3 ms·
If it becomes standard, people would use it without a master password, and then stealing passwords via malicious scripts will become very easy.
by hasenj 9y ago
If it becomes standard, people would use it without a master password, and then stealing passwords via malicious scripts will become very easy.
- Sir_Cmpwn 9y agoWhat? How does this follow?
- deong 9y agoWell, I guess if you had no master password, any script you expect people to run could have a surreptitious "pass <some args> | curl" to post password data to some web service of your choosing. Still, if you use a password manager without a master password, I don't think you can be protected from consequence, regardless of what your tools do. Pass could refuse to allow the no master password scenario, or could force some type of blatant user interaction to allow it to work, but ultimately, that user is screwed by something somewhere.
- nzp 9y agoPass doesn't handle your "master password" at all, it's completely delegated to GnuPG (pass is really nothing more than a shell wrapper your file system, GnuPG, and Git). Does GnuPG let you easily get away without a password on your key, I don't remember ATM.
- hasenj 9y agoIt's completely possible to setup `pass` such that you can type `pass <name>` and it will print the password to stdout (you might has to pass an extra parameter or so) without ever asking the user to input anything to confirm they approve of this action. Now if this were to become mainstream, it's almost guaranteed that some percentage of users will set it up to work that way. And now you have the perfect opportunity to write a script that simply attempts to read passwords using pass and if it succeeds sends the results somewhere on the net.