vector.
  - adilparvez 10y ago
    Yes, under that threat model you would lose with all of these password managers.
    - omtose 10y ago
      How so? If the entire directory structure is also encrypted then no program can easily know which sites or services I have passwords for.
      - adilparvez 10y ago
        I was meaning if your machine was compromised.

lucaspiller 10y ago

I was using this for ~4 years and really liked it, but recently I've been using 1Password. I tried 1Password as it has a family plan, that didn't really work out though (getting non-technical people to use a password manager is hard - so I'll forever keep being asked "What's the Netflix password?"), but I have stuck with it for myself. I really like the browser integration, which there isn't anything comparable for pass. I had a bash script [0] which when run would pull the current URL from my browser, and run pass to generate or copy the password to the clipboard - but the 1Password extension is so much nicer. If I'm on a site with weird requirements I'd have to figure out the params to make pass generate a password which matched it; with the extension I just click a few buttons. I've also got hooked on the iOS app. I didn't know there was one for pass, but it looks rather basic compared to 1Password [1]. 1Password also supports TOTP, so you don't need a seperate app for that - although for security you probably should. Maybe one day I'll get around to writing my own extension and app for pass, but for now paying $60/year is worth it for me. I don't pay for many apps/services, but this I find really worth it. [0] https://github.com/lucaspiller/passosx https://github.com/lucaspiller/passosx [1] https://github.com/davidjb/pass-ios https://github.com/davidjb/pass-ios

iKlsR 10y ago
https://www.enpass.io/ https://www.enpass.io/ is a winner for me.
gr3yh47 10y ago
>I really like the browser integration, which there isn't anything comparable for pass. people keep saying stuff like this (the one i use because x feature has no real competitor) lastpass. i've used most password managers out there and lastpass hits all these points and more
- ohstopitu 10y ago
  After lastpass was bought out, I went on a spree to find a different password manager and in that process, I tried almost all of them (free & paid). Nothing came close to Lastpass so I decided to stick with them until they mess up. If the worst comes to worst, I'll probably move to Dashlane (which is significantly more expensive & a bit more work to use - extensions won't work without a desktop app)

atemerev 10y ago

I have lost 4 hardware tokens already. :(

ejcx 10y ago

Not to shamelessly self promote, but if you like pass but hate GPG, then I already built you a command line password manager that is almost exactly the same as pass It can securely save files, generate passwords, save passwords and optionally can sync using git. https://github.com/ejcx/passgo https://github.com/ejcx/passgo

NickBusey 10y ago
As someone with basically no experience with encryption, why would someone hate GPG?
- cyphar 10y ago
  GPG is well known to have a very clunky interface. It also is based on very old crypto (we know it works against the NSA, but we also know that it has problems that other crypto doesn't).

Ajedi32 10y ago

Eh, the UX doesn't look great compared to my current solution (KeePass). No browser integration or auto-type, no InputStick support on mobile, etc. YubiKey support looks pretty nice though; I'm not sure there's an easy way to do what with KeePass.

SippinLean 10y ago

Does it officially support every major browser on my desktop and phone? Anything that doesn't is still less useful to be than LastPass.

stable-point 10y ago
I don't think it supports any browsers via plugin. You use a separate app to unlock your keychain, it places the relevant password on your clipboard and then it clears the clipboard 30s later. Very simple and therefore avoids a whole bunch of vulnerabilities other password managers (like LastPass) introduce by integrating with browser plugins.
- SippinLean 10y ago
  Sounds a lot more complicated than automatically logging me in without need for any action on my part like LastPass

baliex 10y ago

Can you point me in the direction of the iOS client? Nevermind, I think I've got it (https://github.com/davidjb/pass-ios https://github.com/davidjb/pass-ios) but is there a no-jailbreak option?