5 ms·

I really like the pass manager (CLI): https://www.passwordstore.org/ https://www.passwordstore.org/ It stays encrypted at rest on your machine protected by GPG

by nickjj 8y ago

I really like the pass manager (CLI): https://www.passwordstore.org/ https://www.passwordstore.org/ It stays encrypted at rest on your machine protected by GPG keys and when you want to access a password you can choose to copy it to your clipboard for 45 seconds or print it to stdout. No subscription services, and everything stays local on your machine, but you can easily sync it to other devices using whatever file syncing service you want since it's just encrypted files on disk.

folkhack 8y ago
This was brought up last time - but even having something like the path "./Banking/bankofamerica.com" visible on the filesystem is a disclosure of sensitive information, even if the password is encrypted at-rest. Otherwise I love the idea of *nix based philosophy for password management =)
- tanderson92 8y ago
  This is why pass-tomb was invented.
  - folkhack 8y ago
    Excellent - thanks for the heads up =) Will be looking into this to replace a KeePass DB!
- nickjj 8y ago
  The path does leak some information but in that case the bad actor would also need to know the username along with the password (both of which would be encrypted). But you have to ask yourself. Who are you protecting against here? Are people browsing around your laptop / workstation without you monitoring what they're doing? If someone has your machine without your consent, then you're pretty much screwed because 99.99999% of people will leave themselves logged into things like gmail which requires no password to access it once the machine is powered on. It's basically this xkcd scenario: https://xkcd.com/1200/ https://xkcd.com/1200/
  - folkhack 8y ago
    > Are people browsing around your laptop / workstation without you monitoring what they're doing? Nope - but the industry that I work in constantly assumes "bad actors" are present. Although it's not perfect - everything is 2FA, all disks on laptops encrypted, there are strict rules in dealing with secrets/sensitive information, etc. My main concern is if someone were able to do a rip of my home directory. Trust me - there's a TON of room for improvement, but doing some general protection against someone with "shell" access is something I'm in the practice of... it's the same reason I carefully manage what ends up in my .zsh_history or .bash_history =) > If someone has your machine without your consent, then you're pretty much screwed Agreed. Encrypt the disk (I trust LUKS), lock your machine when not in-use, ensure it shuts itself down if a password is "fat-fingered" more than twice, use solid passwords with good complexity, use 2FA when you can/should, etc.
taeric 8y ago
Is it possible to use a security token with this? My last search was not fruitful. :(
- nickjj 8y ago
  Token in what sense? A pass phrase? If so, yes because you can assign a pass phrase to your gpg key. Then you can choose to either type it in every time you unlock a password or cache it for your session (depends on how important security is for you). Personally I cache it for my session. This way I only need to type in my pass phrase once when I power on the machine. The best part about the pass utility is that it piggy backs off GPG for its encryption mechanism.
  - taeric 8y ago
    Apologies, I meant a physical token. Yubi or Titan key.
    - nickjj 8y ago
      I'm not sure but it would come down to if openpgp supports that. A quick Google shows this: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide I didn't read everything but it seems pretty comprehensive.
      - taeric 8y ago
        Yeah, I just tried googling again. I think last time I indexed too heavily on if pass supported this, now I see I just need to setup openpgp. That sounds promising. Thanks!
    - gnfurlong 8y ago
      YubiKey is at least supported, but only because it also functions as a pgp smartcard. You can load you pgp private keys on the yubikey and then all decryption will only be done on the Yubikey itself.

by nickjj 8y ago

folkhack 8y ago

This was brought up last time - but even having something like the path "./Banking/bankofamerica.com" visible on the filesystem is a disclosure of sensitive information, even if the password is encrypted at-rest. Otherwise I love the idea of *nix based philosophy for password management =)

tanderson92 8y ago
This is why pass-tomb was invented.
- folkhack 8y ago
  Excellent - thanks for the heads up =) Will be looking into this to replace a KeePass DB!
nickjj 8y ago
The path does leak some information but in that case the bad actor would also need to know the username along with the password (both of which would be encrypted). But you have to ask yourself. Who are you protecting against here? Are people browsing around your laptop / workstation without you monitoring what they're doing? If someone has your machine without your consent, then you're pretty much screwed because 99.99999% of people will leave themselves logged into things like gmail which requires no password to access it once the machine is powered on. It's basically this xkcd scenario: https://xkcd.com/1200/ https://xkcd.com/1200/
- folkhack 8y ago
  > Are people browsing around your laptop / workstation without you monitoring what they're doing? Nope - but the industry that I work in constantly assumes "bad actors" are present. Although it's not perfect - everything is 2FA, all disks on laptops encrypted, there are strict rules in dealing with secrets/sensitive information, etc. My main concern is if someone were able to do a rip of my home directory. Trust me - there's a TON of room for improvement, but doing some general protection against someone with "shell" access is something I'm in the practice of... it's the same reason I carefully manage what ends up in my .zsh_history or .bash_history =) > If someone has your machine without your consent, then you're pretty much screwed Agreed. Encrypt the disk (I trust LUKS), lock your machine when not in-use, ensure it shuts itself down if a password is "fat-fingered" more than twice, use solid passwords with good complexity, use 2FA when you can/should, etc.

taeric 8y ago

Is it possible to use a security token with this? My last search was not fruitful. :(

nickjj 8y ago
Token in what sense? A pass phrase? If so, yes because you can assign a pass phrase to your gpg key. Then you can choose to either type it in every time you unlock a password or cache it for your session (depends on how important security is for you). Personally I cache it for my session. This way I only need to type in my pass phrase once when I power on the machine. The best part about the pass utility is that it piggy backs off GPG for its encryption mechanism.
- taeric 8y ago
  Apologies, I meant a physical token. Yubi or Titan key.
  - nickjj 8y ago
    I'm not sure but it would come down to if openpgp supports that. A quick Google shows this: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide I didn't read everything but it seems pretty comprehensive.
    - taeric 8y ago
      Yeah, I just tried googling again. I think last time I indexed too heavily on if pass supported this, now I see I just need to setup openpgp. That sounds promising. Thanks!
  - gnfurlong 8y ago
    YubiKey is at least supported, but only because it also functions as a pgp smartcard. You can load you pgp private keys on the yubikey and then all decryption will only be done on the Yubikey itself.