8 ms·

I don't like the fact someone with access to my hard-drive can figure out all the services I'm using just by looking at the filenames. It's convenient yes, but

I don't like the fact someone with access to my hard-drive can figure out all the services I'm using just by looking at the filenames. It's convenient yes, but I prefer one encrypted file that contains it all.

YorickPeterse 9y ago
This shouldn't really be an issue if you're using full disk encryption.
- jrochkind1 9y ago
  That seems like saying why use an encrypting password manager at all if you're using full disk encryption, isn't it okay to just keep your passwords in plaintext on your encrypted disk?
  - rythie 9y ago
    Not if you use cloud backup or get a virus.
- chme 9y ago
  This isn't how real security works. There is a concept for 'defense in depth', saying that every component should be secure on its own and not rely on other components.
- pavon 9y ago
  Encryption only protects files at rest. The vast majority of attacks are against live systems connected to a network, where full disk encryption won't help you one bit. It is a nice extra layer of protection for when a device is lost/stolen, but I don't consider it a primary form of protection for any important data.
painted 9y ago
yeah, from a security point of view it's similar to have one file or multiple ones encrypted with the same key
- zamber 9y ago
  It's not. When you decrypt one file you have all of your passwords in-memory (terminal, clipboard, browser extension, qtpass). When you do that for one login/password pair you only expose that pair, not all of the others.
  - palunon 9y ago
    When you decrypt, you have the key in memory in either case. Assuming you don't put all the password into an untrustworthy output (terminal, clipboard, etc), what's the difference ?
roddhjav 9y ago
This "issue" has been fixed with the pass extension 'pass-tomb' that keep the whole tree of password encrypted inside a tomb See https://github.com/roddhjav/pass-tomb https://github.com/roddhjav/pass-tomb However keep in mind it's not always a big "issue", for instance only looking at your browser history will retrieve the same knowledge.
- ufo 9y ago
  Oh well... I wonder why they didnt make something like this the default.
  - zamber 9y ago
    s/they/he/ Pass is pretty much a glorified bash script using GPG and Git. Adding filename encryption on top would be a nightmare, not to mention that terminal suggestions would be pretty much broken.
    - majewsky 9y ago
      > not to mention that terminal suggestions would be pretty much broken You can always write an (encrypted) index file that contains a simple list of all domains.
    - ufo 9y ago
      Storing all that information in plaintext just to make terminal suggestions easier to implement sounds shortsighted to me.
- Tharkun 9y ago
  I mount my pass dir with encfs. Mount when I need access to passwords, and no need to remember to close it before I shut down (or if the machine randomly crashes). I can store the encfs encrypted tree on cloud storage (spideroak in my case) and have it synched across machines. Works pretty well.
gioele 9y ago
Check out pw, my alternative to pass, designed because of the reason you mentioned: I don't want my password manager to leak the list of services I use. https://github.com/gioele/pw https://github.com/gioele/pw In pw each password database is a single file, the internal indexes are random IDs. Each line in a database is a serialized GPG file with a password and associated metadata. The file format is git-compatible and everything can be managed with standard command line tools.

YorickPeterse 9y ago

This shouldn't really be an issue if you're using full disk encryption.

jrochkind1 9y ago
That seems like saying why use an encrypting password manager at all if you're using full disk encryption, isn't it okay to just keep your passwords in plaintext on your encrypted disk?
- rythie 9y ago
  Not if you use cloud backup or get a virus.
chme 9y ago
This isn't how real security works. There is a concept for 'defense in depth', saying that every component should be secure on its own and not rely on other components.
pavon 9y ago
Encryption only protects files at rest. The vast majority of attacks are against live systems connected to a network, where full disk encryption won't help you one bit. It is a nice extra layer of protection for when a device is lost/stolen, but I don't consider it a primary form of protection for any important data.

painted 9y ago

yeah, from a security point of view it's similar to have one file or multiple ones encrypted with the same key

zamber 9y ago
It's not. When you decrypt one file you have all of your passwords in-memory (terminal, clipboard, browser extension, qtpass). When you do that for one login/password pair you only expose that pair, not all of the others.
- palunon 9y ago
  When you decrypt, you have the key in memory in either case. Assuming you don't put all the password into an untrustworthy output (terminal, clipboard, etc), what's the difference ?

roddhjav 9y ago

This "issue" has been fixed with the pass extension 'pass-tomb' that keep the whole tree of password encrypted inside a tomb See https://github.com/roddhjav/pass-tomb https://github.com/roddhjav/pass-tomb However keep in mind it's not always a big "issue", for instance only looking at your browser history will retrieve the same knowledge.

ufo 9y ago
Oh well... I wonder why they didnt make something like this the default.
- zamber 9y ago
  s/they/he/ Pass is pretty much a glorified bash script using GPG and Git. Adding filename encryption on top would be a nightmare, not to mention that terminal suggestions would be pretty much broken.
  - majewsky 9y ago
    > not to mention that terminal suggestions would be pretty much broken You can always write an (encrypted) index file that contains a simple list of all domains.
  - ufo 9y ago
    Storing all that information in plaintext just to make terminal suggestions easier to implement sounds shortsighted to me.
Tharkun 9y ago
I mount my pass dir with encfs. Mount when I need access to passwords, and no need to remember to close it before I shut down (or if the machine randomly crashes). I can store the encfs encrypted tree on cloud storage (spideroak in my case) and have it synched across machines. Works pretty well.

gioele 9y ago

Check out pw, my alternative to pass, designed because of the reason you mentioned: I don't want my password manager to leak the list of services I use. https://github.com/gioele/pw https://github.com/gioele/pw In pw each password database is a single file, the internal indexes are random IDs. Each line in a database is a serialized GPG file with a password and associated metadata. The file format is git-compatible and everything can be managed with standard command line tools.