10 ms·

Announcing gopass – A 'pass' compatible password manager for teams

128 points by MetalMatze 10y ago

endymi0n 10y ago
We're the team behind gopass and worked hard over the last weeks to bring you this - happy to hear any feedback!
- danjoc 10y ago
  I've used QTPass. It provides support to encrypt password directories to multiple keys. It allows for multiple profiles as well, so one can have a team password store as well as a private one. It can also auto push/pull. Plus it has a nice cross platform gui. Can you elaborate on the differences between how gopass and QTPass accomplish these things and why one might want to choose gopass instead?
  - endymi0n 10y ago
    Actually, QTPass uses `pass` under the hood (which means you can use it with gopass as well!) and seems to have taken a different abstraction on it than we did, I didn't know about that project. That being said, with the next versions we're supporting much nicer features as well, such as binary secrets, grant/request workflows and other stuff. We cater to a command-line first audience, but there's nothing preventing you from using QTPass with gopass.
  - endymi0n 10y ago
    Roadmap Be 100% pass compatible Storing binary files in gopass (almost done) Storing structured files and templates (credit cards, DBs, websites...) UX improvements and more wizards Tackle the information disclosure issue Build a great workflow for requesting and granting access Better and more fine grained ACL Be nicely usable by semi- and non-technical users
    - danjoc 10y ago
      >Tackle the information disclosure issue I'm curious how you plan to approach this one. One nice thing about passff is that it can find the right password file based on if the file name matches the domain. I don't need to drill down to my bank/paypal file when I visit paypal.com for instance. It would be nice if a public github repo would suffice, but putting a git remote on a usb stick works pretty nicely and is private as well. I'm considering writing an implementation myself for a different audience, so it is nice to pick your brains as you've probably given this a lot of thought too :)
- EdwinHoksberg 10y ago
  Looks great! Will be using this instead of pass from now on :) Any plans for adding fish shell autocompletions?
- kfrzcode 10y ago
  Autocompletion on zsh didn't work out of the box, but I'll give it a go for a few weeks and let you know ;)
  - dewey 10y ago
    Did you try this? https://github.com/justwatchcom/gopass#autocompletion https://github.com/justwatchcom/gopass#autocompletion
tyingq 10y ago
Pretty neat, and addresses a space where no tools seem to exist. Would be cool if it could leverage a GitHub public repo for password updates. Something like using the list of collaborators on a repo, iterate over their GH public keys, and push new encrypted files for each collaborator on the repo. I suppose though, this would leak a lot of metadata on how the tool is being used, and would tie it too closely to GitHub vs just git.
- endymi0n 10y ago
  You can use a public repo - we just wouldn't recommend it at this point in time, for the obvious reason of metadata leakage. We're currently thinking hard about how to enable this while still leaving the nice properties of git merges alone - might be some kind of shadow mode with hashed identifiers in the end.
- hobarrera 10y ago
  > Pretty neat, and addresses a space where no tools seem to exist. It's literally a port of an existing tool, so a tool DID exist.
  - tyingq 10y ago
    The space is "team sharing" for passwords. My reading of the post says that's a net new feature. Or did I miss something?
    - hobarrera 10y ago
      pass doesn't lack anything for "team sharing". You can add the GPG keys for multiple users ("team"), and they can all read those passwords. From what I can tell, gopass adds nothing new here (they even brag about using the same format/interface).
Daviey 10y ago
A comparison between this and Vault would be super useful.
- endymi0n 10y ago
  Vault is pretty cool as well, but hard to set up correctly (you need your own PKI for serious use, etc.) - it's sweet spot are server sided and app secrets used in production, while gopass is meant to cater for all kinds of shared secrets in distributed teams.
  - falsedan 10y ago
    I don't understand the distinction. Vault's sweet spot is automated generation and revocation of credentials which are given to authenticated clients (like creating a one-off keypair for an SSH session & giving the private part to the user and allowing the server to read the public part). We're currently testing the waters of migrating our pass-like shared password store to vault (so we can grant authorization to automated scripts to read certain shared rotated creds).
    - tex0 10y ago
      I would very much encourage anyone to use Vault to manage secrets consumed by machines, but for personal credentials it's maybe not the best fit.
      - endymi0n 10y ago
        One of my ideas was using Vault as an alternative backing store for a gopass mount actually. And then it's Vault for company secrets (and no hassle with keys due to central PKI) and gpg for private stores (fast & simple to set up on your own).
      - falsedan 10y ago
        Can you elaborate? (I know why not to use Vault for my banking passwords, also why to use it for the bind password for some app's LDAP auth backend)
WhitneyLand 10y ago
so this intended to be unix focused, not something that could replace lastpass for example? been looking for something better than lp.
- endymi0n 10y ago
  We're happy to include Windows as well (shouldn't be that hard to integrate thanks to Go), but there's simply nobody using Windows in the team at this point. Feel free to contribute - this project is meant to be the rock solid base of a very versatile password manager ecosystem.
  - majkinetor 10y ago
    Oh freck, that was a first thing I thought - finally native pass on Windows. When I came in the docs to the mount land I stopped hopping. Being that mount is needed for just one feature that I can totally live without, what are the other obastacles to proper x-platform solution ? AFAIK all other deps are available on native Windows (not cygwin or ubuntu4win). I will definitivelly try to see if it works.
- devopsproject 10y ago
  dashlane?
  - nyolfen 10y ago
    this is the first i've heard of dashlane -- looks more or less like a lp clone, can someone give me a comparison rundown/why one would prefer it?
    - devopsproject 10y ago
      They are both password managers and will have similar features. Google "lastpass vs dashlane" and you will find several comparisons
- eridius 10y ago
zx2c4 10y ago
> Second, with all due respect to the original author zx2c4 (who is currently working on the very promising WireGuard project) Indeed I am working on WireGuard. But I haven't forgotten pass. We're currently working on a new release. > the project proved to be a wild bunch of hotwired bash scripts that mostly looked like they were written as a one-off job I very much disagree with this silliness.
- MetalMatze 10y ago
  First of all: Thank you for pass! We've been using it a lot internally and just because pass is so awesome, we decided to start gopass. We use Go for almost everything at JustWatch and that's why we decided to rewrite it in Go as this would allow us to add even more features with better abstraction in the future. Bash just didn't feel like the right fit for that.
  - benologist 10y ago
    That's exciting, because now we get to find out how big a problem is a tool you use being in a language you don't. It might actually be a good idea if the original one is waning cause you only need to make a competitive version of any one of those tools or businesses.
  - gmluke 10y ago
    I looked at the code for pass recently, and thought it was a nice example of something where bash is absolutely adequate. You point out (in discussing the design of pass): > There is one slight drawback to all the simplicity, and that is an information disclosure inherent to the design: pass stores all folder and file names in clear text, so even if you fully trust GPG, you should probably not put this repo into a public place like Github, because this may expose your account names and other metadata. What's not completely obvious from a cursory read is whether gopass improves upon that. Also, the multiple stores feature looks like it might be quite nice, but a lengthier example would be very helpful! Edit: improve clarity
    - johnnycarcin 10y ago
LamaOfRuin 10y ago
Should tab completion work with gopass? Seems pretty unusable to me as a general purpose password manager without it, but it doesn't work for me out of the box with a `go get` source install. Edit: found it on the github readme https://github.com/justwatchcom/gopass#autocompletion https://github.com/justwatchcom/gopass#autocompletion
VA3FXP 10y ago
I'm pretty excited about this actually. Thank-you so much for your efforts. I've been using pass for awhile now, and I really love what it does, but it's a case where it feels 90% finished. I have one desperate request; colour output as an option. Every time there is an update to pass (or I need to reinstall) I need to edit the file and change the options from " tree -C " to " tree -n " This is a pain in the ass. I am visually impaired. The 'default' dark-blue that tree uses for directories is unreadable to me. My two choices for dealing with this are to use DIRCOLORS or edit the pass executable. I'd prefer to not muck about with my environment settings. (as I do not normally see any colour output) Anyway; awesome project!
- MetalMatze 10y ago
  https://github.com/justwatchcom/gopass/issues/4 https://github.com/justwatchcom/gopass/issues/4 I just created an issue for that. Shouldn't be that hard to support it. Feel free to subscribe to the issue on github or comment any thing that's missing. Thanks!
zeveb 10y ago
> There is one slight drawback to all the simplicity, and that is an information disclosure inherent to the design: pass stores all folder and file names in clear text, so even if you fully trust GPG, you should probably not put this repo into a public place like Github, because this may expose your account names and other metadata. This is my concern with pass. It's an awesome tool, but it really needs to figure out a way to hide the filenames. I think this is doable (after all, encfs has the same need, and does it well), but I don't know if the pass team have the will to do it. > First, the project is curated in a traditional mailing-list based approach that was pretty unapproachable compared to a modern Github based workflow. Sigh, not this again. I think that I prefer email vice a proprietary, centralised single point of failure like GitHub, and I know that I'd rather not work with someone who considers email unapproachable. If your email account is unmanageable, fix it. Email's a really, really valuable tool; don't let go of it.
- dewey 10y ago
  I don't see how GitHub is a single point of failure, the tool was developed on an internal Gitlab instance and then just pushed to GitHub. In case anything happens to GitHub you'd just have to push it to some new service and update the website. Nothing will be lost. It's just more exposure to put it on GitHub right now because most people bookmark/star there repositories there and don't want to bookmark different cgit/Gitlab/gogs/gitea links. I don't think anyone is abandoning emails just because they don't want to email patches around and manually apply them.
- abeyer 10y ago
  > Sigh, not this again. I think that I prefer email vice a proprietary, centralised single point of failure like GitHub, and I know that I'd rather not work with someone who considers email unapproachable. That's a fair debate in general, and I think you're right that there are some advantages to mailing-list driven approaches when they're done really well. But after being subscribed to the pass list the last few months (and having seen similar situations on other projects in the past), I've been a bit underwhelmed with the actual execution there. There seems to be a lack of transparency around how to submit, what to submit, if/when/how it's considered or evaluated for incorporation, and when that might actually make it to a release. As a result there seems to be (even in this fairly short time) lots of repeated conversations about similar fixes/features/ideas and duplicate and overlapping patches around them. I get that it seems to be a one-person show, and maybe not his/her top priority, and don't mean this as a criticism of the project (which I use and love.) But I think it's valuable to note that mail based models do really need active and engaged maintainers on the list all the time to make them work out well. If they aren't able or willing to do so, and want to be a bit more hands-off, I think github or something like it perhaps is a better model.
draven 10y ago
I just spent a few hours to migrate our keepassx database to pass and make the team switch to pass. Gopass seems great, especially the multistore support (which you can do w/ pass by setting an env variable), thank you for your work!
- nerdponx 10y ago
  What made you want to switch?
OJFord 10y ago
This looks great, I've been toying with something similar built on top of Keybase that I just use for personal passwords, but using KBFS means it should be simple to extend it to shared passwords, since you just store it in the `private/me,you` directory instead of `private/me`. My concern with using something like this or pass is that I have to manage the distribution/backup of the store/vault/db myself - whereas I can throw my laptop off a cliff, buy a new one, login to Keybase, and my passwords are still there.
ejcx 10y ago
Shameless self plug, I actually build a project called passgo, modeled after Jason's pass project as well. I'm a huge fan of pass' simplicity, but I really dislike managing keys: https://github.com/ejcx/passgo https://github.com/ejcx/passgo The difference is mine does not use PGP and is instead password based, but the command line interface is almost identical. I now use passgo to encrypt and manage my ssh keys, etc.
- MetalMatze 10y ago
  Saw that in the process of writing gopass too! > The difference is mine does not use PGP and is instead password based... And we still wanted to use PGP because crypto is hard. :)
praseodym 10y ago
There's a Chrome+Firefox browser plug-in which also uses a native binary written in Go: https://github.com/dannyvankooten/browserpass/blob/master/browserpass.go https://github.com/dannyvankooten/browserpass/blob/master/br...
- MetalMatze 10y ago
  Yep. I'm using that extension on Chrome everyday with gopass in the background. Works great! Now that we published gopass I wanted to take another look at the source of browserpass in the coming days. Maybe we can try to support both pass & gopass (with the new features).
homakov 10y ago
Any example of a company where few people badly need to share password and there is no "team" where you can add new users?
rkeene2 10y ago
I have a similar project that uses smartcards/HSMs/anything with a PKCS#11 interface called "hunter2": https://chiselapp.com/user/rkeene/repository/hunter2/ https://chiselapp.com/user/rkeene/repository/hunter2/
dkonofalski 10y ago
Really weird that there's no mention of 1Password and its flexibility through both 1Password for Teams and 1Password Shared Vaults. I work with 2 different teams that share passwords like this and one of them has a shared vault that syncs through Dropbox for everyone while the other one is managed through 1Password for Teams so that we can update passwords and access at our discretion. I'm very curious to see how this will stack up against those solutions because, to be honest, there is very little room for improvement from 1Password, in my eyes. They have a very, very solid and secure product and the UI is fantastic.
- swozey 10y ago
  Not viable until they support Linux which they've put zero effort into doing even though it's been requested for years. I used to use it in Wine which was decent but the Chrome extension couldn't talk to the app which makes using it a terrible UX (open app, search for pass, copy, paste, over and over). Literally the only reason I currently use OSX. A password manager... Here's the 6 year old 35 page thread if you want to throw your vote into a black hole; https://discussions.agilebits.com/discussion/2846/new-product-request-1password-for-linux/p1 https://discussions.agilebits.com/discussion/2846/new-produc... Instead they've become a SAAS Lastpass competitor which literally nobody asked for, in fact people were trying to leave LastPass due it it's forced-online nature (which naturally frightens people, having your passwords stored online somewhere).
  - caconym_ 10y ago
    > Instead they've become a SAAS Lastpass competitor which literally nobody asked for, in fact people were trying to leave LastPass due it it's forced-online nature (which naturally frightens people, having your passwords stored online somewhere). I've used 1Password for a number of years and loved it and recommended it to friends and family, but their offering now just confuses me. I don't even know what their product is anymore, and I really need to be able to understand the attack surface of my password manager. So I've been looking into... other options.
    - 10y ago
aeorgnoieang 10y ago
I'm currently using Pass on most of my computers. I was using Bruce Schneier's Password Safe (and various compatible apps: pwSafe on Mac and iOS and Password Gorilla on an older Mac and Linux boxes) and the big pain for me was merging changes. I'd found that trying to use a single 'safe' via Dropbox was a recipe for disaster because some of the programs wouldn't cleanly close the safe file, or at least one of them would occasionally complain about the state of the file. So I created a copy of the safe for each of my computers and devices. Then every 6 months or so I'd merge all of the safe files into a single file and recreate all of the device-specific files as copies of that single file. But merging in Password Safe sucked. There was no way to review the differences between entries in different safes, other than manually inspecting entries. I don't believe either of the two versions (Mac and iOS) of pwSafe (both version 1) supported merging at all. Password Gorilla was actually the best among the bunch as it had a nice 'diff' window with which you could explicitly pick which version of several fields for an entry you wanted to retain. But sometimes I couldn't get its 'diff' window to fit on my screen so I'd have to plug my laptop into a larger monitor. Using Pass with Git is so much easier. I've also been using git-remote-gcrypt[1] to push my local Pass repos to a shared 'remote' file stored in Dropbox. It works great. [1] https://spwhitton.name/tech/code/git-remote-gcrypt/ https://spwhitton.name/tech/code/git-remote-gcrypt/ The only painful aspects of Pass now is the weird behavior of `gpg` on Windows in Cygwin and the clunkiness of my current multi-repo setup. Hopefully running Pass under "Bash on Ubuntu on Windows" will mitigate the former. Given that Pass is written in Bash and that the various repo config settings are read from environment variables, it doesn't seem likely that the latter will get much better than my current setup, which involves sourcing a script to switch the relevant environment variables.
- MetalMatze 10y ago
  I know the pain of managing the synchronization of your password store. That's exactly why we enable git by default now and auto commit all you changes like pass did before. For me it works great personally, but also with a team it's awesome. It just feels like working with people that know git on something not encrypted. Regard the windows support we would be happy to get as much feedback on that as possible. Nobody of us uses windows with gopass. If you have any idea how to improve the experience please let us know. Thanks!
miduil 10y ago
I've been using `pass` for a very long time, and in combination with dmenu or rofi, it has proven to improve my workflow accessing passphrases a lot. For 'teams' (and serv{er, ices}) I've started implementing some stuff via. vault-project [0]. The project looks really promising, sadly never got up-voted on HN so far. The basic concept of vault is a centralized storage of secrets, managed via. Access-Control-Lists (ACLs) and accessible via. REST. Because the secrets are only accessible from a single point, you'll also have an overview of who did access which secret (called audit log). It's also possible to implement replacing all necessary secrets whenever someone has left/changed the group that got access to the secrets. Vault also makes integration in certain provisioning tools possible (though, that's something you need to spend more development in). Vault provides many database-backends [1], but also various other things (like ssh [2]). Other things for managing secrets are: - keywhiz: https://square.github.io/keywhiz/single_page.html https://square.github.io/keywhiz/single_page.html - keyringer: https://keyringer.pw https://keyringer.pw [0]: https://www.vaultproject.io/ https://www.vaultproject.io/ [1]: https://www.vaultproject.io/docs/secrets/index.html https://www.vaultproject.io/docs/secrets/index.html [2]: https://www.vaultproject.io/docs/secrets/ssh/index.html https://www.vaultproject.io/docs/secrets/ssh/index.html
- riffic 10y ago
  Hashicorp's Vault is highly regarded in the DevOps community.
- MetalMatze 10y ago
  Yes. Vault is awesome and we're planning to use Vault ourselves. However Vault is mostly meant for machines to read the secrets and gopass is designed for humans.
marcosnils 10y ago
Hey there, Vault auhtor here ( not the Hashicorp one, ours is earlier). Wondering if you came across our project https://github.com/franela/vault https://github.com/franela/vault
jpeeler 10y ago
I quickly looked to see what git library gopass is using, but it looks like git is just being called directly: https://github.com/justwatchcom/gopass/blob/a6f88e079be193f82779abb49d89c90442c91edb/password/git.go#L32 https://github.com/justwatchcom/gopass/blob/a6f88e079be193f8... . Surely libgit2 would work well here.

128 points by MetalMatze 10y ago

endymi0n 10y ago

We're the team behind gopass and worked hard over the last weeks to bring you this - happy to hear any feedback!

danjoc 10y ago
I've used QTPass. It provides support to encrypt password directories to multiple keys. It allows for multiple profiles as well, so one can have a team password store as well as a private one. It can also auto push/pull. Plus it has a nice cross platform gui. Can you elaborate on the differences between how gopass and QTPass accomplish these things and why one might want to choose gopass instead?
- endymi0n 10y ago
  Actually, QTPass uses `pass` under the hood (which means you can use it with gopass as well!) and seems to have taken a different abstraction on it than we did, I didn't know about that project. That being said, with the next versions we're supporting much nicer features as well, such as binary secrets, grant/request workflows and other stuff. We cater to a command-line first audience, but there's nothing preventing you from using QTPass with gopass.
- endymi0n 10y ago
  Roadmap Be 100% pass compatible Storing binary files in gopass (almost done) Storing structured files and templates (credit cards, DBs, websites...) UX improvements and more wizards Tackle the information disclosure issue Build a great workflow for requesting and granting access Better and more fine grained ACL Be nicely usable by semi- and non-technical users
  - danjoc 10y ago
    >Tackle the information disclosure issue I'm curious how you plan to approach this one. One nice thing about passff is that it can find the right password file based on if the file name matches the domain. I don't need to drill down to my bank/paypal file when I visit paypal.com for instance. It would be nice if a public github repo would suffice, but putting a git remote on a usb stick works pretty nicely and is private as well. I'm considering writing an implementation myself for a different audience, so it is nice to pick your brains as you've probably given this a lot of thought too :)
EdwinHoksberg 10y ago
Looks great! Will be using this instead of pass from now on :) Any plans for adding fish shell autocompletions?
kfrzcode 10y ago
Autocompletion on zsh didn't work out of the box, but I'll give it a go for a few weeks and let you know ;)
- dewey 10y ago
  Did you try this? https://github.com/justwatchcom/gopass#autocompletion https://github.com/justwatchcom/gopass#autocompletion

tyingq 10y ago

Pretty neat, and addresses a space where no tools seem to exist. Would be cool if it could leverage a GitHub public repo for password updates. Something like using the list of collaborators on a repo, iterate over their GH public keys, and push new encrypted files for each collaborator on the repo. I suppose though, this would leak a lot of metadata on how the tool is being used, and would tie it too closely to GitHub vs just git.

endymi0n 10y ago
You can use a public repo - we just wouldn't recommend it at this point in time, for the obvious reason of metadata leakage. We're currently thinking hard about how to enable this while still leaving the nice properties of git merges alone - might be some kind of shadow mode with hashed identifiers in the end.
hobarrera 10y ago
> Pretty neat, and addresses a space where no tools seem to exist. It's literally a port of an existing tool, so a tool DID exist.
- tyingq 10y ago
  The space is "team sharing" for passwords. My reading of the post says that's a net new feature. Or did I miss something?
  - hobarrera 10y ago
    pass doesn't lack anything for "team sharing". You can add the GPG keys for multiple users ("team"), and they can all read those passwords. From what I can tell, gopass adds nothing new here (they even brag about using the same format/interface).

Daviey 10y ago

A comparison between this and Vault would be super useful.

endymi0n 10y ago
Vault is pretty cool as well, but hard to set up correctly (you need your own PKI for serious use, etc.) - it's sweet spot are server sided and app secrets used in production, while gopass is meant to cater for all kinds of shared secrets in distributed teams.
- falsedan 10y ago
  I don't understand the distinction. Vault's sweet spot is automated generation and revocation of credentials which are given to authenticated clients (like creating a one-off keypair for an SSH session & giving the private part to the user and allowing the server to read the public part). We're currently testing the waters of migrating our pass-like shared password store to vault (so we can grant authorization to automated scripts to read certain shared rotated creds).
  - tex0 10y ago
    I would very much encourage anyone to use Vault to manage secrets consumed by machines, but for personal credentials it's maybe not the best fit.
    - endymi0n 10y ago
      One of my ideas was using Vault as an alternative backing store for a gopass mount actually. And then it's Vault for company secrets (and no hassle with keys due to central PKI) and gpg for private stores (fast & simple to set up on your own).
    - falsedan 10y ago
      Can you elaborate? (I know why not to use Vault for my banking passwords, also why to use it for the bind password for some app's LDAP auth backend)

WhitneyLand 10y ago

so this intended to be unix focused, not something that could replace lastpass for example? been looking for something better than lp.

endymi0n 10y ago
We're happy to include Windows as well (shouldn't be that hard to integrate thanks to Go), but there's simply nobody using Windows in the team at this point. Feel free to contribute - this project is meant to be the rock solid base of a very versatile password manager ecosystem.
- majkinetor 10y ago
  Oh freck, that was a first thing I thought - finally native pass on Windows. When I came in the docs to the mount land I stopped hopping. Being that mount is needed for just one feature that I can totally live without, what are the other obastacles to proper x-platform solution ? AFAIK all other deps are available on native Windows (not cygwin or ubuntu4win). I will definitivelly try to see if it works.
devopsproject 10y ago
dashlane?
- nyolfen 10y ago
  this is the first i've heard of dashlane -- looks more or less like a lp clone, can someone give me a comparison rundown/why one would prefer it?
  - devopsproject 10y ago
    They are both password managers and will have similar features. Google "lastpass vs dashlane" and you will find several comparisons
eridius 10y ago

zx2c4 10y ago

> Second, with all due respect to the original author zx2c4 (who is currently working on the very promising WireGuard project) Indeed I am working on WireGuard. But I haven't forgotten pass. We're currently working on a new release. > the project proved to be a wild bunch of hotwired bash scripts that mostly looked like they were written as a one-off job I very much disagree with this silliness.

MetalMatze 10y ago
First of all: Thank you for pass! We've been using it a lot internally and just because pass is so awesome, we decided to start gopass. We use Go for almost everything at JustWatch and that's why we decided to rewrite it in Go as this would allow us to add even more features with better abstraction in the future. Bash just didn't feel like the right fit for that.
- benologist 10y ago
  That's exciting, because now we get to find out how big a problem is a tool you use being in a language you don't. It might actually be a good idea if the original one is waning cause you only need to make a competitive version of any one of those tools or businesses.
- gmluke 10y ago
  I looked at the code for pass recently, and thought it was a nice example of something where bash is absolutely adequate. You point out (in discussing the design of pass): > There is one slight drawback to all the simplicity, and that is an information disclosure inherent to the design: pass stores all folder and file names in clear text, so even if you fully trust GPG, you should probably not put this repo into a public place like Github, because this may expose your account names and other metadata. What's not completely obvious from a cursory read is whether gopass improves upon that. Also, the multiple stores feature looks like it might be quite nice, but a lengthier example would be very helpful! Edit: improve clarity
  - johnnycarcin 10y ago

LamaOfRuin 10y ago

Should tab completion work with gopass? Seems pretty unusable to me as a general purpose password manager without it, but it doesn't work for me out of the box with a `go get` source install. Edit: found it on the github readme https://github.com/justwatchcom/gopass#autocompletion https://github.com/justwatchcom/gopass#autocompletion

VA3FXP 10y ago

I'm pretty excited about this actually. Thank-you so much for your efforts. I've been using pass for awhile now, and I really love what it does, but it's a case where it feels 90% finished. I have one desperate request; colour output as an option. Every time there is an update to pass (or I need to reinstall) I need to edit the file and change the options from " tree -C " to " tree -n " This is a pain in the ass. I am visually impaired. The 'default' dark-blue that tree uses for directories is unreadable to me. My two choices for dealing with this are to use DIRCOLORS or edit the pass executable. I'd prefer to not muck about with my environment settings. (as I do not normally see any colour output) Anyway; awesome project!

MetalMatze 10y ago
https://github.com/justwatchcom/gopass/issues/4 https://github.com/justwatchcom/gopass/issues/4 I just created an issue for that. Shouldn't be that hard to support it. Feel free to subscribe to the issue on github or comment any thing that's missing. Thanks!

zeveb 10y ago

> There is one slight drawback to all the simplicity, and that is an information disclosure inherent to the design: pass stores all folder and file names in clear text, so even if you fully trust GPG, you should probably not put this repo into a public place like Github, because this may expose your account names and other metadata. This is my concern with pass. It's an awesome tool, but it really needs to figure out a way to hide the filenames. I think this is doable (after all, encfs has the same need, and does it well), but I don't know if the pass team have the will to do it. > First, the project is curated in a traditional mailing-list based approach that was pretty unapproachable compared to a modern Github based workflow. Sigh, not this again. I think that I prefer email vice a proprietary, centralised single point of failure like GitHub, and I know that I'd rather not work with someone who considers email unapproachable. If your email account is unmanageable, fix it. Email's a really, really valuable tool; don't let go of it.

dewey 10y ago
I don't see how GitHub is a single point of failure, the tool was developed on an internal Gitlab instance and then just pushed to GitHub. In case anything happens to GitHub you'd just have to push it to some new service and update the website. Nothing will be lost. It's just more exposure to put it on GitHub right now because most people bookmark/star there repositories there and don't want to bookmark different cgit/Gitlab/gogs/gitea links. I don't think anyone is abandoning emails just because they don't want to email patches around and manually apply them.
abeyer 10y ago
> Sigh, not this again. I think that I prefer email vice a proprietary, centralised single point of failure like GitHub, and I know that I'd rather not work with someone who considers email unapproachable. That's a fair debate in general, and I think you're right that there are some advantages to mailing-list driven approaches when they're done really well. But after being subscribed to the pass list the last few months (and having seen similar situations on other projects in the past), I've been a bit underwhelmed with the actual execution there. There seems to be a lack of transparency around how to submit, what to submit, if/when/how it's considered or evaluated for incorporation, and when that might actually make it to a release. As a result there seems to be (even in this fairly short time) lots of repeated conversations about similar fixes/features/ideas and duplicate and overlapping patches around them. I get that it seems to be a one-person show, and maybe not his/her top priority, and don't mean this as a criticism of the project (which I use and love.) But I think it's valuable to note that mail based models do really need active and engaged maintainers on the list all the time to make them work out well. If they aren't able or willing to do so, and want to be a bit more hands-off, I think github or something like it perhaps is a better model.

draven 10y ago

I just spent a few hours to migrate our keepassx database to pass and make the team switch to pass. Gopass seems great, especially the multistore support (which you can do w/ pass by setting an env variable), thank you for your work!

nerdponx 10y ago
What made you want to switch?

OJFord 10y ago

This looks great, I've been toying with something similar built on top of Keybase that I just use for personal passwords, but using KBFS means it should be simple to extend it to shared passwords, since you just store it in the `private/me,you` directory instead of `private/me`. My concern with using something like this or pass is that I have to manage the distribution/backup of the store/vault/db myself - whereas I can throw my laptop off a cliff, buy a new one, login to Keybase, and my passwords are still there.

ejcx 10y ago

Shameless self plug, I actually build a project called passgo, modeled after Jason's pass project as well. I'm a huge fan of pass' simplicity, but I really dislike managing keys: https://github.com/ejcx/passgo https://github.com/ejcx/passgo The difference is mine does not use PGP and is instead password based, but the command line interface is almost identical. I now use passgo to encrypt and manage my ssh keys, etc.

MetalMatze 10y ago
Saw that in the process of writing gopass too! > The difference is mine does not use PGP and is instead password based... And we still wanted to use PGP because crypto is hard. :)

praseodym 10y ago

There's a Chrome+Firefox browser plug-in which also uses a native binary written in Go: https://github.com/dannyvankooten/browserpass/blob/master/browserpass.go https://github.com/dannyvankooten/browserpass/blob/master/br...

MetalMatze 10y ago
Yep. I'm using that extension on Chrome everyday with gopass in the background. Works great! Now that we published gopass I wanted to take another look at the source of browserpass in the coming days. Maybe we can try to support both pass & gopass (with the new features).

homakov 10y ago

Any example of a company where few people badly need to share password and there is no "team" where you can add new users?

rkeene2 10y ago

I have a similar project that uses smartcards/HSMs/anything with a PKCS#11 interface called "hunter2": https://chiselapp.com/user/rkeene/repository/hunter2/ https://chiselapp.com/user/rkeene/repository/hunter2/

dkonofalski 10y ago

Really weird that there's no mention of 1Password and its flexibility through both 1Password for Teams and 1Password Shared Vaults. I work with 2 different teams that share passwords like this and one of them has a shared vault that syncs through Dropbox for everyone while the other one is managed through 1Password for Teams so that we can update passwords and access at our discretion. I'm very curious to see how this will stack up against those solutions because, to be honest, there is very little room for improvement from 1Password, in my eyes. They have a very, very solid and secure product and the UI is fantastic.

swozey 10y ago
Not viable until they support Linux which they've put zero effort into doing even though it's been requested for years. I used to use it in Wine which was decent but the Chrome extension couldn't talk to the app which makes using it a terrible UX (open app, search for pass, copy, paste, over and over). Literally the only reason I currently use OSX. A password manager... Here's the 6 year old 35 page thread if you want to throw your vote into a black hole; https://discussions.agilebits.com/discussion/2846/new-product-request-1password-for-linux/p1 https://discussions.agilebits.com/discussion/2846/new-produc... Instead they've become a SAAS Lastpass competitor which literally nobody asked for, in fact people were trying to leave LastPass due it it's forced-online nature (which naturally frightens people, having your passwords stored online somewhere).
- caconym_ 10y ago
  > Instead they've become a SAAS Lastpass competitor which literally nobody asked for, in fact people were trying to leave LastPass due it it's forced-online nature (which naturally frightens people, having your passwords stored online somewhere). I've used 1Password for a number of years and loved it and recommended it to friends and family, but their offering now just confuses me. I don't even know what their product is anymore, and I really need to be able to understand the attack surface of my password manager. So I've been looking into... other options.
  - 10y ago

aeorgnoieang 10y ago

I'm currently using Pass on most of my computers. I was using Bruce Schneier's Password Safe (and various compatible apps: pwSafe on Mac and iOS and Password Gorilla on an older Mac and Linux boxes) and the big pain for me was merging changes. I'd found that trying to use a single 'safe' via Dropbox was a recipe for disaster because some of the programs wouldn't cleanly close the safe file, or at least one of them would occasionally complain about the state of the file. So I created a copy of the safe for each of my computers and devices. Then every 6 months or so I'd merge all of the safe files into a single file and recreate all of the device-specific files as copies of that single file. But merging in Password Safe sucked. There was no way to review the differences between entries in different safes, other than manually inspecting entries. I don't believe either of the two versions (Mac and iOS) of pwSafe (both version 1) supported merging at all. Password Gorilla was actually the best among the bunch as it had a nice 'diff' window with which you could explicitly pick which version of several fields for an entry you wanted to retain. But sometimes I couldn't get its 'diff' window to fit on my screen so I'd have to plug my laptop into a larger monitor. Using Pass with Git is so much easier. I've also been using git-remote-gcrypt[1] to push my local Pass repos to a shared 'remote' file stored in Dropbox. It works great. [1] https://spwhitton.name/tech/code/git-remote-gcrypt/ https://spwhitton.name/tech/code/git-remote-gcrypt/ The only painful aspects of Pass now is the weird behavior of `gpg` on Windows in Cygwin and the clunkiness of my current multi-repo setup. Hopefully running Pass under "Bash on Ubuntu on Windows" will mitigate the former. Given that Pass is written in Bash and that the various repo config settings are read from environment variables, it doesn't seem likely that the latter will get much better than my current setup, which involves sourcing a script to switch the relevant environment variables.

MetalMatze 10y ago
I know the pain of managing the synchronization of your password store. That's exactly why we enable git by default now and auto commit all you changes like pass did before. For me it works great personally, but also with a team it's awesome. It just feels like working with people that know git on something not encrypted. Regard the windows support we would be happy to get as much feedback on that as possible. Nobody of us uses windows with gopass. If you have any idea how to improve the experience please let us know. Thanks!

miduil 10y ago

I've been using `pass` for a very long time, and in combination with dmenu or rofi, it has proven to improve my workflow accessing passphrases a lot. For 'teams' (and serv{er, ices}) I've started implementing some stuff via. vault-project [0]. The project looks really promising, sadly never got up-voted on HN so far. The basic concept of vault is a centralized storage of secrets, managed via. Access-Control-Lists (ACLs) and accessible via. REST. Because the secrets are only accessible from a single point, you'll also have an overview of who did access which secret (called audit log). It's also possible to implement replacing all necessary secrets whenever someone has left/changed the group that got access to the secrets. Vault also makes integration in certain provisioning tools possible (though, that's something you need to spend more development in). Vault provides many database-backends [1], but also various other things (like ssh [2]). Other things for managing secrets are: - keywhiz: https://square.github.io/keywhiz/single_page.html https://square.github.io/keywhiz/single_page.html - keyringer: https://keyringer.pw https://keyringer.pw [0]: https://www.vaultproject.io/ https://www.vaultproject.io/ [1]: https://www.vaultproject.io/docs/secrets/index.html https://www.vaultproject.io/docs/secrets/index.html [2]: https://www.vaultproject.io/docs/secrets/ssh/index.html https://www.vaultproject.io/docs/secrets/ssh/index.html

riffic 10y ago
Hashicorp's Vault is highly regarded in the DevOps community.
MetalMatze 10y ago
Yes. Vault is awesome and we're planning to use Vault ourselves. However Vault is mostly meant for machines to read the secrets and gopass is designed for humans.

marcosnils 10y ago

Hey there, Vault auhtor here ( not the Hashicorp one, ours is earlier). Wondering if you came across our project https://github.com/franela/vault https://github.com/franela/vault

jpeeler 10y ago

I quickly looked to see what git library gopass is using, but it looks like git is just being called directly: https://github.com/justwatchcom/gopass/blob/a6f88e079be193f82779abb49d89c90442c91edb/password/git.go#L32 https://github.com/justwatchcom/gopass/blob/a6f88e079be193f8... . Surely libgit2 would work well here.