4 ms·
A comparison between this and Vault would be super useful.
by Daviey 10y ago
A comparison between this and Vault would be super useful.
- endymi0n 10y agoVault is pretty cool as well, but hard to set up correctly (you need your own PKI for serious use, etc.) - it's sweet spot are server sided and app secrets used in production, while gopass is meant to cater for all kinds of shared secrets in distributed teams.
- falsedan 10y agoI don't understand the distinction. Vault's sweet spot is automated generation and revocation of credentials which are given to authenticated clients (like creating a one-off keypair for an SSH session & giving the private part to the user and allowing the server to read the public part). We're currently testing the waters of migrating our pass-like shared password store to vault (so we can grant authorization to automated scripts to read certain shared rotated creds).
- tex0 10y agoI would very much encourage anyone to use Vault to manage secrets consumed by machines, but for personal credentials it's maybe not the best fit.
- endymi0n 10y agoOne of my ideas was using Vault as an alternative backing store for a gopass mount actually. And then it's Vault for company secrets (and no hassle with keys due to central PKI) and gpg for private stores (fast & simple to set up on your own).
- falsedan 10y agoCan you elaborate? (I know why not to use Vault for my banking passwords, also why to use it for the bind password for some app's LDAP auth backend)
- tptacek 10y agoA "PKI" is just a root signing key. I don't have strong opinions about Vault or the Vault approach in general, but I worry when I see people dispensing advice about secret storage who adopt the position that a PKI is a difficult thing to reason about.