6 ms·

I've used this for a long time, and along with its Git integration (pushing/pulling to/from a repository on my own server, accessed over SSH) and a GPG key stor

by jbg_ 9y ago

I've used this for a long time, and along with its Git integration (pushing/pulling to/from a repository on my own server, accessed over SSH) and a GPG key stored on a Yubikey Neo, I've got basically seamless sync between two laptops, a desktop and an Android phone, without using any third-party service. The "Password Store" app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo to decrypt the passwords.

emilecantin 9y ago
I've got the same setup, it's pretty great. One thing, though: make sure you have another way of decrypting your passwords! I lost my Yubikey once, and I lost all my passwords. Now I have a copy of that key on a USB drive I keep at home in a small safe.
- jbg_ 9y ago
  Yeah, my passwords are encrypted to two private keys. One is on the Yubikey, the other is printed and stored securely.
  - Karissa44 9y ago
    my FATHER co-worker's sister-in-law makes $73 /hour on the computer . She has been without a job for nine months but last month her check was $20283 just working on the computer for a few hours. This Sitemore information>>>>>>>>>>>http://ow.ly/iBXm30dNtIZ http://ow.ly/iBXm30dNtIZ
- jethro_tell 9y ago
  General recommendation is to have a backup for everything on a yubi key. Two keys or printed backup codes or whatever.
- xur17 9y ago
  What's the best way to backup the private key on your yubikey? Do you just generate it on your computer instead of on your device, and then back that up?
  - subway 9y ago
    Generally a good way to do this is via GPG subkeys. You keep your master/certifying key offline, in your safety deposit box, and load a subkey onto your Yubikey. If the Yubikey is lost, you can easily revoke the subkeys and generate new ones. Here's a nice tutorial on it: https://www.jfry.me/articles/2015/gpg-smartcard/ https://www.jfry.me/articles/2015/gpg-smartcard/
    - xur17 9y ago
      Thanks for the link. I started reading through that, and it is quite involved. I'm still deciding if it's worth it. I'm not sure I fully understand subkeys. It looks like they can be used in place of my main key, and I can generate new subkeys from my main key. Is this so I can revoke my subkeys if they are ever compromised? Can other subkeys decrypt my 'pass' files or is that limited to the subkey that generated them? It seems like the existing private key would be able to decrypt passwords in the future even after it was revoked, if the user still had the original files.
      - subway 9y ago
        Yes -- revocation is just an indicator of the subkey's trust going forward. Once revoked, the user would generate a new subkey and re-encrypt their password wallet. While the git features and multi-key capabilities of pass lend well to very lightweight team usage, the model is definitely best suited for use by an individual.
        xur17 9y ago
        So a subkey is aware of all revocations from before it was generated? If I generate 2 subkeys, can they both encrypt and decrypt my passwords? The only difference is that I can revoke them independently?
        subway 9y ago
        Sorry, to clarify, you need to keep a backup of all subkeys along side your master/certifying key. Data encrypted to a given subkey can only be decrypted by that same subkey. Honestly, if you're using GPG strictly for personal password wallet encryption, and don't intend to maintain an identity tied with the key long term, there's no need to do the subkey thing -- just create an offline key, load it to your YK, then securely store the offline key. Subkeys shines when you want to maintain an identity long term, while allowing rotation of the keys that do your day to day encryption (or signing/auth)
fps 9y ago
I have the same setup, but I haven't yet been able to get the Yubikey Neo to work as a GPG key on android via NFC. It prompts for a PIN, but the PIN I use for GPG on linux isn't accepted. There's also no working windows client for this setup, so I find I have to manually copy a lot of 20 character complex passwords by hand these days.
- gant 9y ago
  Why doesn't it work? From the top of my head, QtPass with gpg4win should work.
- jbg_ 9y ago
  Interesting. The same PIN that I use to unlock the card on my laptops works on my phone. I'm not sure what would lead to the behaviour you describe!
- kranner 9y ago
  I share a pass git repo between a Mac and a Windows machine. GPG4Win works fine on Windows.
- tylorr 9y ago
  I use Msys2 on Windows which then lets me install GPG and Pass from its package manager.
maeln 9y ago
The only problem I got with the password store application is that the Git integration seem to be a bit broken. It often refuse to push, pull or sync depsite having no conflict. But you just have to delete the store and pull everything again, so it's not a huge problem. I definitly have to try the yubikey integration !
- uggedal 9y ago
  I use termux[1] to clone/pull my pass repo for "Password Store" on Android since I need ed25519 key support. [1]: https://termux.com https://termux.com
- xiaomai 9y ago
  I don't think the git integration can be broken. You can go into the ~/.password-store directory yourself and see what is going on next time you have issues (it's just a regular git repo).

by jbg_ 9y ago

emilecantin 9y ago

I've got the same setup, it's pretty great. One thing, though: make sure you have another way of decrypting your passwords! I lost my Yubikey once, and I lost all my passwords. Now I have a copy of that key on a USB drive I keep at home in a small safe.

jbg_ 9y ago
Yeah, my passwords are encrypted to two private keys. One is on the Yubikey, the other is printed and stored securely.
- Karissa44 9y ago
  my FATHER co-worker's sister-in-law makes $73 /hour on the computer . She has been without a job for nine months but last month her check was $20283 just working on the computer for a few hours. This Sitemore information>>>>>>>>>>>http://ow.ly/iBXm30dNtIZ http://ow.ly/iBXm30dNtIZ
jethro_tell 9y ago
General recommendation is to have a backup for everything on a yubi key. Two keys or printed backup codes or whatever.
xur17 9y ago
What's the best way to backup the private key on your yubikey? Do you just generate it on your computer instead of on your device, and then back that up?
- subway 9y ago
  Generally a good way to do this is via GPG subkeys. You keep your master/certifying key offline, in your safety deposit box, and load a subkey onto your Yubikey. If the Yubikey is lost, you can easily revoke the subkeys and generate new ones. Here's a nice tutorial on it: https://www.jfry.me/articles/2015/gpg-smartcard/ https://www.jfry.me/articles/2015/gpg-smartcard/
  - xur17 9y ago
    Thanks for the link. I started reading through that, and it is quite involved. I'm still deciding if it's worth it. I'm not sure I fully understand subkeys. It looks like they can be used in place of my main key, and I can generate new subkeys from my main key. Is this so I can revoke my subkeys if they are ever compromised? Can other subkeys decrypt my 'pass' files or is that limited to the subkey that generated them? It seems like the existing private key would be able to decrypt passwords in the future even after it was revoked, if the user still had the original files.
    - subway 9y ago
      Yes -- revocation is just an indicator of the subkey's trust going forward. Once revoked, the user would generate a new subkey and re-encrypt their password wallet. While the git features and multi-key capabilities of pass lend well to very lightweight team usage, the model is definitely best suited for use by an individual.
      - xur17 9y ago
        So a subkey is aware of all revocations from before it was generated? If I generate 2 subkeys, can they both encrypt and decrypt my passwords? The only difference is that I can revoke them independently?
        subway 9y ago
        Sorry, to clarify, you need to keep a backup of all subkeys along side your master/certifying key. Data encrypted to a given subkey can only be decrypted by that same subkey. Honestly, if you're using GPG strictly for personal password wallet encryption, and don't intend to maintain an identity tied with the key long term, there's no need to do the subkey thing -- just create an offline key, load it to your YK, then securely store the offline key. Subkeys shines when you want to maintain an identity long term, while allowing rotation of the keys that do your day to day encryption (or signing/auth)

fps 9y ago

I have the same setup, but I haven't yet been able to get the Yubikey Neo to work as a GPG key on android via NFC. It prompts for a PIN, but the PIN I use for GPG on linux isn't accepted. There's also no working windows client for this setup, so I find I have to manually copy a lot of 20 character complex passwords by hand these days.

gant 9y ago
Why doesn't it work? From the top of my head, QtPass with gpg4win should work.
jbg_ 9y ago
Interesting. The same PIN that I use to unlock the card on my laptops works on my phone. I'm not sure what would lead to the behaviour you describe!
kranner 9y ago
I share a pass git repo between a Mac and a Windows machine. GPG4Win works fine on Windows.
tylorr 9y ago
I use Msys2 on Windows which then lets me install GPG and Pass from its package manager.

maeln 9y ago

The only problem I got with the password store application is that the Git integration seem to be a bit broken. It often refuse to push, pull or sync depsite having no conflict. But you just have to delete the store and pull everything again, so it's not a huge problem. I definitly have to try the yubikey integration !

uggedal 9y ago
I use termux[1] to clone/pull my pass repo for "Password Store" on Android since I need ed25519 key support. [1]: https://termux.com https://termux.com
xiaomai 9y ago
I don't think the git integration can be broken. You can go into the ~/.password-store directory yourself and see what is going on next time you have issues (it's just a regular git repo).