4 ms·

I use https://www.passwordstore.org/ https://www.passwordstore.org/ and love it. It's a lot more manual than lastpass or 1password but all I care about is keep

by qudat 8y ago

I use https://www.passwordstore.org/ https://www.passwordstore.org/ and love it. It's a lot more manual than lastpass or 1password but all I care about is keeping my devices synced, being in full control of my data, and not having to pay anything.

kdtsh 8y ago
It's so good. It's incredibly simple and fast (it's just a script which works as a front end to git and GPG); it's very well documented and there are only a few commands you need; devices are sync'd by way of git; it's got a heap of add-ons, including an OTP generator. There's even a great iOS app, PassForiOS, which also handles OTP 2FA (the only downside to the app is that you have to clone from an existing pass repository, but that's not a big deal unless you don't have a computer or you were planning on starting to build your password database on your phone). Never used it on Windows or Android so I can't say what it's like there, but if you're on macOS, a combination of GPG Suite, pass, and the default Terminal make password management easy. edit: there's the unfortunate fact that the names of files in which passwords are stored are in plaintext, since it's all ordinary files and directories. pass-tomb is supposed to be a good way of encrypting your .password-store directory, but I don't think this is compatible with the iOS app. Still, not a serious problem for my use case anyway, and a solution is available if I'd be willing to forego the iOS app.
gnfurlong 8y ago
I'm surprised there's not more discussion of passwordstore in this thread. In light of the parent article, I want to point out one of it's killer features (from my perspective). As it's built on top of PGP, you can move your private key to a PGP smart card and then decryption operations are done entirely on the smart card. Your private key never leaves the card. If you're using a Yubikey as the smart card, there's also a feature where you have to touch the card to approve of any operation (even when already unlocked by entering the smart card's password).

by qudat 8y ago

kdtsh 8y ago

It's so good. It's incredibly simple and fast (it's just a script which works as a front end to git and GPG); it's very well documented and there are only a few commands you need; devices are sync'd by way of git; it's got a heap of add-ons, including an OTP generator. There's even a great iOS app, PassForiOS, which also handles OTP 2FA (the only downside to the app is that you have to clone from an existing pass repository, but that's not a big deal unless you don't have a computer or you were planning on starting to build your password database on your phone). Never used it on Windows or Android so I can't say what it's like there, but if you're on macOS, a combination of GPG Suite, pass, and the default Terminal make password management easy. edit: there's the unfortunate fact that the names of files in which passwords are stored are in plaintext, since it's all ordinary files and directories. pass-tomb is supposed to be a good way of encrypting your .password-store directory, but I don't think this is compatible with the iOS app. Still, not a serious problem for my use case anyway, and a solution is available if I'd be willing to forego the iOS app.

gnfurlong 8y ago

I'm surprised there's not more discussion of passwordstore in this thread. In light of the parent article, I want to point out one of it's killer features (from my perspective). As it's built on top of PGP, you can move your private key to a PGP smart card and then decryption operations are done entirely on the smart card. Your private key never leaves the card. If you're using a Yubikey as the smart card, there's also a feature where you have to touch the card to approve of any operation (even when already unlocked by entering the smart card's password).