7 ms·

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with wha

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/ https://git.zx2c4.com/password-store/about/

raamdev 9y ago
+1 for `pass`. I wrote a handy Bash script [1] that lets me easily search my passwords without having an exact match (e.g., `fpass fin cap one` quickly finds my password info for "Financial/CapitalOne.gpg"). It makes pulling up passwords so much easier as I only need to remember fragments of how I stored it instead of trying to remember exact folders and names using auto-complete to find the password. I also use iTerm2's system-wide hotkey [2] to quickly show/hide a dedicated terminal window that I use for retrieving passwords. I've been using this setup for years now and I absolutely love it. The only downside is no access from my phone, but I always have my laptop with me and I memorize passwords that I frequently use. 1. https://github.com/raamdev/bin/blob/master/fpass https://github.com/raamdev/bin/blob/master/fpass 2. https://apple.stackexchange.com/a/48805 https://apple.stackexchange.com/a/48805
- enzolovesbacon 9y ago
  Oh my ZSH (http://ohmyz.sh/ http://ohmyz.sh/), if you use zsh of course, has autocomplete, so folders and GPG files are only a few tabs away.
  - earenndil 9y ago
    Don't need omz for autocomplete, it's already there in zsh. I TBH don't really like omz. It feels bloated, and I don't really need anything else on top of the already-awesome zsh.
- nikital 9y ago
  > The only downside is no access from my phone. On Android, I use Password Store to sync my `pass` directory and use it from the phone. It a very high quality app, I had no issues after years of usage. https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store
  - JoshuaRLi 9y ago
    Keepass user here wanting to switch over to pass, this is exactly the missing piece of the puzzle I needed - thank you!
    - pigpigs 9y ago
      I'm looking into using pass / keepass, any particular reason you are switching over to pass?
      - JoshuaRLi 9y ago
        I think I'm currently in a minimalist phase; the KeePassX UI is too feature rich and cluttered and makes me want to configure everything but I don't want to manage that. If that's not a problem for you, KeePassX is definitely a solid password manager!
- tuxxy 9y ago
  Instead of hiding the window, why don't you look into using terminal colors to hide the password? That way the passwords aren't visible until you highlight them.
  - jolmg 9y ago
    Better to use the '-c' option to put the password in the clipboard and not display it in the terminal.
- fmariluis 9y ago
  > The only downside is no access from my phone For iOS: https://github.com/mssun/passforios https://github.com/mssun/passforios works really well and it's open source.
ufo 9y ago
Does pass still stote metadata unencrypted (as file names) or did they fix that now?
tptacek 9y ago
If you're not going to use 1Password, which is still the only commercial password manager I'll recommend, "pass" is probably your best alternative.
- chaitanya 9y ago
  As a LastPass user, any particular reasons why I should avoid them? Is it down to all the security issues they've faced lately?
  - tptacek 9y ago
    1Password is the only commercial password manager I recommend, but I'll go further than that when it comes to LastPass and say: I really think you should avoid LastPass, and, if you're using it, migrate to something else. I'm not going to go into details, sorry.
    - badpenny 9y ago
      LastPass is the only commercial password manager I recommend. I really think you should avoid 1Password. I'm not going to go into details, sorry.
      - tptacek 9y ago
        You do much work in this field?
        parent5446 9y ago
        It doesn't matter whether he does or not. He's using your own argument against you. Stepping in here and saying, "don't worry guys I'm the expert, so don't ask any questions", is just pompous and doesn't actually convince anybody. Use logic to support your claims, not your resume.
        tptacek 9y ago
raziel2p 9y ago
My main reason to not use pass is that I can't allow multiple private keys to unlock the password store. I don't want to transfer my private key between all my machines.
- corey_moncure 9y ago
  You absolutely can do this. In your .gpg-id file, simply list the keys you want to encrypt for on separate lines. Every file below that .gpg-id file in the directory hierarchy will be encrypted for any of those keys to unlock.
  - andrewstuart2 9y ago
    Also you can re-init any time you want, listing multiple keys. This will go through all your passwords and re-encrypt them for each of the keys listed. That's how I got my phone set up with access (with its own locally-generated private key). If you want more granular key strategy, look at gopass [1], which is a pass-compatible binary that gives a little more granular control over key usage (IIRC), and is written in Go. [1] https://github.com/justwatchcom/gopass https://github.com/justwatchcom/gopass
- spapas82 9y ago
  Why not transfer the private key? I encrypted it using a one-time pass and send it using email. I then decryped and installed to the other machine. Since I don't have the one time pass anymore the encrypted file is not usable anymore and I have the same key to both machines. Please explain any holes with that flow.
inertial 9y ago
Switched from pass to gopass recently : (https://github.com/justwatchcom/gopass https://github.com/justwatchcom/gopass). It's open source and has a tad bit more features over pass. Some of the reasons for my choice to switch: - compatible with pass - support for multiple stores - store binary data (e.g. QR codes for seeding 2FA) : upcoming - report / track issues on github.com/justwatchcom/gopass/issues - more details here : https://www.justwatch.com/gopass/docs/ https://www.justwatch.com/gopass/docs/
- philsnow 9y ago
  fun fact: 2FA QR codes contain the secret as just part of a url. you don't need to save the binary image, just figure out what the (usually base32-encoded) secret value is, and store that. google authentcator lets you type in the base32-encoded secret (useful if your phone's camera is broken). see e.g. https://garbagecollected.org/2014/09/14/how-google-authenticator-works/ https://garbagecollected.org/2014/09/14/how-google-authentic...
- ekimekim 9y ago
  The original pass seems to handle binary data fine: $ pass insert -m mybinarysecret <secret.png $ pass show mybinarysecret >secret.png Admittedly, it's not very user-friendly, but some simple wrapper scripts could fix that.
- deleted 9y ago
  [deleted]
gkya 9y ago
Pass also has Android and (AFAIK) iOS clients, and many other frontends.

raamdev 9y ago

+1 for `pass`. I wrote a handy Bash script [1] that lets me easily search my passwords without having an exact match (e.g., `fpass fin cap one` quickly finds my password info for "Financial/CapitalOne.gpg"). It makes pulling up passwords so much easier as I only need to remember fragments of how I stored it instead of trying to remember exact folders and names using auto-complete to find the password. I also use iTerm2's system-wide hotkey [2] to quickly show/hide a dedicated terminal window that I use for retrieving passwords. I've been using this setup for years now and I absolutely love it. The only downside is no access from my phone, but I always have my laptop with me and I memorize passwords that I frequently use. 1. https://github.com/raamdev/bin/blob/master/fpass https://github.com/raamdev/bin/blob/master/fpass 2. https://apple.stackexchange.com/a/48805 https://apple.stackexchange.com/a/48805

enzolovesbacon 9y ago
Oh my ZSH (http://ohmyz.sh/ http://ohmyz.sh/), if you use zsh of course, has autocomplete, so folders and GPG files are only a few tabs away.
- earenndil 9y ago
  Don't need omz for autocomplete, it's already there in zsh. I TBH don't really like omz. It feels bloated, and I don't really need anything else on top of the already-awesome zsh.
nikital 9y ago
> The only downside is no access from my phone. On Android, I use Password Store to sync my `pass` directory and use it from the phone. It a very high quality app, I had no issues after years of usage. https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store
- JoshuaRLi 9y ago
  Keepass user here wanting to switch over to pass, this is exactly the missing piece of the puzzle I needed - thank you!
  - pigpigs 9y ago
    I'm looking into using pass / keepass, any particular reason you are switching over to pass?
    - JoshuaRLi 9y ago
      I think I'm currently in a minimalist phase; the KeePassX UI is too feature rich and cluttered and makes me want to configure everything but I don't want to manage that. If that's not a problem for you, KeePassX is definitely a solid password manager!
tuxxy 9y ago
Instead of hiding the window, why don't you look into using terminal colors to hide the password? That way the passwords aren't visible until you highlight them.
- jolmg 9y ago
  Better to use the '-c' option to put the password in the clipboard and not display it in the terminal.
fmariluis 9y ago
> The only downside is no access from my phone For iOS: https://github.com/mssun/passforios https://github.com/mssun/passforios works really well and it's open source.

ufo 9y ago

Does pass still stote metadata unencrypted (as file names) or did they fix that now?

tptacek 9y ago

If you're not going to use 1Password, which is still the only commercial password manager I'll recommend, "pass" is probably your best alternative.

chaitanya 9y ago
As a LastPass user, any particular reasons why I should avoid them? Is it down to all the security issues they've faced lately?
- tptacek 9y ago
  1Password is the only commercial password manager I recommend, but I'll go further than that when it comes to LastPass and say: I really think you should avoid LastPass, and, if you're using it, migrate to something else. I'm not going to go into details, sorry.
  - badpenny 9y ago
    LastPass is the only commercial password manager I recommend. I really think you should avoid 1Password. I'm not going to go into details, sorry.
    - tptacek 9y ago
      You do much work in this field?
      - parent5446 9y ago
        It doesn't matter whether he does or not. He's using your own argument against you. Stepping in here and saying, "don't worry guys I'm the expert, so don't ask any questions", is just pompous and doesn't actually convince anybody. Use logic to support your claims, not your resume.
        tptacek 9y ago

raziel2p 9y ago

My main reason to not use pass is that I can't allow multiple private keys to unlock the password store. I don't want to transfer my private key between all my machines.

corey_moncure 9y ago
You absolutely can do this. In your .gpg-id file, simply list the keys you want to encrypt for on separate lines. Every file below that .gpg-id file in the directory hierarchy will be encrypted for any of those keys to unlock.
- andrewstuart2 9y ago
  Also you can re-init any time you want, listing multiple keys. This will go through all your passwords and re-encrypt them for each of the keys listed. That's how I got my phone set up with access (with its own locally-generated private key). If you want more granular key strategy, look at gopass [1], which is a pass-compatible binary that gives a little more granular control over key usage (IIRC), and is written in Go. [1] https://github.com/justwatchcom/gopass https://github.com/justwatchcom/gopass
spapas82 9y ago
Why not transfer the private key? I encrypted it using a one-time pass and send it using email. I then decryped and installed to the other machine. Since I don't have the one time pass anymore the encrypted file is not usable anymore and I have the same key to both machines. Please explain any holes with that flow.

inertial 9y ago

Switched from pass to gopass recently : (https://github.com/justwatchcom/gopass https://github.com/justwatchcom/gopass). It's open source and has a tad bit more features over pass. Some of the reasons for my choice to switch: - compatible with pass - support for multiple stores - store binary data (e.g. QR codes for seeding 2FA) : upcoming - report / track issues on github.com/justwatchcom/gopass/issues - more details here : https://www.justwatch.com/gopass/docs/ https://www.justwatch.com/gopass/docs/

philsnow 9y ago
fun fact: 2FA QR codes contain the secret as just part of a url. you don't need to save the binary image, just figure out what the (usually base32-encoded) secret value is, and store that. google authentcator lets you type in the base32-encoded secret (useful if your phone's camera is broken). see e.g. https://garbagecollected.org/2014/09/14/how-google-authenticator-works/ https://garbagecollected.org/2014/09/14/how-google-authentic...
ekimekim 9y ago
The original pass seems to handle binary data fine: $ pass insert -m mybinarysecret <secret.png $ pass show mybinarysecret >secret.png Admittedly, it's not very user-friendly, but some simple wrapper scripts could fix that.
deleted 9y ago
[deleted]

gkya 9y ago

Pass also has Android and (AFAIK) iOS clients, and many other frontends.