3 ms·
passwordstore.org is good if you're a nerd. It's built on standard linux tools: pwgen, gnupg, git. QTPass is a QT based multi-platform desktop gui version. That
by danjoc 10y ago
passwordstore.org is good if you're a nerd. It's built on standard linux tools: pwgen, gnupg, git. QTPass is a QT based multi-platform desktop gui version. That helps if you're not in the mood to be a nerd today. Android Password Store is the mobile version and integrates with Android chrome/chromium. Thanks to gnupg, pass also works in conjunction with smartcards like Yubikeys. Open Keychain on android allows you to use a Yubikey Neo with Android Password Store. PassFF is the Firefox plugin.
Usage: It's a git repo with passwords stored in encrypted text files. Syncing is done by push/pull the git repo. Since it is git, you have a record of every password you ever generated. Unlocking a password with a Yubikey requires a pin entry and a physical touch. Once entered, the key is available for further passwords without pin, but a Yubikey 4 can be configured to require a touch every time if you're worried about compromised hardware stealing your entire password database.
There's no import from other managers that I'm aware of, but it might exist. Googling stuff about 'pass' is tedious. Google for 'zx2c4 pass' and you'll have better results.
- ricardobeat 10y agoDoes using PGP make it any safer than, say, simple password-based SHA-512 encryption?
- danjoc 10y agoIt does. Using PGP in conjunction with a Yubikey means even if someone obtains your password repo, they still can't get in without your physical private key. Without using a Yubikey, an attacker would still need to obtain the private key. They couldn't just grab the vault from the cloud store and start running offline password cracking on it.
- scott_karana 10y agoHow do you encrypt using a hash function?...
- tripzilch 10y agoWhile it can be done (use the secure hash to generate a key stream--but first google it because I bet there are some pitfalls to keep an eye on), I assume that the parent poster meant to indicate a symmetric encryption algorithm like AES (as opposed to asymmetric PGP), instead of a hash algorithm like SHA.