7 ms·

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've fin

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that extension is only supported on mac only or something. Pass is the one thing that seems fairly universal I think and it's all just text files which makes things really nice. No worrying about will it work on mobile or if the browser extension is useless without an application. For example, 1Password X is a standalone extension so you could use it on Linux while Dashlane requires the desktop application running on the host. The connection works but isn't always reliable when running non-natively ie WINE As for security, they're all fairly well audited I think? Remembear and 1Password both have external audits they pass, and provide remediation plans for any findings. Probably the same with Lastpass. Personally, I don't really think about it that much so I don't have a good answer. You can interpret that as me trusting providers but I have no real idea. I mainly just focus on the usability hah

Boulth 7y ago
Not to mention pass, due to its connection to GnuPG, can protect secrets using Yubikey that require 6 digit PIN (will lock after 3 tries) and touching the blinking dot.
- eropple 7y ago
  Interesting. I've never used pass, but this thread is making it sound interesting. Does it support fallbacks (multiple keys, other forms of credentials) simultaneously?
  - Boulth 7y ago
    Multiple keys: yes, through a config file (can be also useful for team access). I'm not sure about "other forms of credentials" though. Pass is just a simple GnuPG wrapper if gpg can do something pass can do it too.
- SomeOldThrow 7y ago
  How do access your passwords from your phone?
  - Libbum 7y ago
    There's an Andriod client for that: https://github.com/zeapo/Android-Password-Store#readme https://github.com/zeapo/Android-Password-Store#readme Plenty of other extensions, managers here: https://www.passwordstore.org/#other https://www.passwordstore.org/#other
  - Boulth 7y ago
    See sibling comment. Additionally it's possible to use the same Yubikey token on laptop and phone (through NFC or USB). Convenient and secure! Second benefit is Yubikey can hold authentication subkey that can be used to SSH to a server on a phone.
dancek 7y ago
I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?
- spondyl 7y ago
  I think GPG keys get a lot of flack for not being the most user friendly thing and probably fair enough. The nature of them having to remain secret, makes managing them a bit confusing. I don't use mine for anything more than signing commits and (rarely) encrypting secrets Personally, I use OpenKeychain[1] on Android, Kleopatra[2] on Linux, GPG Suite[3] on macOS and Pass[4] for iOS/iPadOS Phew, that's a lotta apps but you can just pick and choose whatever you prefer. I have no idea about Windows myself. Once I imported my keys (public + private) into each application, I never really had to touch them again. As I mentioned, I use my GPG key for signing my commits. I think I saved my password to my laptops keychain so it automatically signs my commits without my interaction. Similarly, Pass automatically encrypts and decrypts everything without my interaction. Whether that's a good idea security wise aside, it works fairly seamlessly. Pass on my iPad is quite literally just a pull to refresh. I would have thought it'd be much more painful with all the GPG nonsense in play! So, back to your questions: > Does your setup require copying the same key to each device? Yes but only once. It may also require entering your password anywhere from everytime to never depending on your settings. For my android device, I have to do it once every restart but after that, a process keeps my "store" open for example. > What would happen if someone got your gpg key? Presumably they could take all of my passwords and sign my Git commits as if they were me. Personally, I have no strong investment in my GPG key, nor am I someone well known so this would have little to no effect beyond being a big annoyance. I would still own my email account so I'd still be able to reset the majority of my passwords. Actually, I don't know my email password (since it's randomly generated) so I'd have to cross my fingers and hope the attacker hasn't revoked any of my sessions. Once again, no different than any other password manager. At least losing the key would be my fault, and not that of a third party I suppose. > What would happen if you lost the key? Presumably I'd lose all of my passwords but once again, that's no different than the single master password setup of those cloud based password managers. I didn't realize until I looked it up just now but you can apparently generate a revocation certificate, separate from your key. From what it says on the tin, I imagine you can keep that safe and if you did lose your key, use it to tell any of the popular key servers that it's gone. That wouldn't do anything to get your password back though, it would just signal to anyone looking up your key, that they shouldn't trust it. Anyway, that was a bit of a tangent but the best way to learn is to just play around with GPG keys. The only reason I know the little I do is purely through making mistake :) I went through heaps of keys myself (I forget why) before I finally settled on my current one. You can even see some revoked ones here http://keys.gnupg.net/pks/lookup?search=marcus%40thingsima.de&fingerprint=on&op=index http://keys.gnupg.net/pks/lookup?search=marcus%40thingsima.d... [1] https://www.openkeychain.org/ https://www.openkeychain.org/ [2] https://www.openpgp.org/software/kleopatra/ https://www.openpgp.org/software/kleopatra/ and https://kde.org/applications/utilities/org.kde.kleopatra https://kde.org/applications/utilities/org.kde.kleopatra [3] https://gpgtools.org/ https://gpgtools.org/ [4] https://github.com/mssun/passforios https://github.com/mssun/passforios
Fnoord 7y ago
Bitwarden has also had an external audit. With regards to Bitwarden, it has a wordphrase on the account which only you know. You can verify this when you connect to the cloud. You can run the server within your own cloud. With the cloud, you can assume that the government has access to the encrypted database. If you have a strong password, it will take them longer to brute-force your database. We are talking about two governments here: the US government (most password managers are from US companies and are hosted in US clouds) and your own (who can attempt to ask for the data), this is no issue, but I believe you should by default not trust them. This is important because it should be part of your risk assessment. It would probably be easier to attempt a MITM (with help of the password manager sysadmin). I've once seen a fake Lastpass login page (back when I used Lastpass). Almost all password managers can import/export their database to CSV. This allows you to avoid a vendor lock-in.
- octosphere 7y ago
  > You can run the server within your own cloud For me there is a tradeoff. On one hand, Bitwarden's online offering where you trust them with your data is convenient, but also a single point of failure. If their server goes offline, you can't access your passwords (And servers do go down). On the other hand you can repair your own instance if it goes down and have full control over it. The only caveat with self-hosting being the overhead. Regular non-techie people just don't have the time or intellectual curiosity to experiment with self-hosting. For me personally I just sync a Keepass database with Dropbox and call it a day.
  - Fnoord 7y ago
    Agreed w/your post in general. > On one hand, Bitwarden's online offering where you trust them with your data is convenient, but also a single point of failure. Put your network connectivity off, and try to relogin to Bitwarden. It will work. I just tried it. The only downside is that the database might not be synced (which, I admit, can be a problem). > The only caveat with self-hosting being the overhead. Regular non-techie people just don't have the time or intellectual curiosity to experiment with self-hosting. I don't know the password to connect to my (hypothetical) self-hosted Bitwarden instance. Because of the above though, that would not be an issue. Hence I am going to switch to self-hosting. There's a Rust implementation with Docker image.
tim333 7y ago
I'm guessing "regular ol' pass" is "pass the standard unix password manager" https://www.passwordstore.org/ https://www.passwordstore.org/ ? Just thought I'd stick that here to save others the googling.
- spondyl 7y ago
  Ah sorry, yes! I was tapping that out rapidly on my phone because I had gotten excited seeing a password manager thread. Maybe too much because I left the shower running before I realized I better wrap up my comment and stop being wasteful haha
tbrock 7y ago
Sadly this isn’t a modern solution. People have smartphones and occasionally have to login to Windows (without WSL). While I’d love for everything I use to provide an easily accessible *nix shell it just isn’t practical for phone use or modern computing environment where you can access cloud data using web services from any internet connected computers/devices.
- yorwba 7y ago
  There are other clients: https://www.passwordstore.org/#other https://www.passwordstore.org/#other FWIW, using Termux on Android enables practical phone use of many command line programs.
- Gorgor 7y ago
  I have a smartphone and use pass via the app Android Password Store [1]. You have to set up your GPG key of course and also an SSH key for the sync with the remote repository, but once that’s done, it works perfectly fine. [1] https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store
- 333c 7y ago
  On iOS I use this open-source client: https://itunes.apple.com/us/app/pass-password-store/id1205820573?mt=8 https://itunes.apple.com/us/app/pass-password-store/id120582...
- e_proxus 7y ago
  That's why I decided to trust a commercial password manager (in this case, 1Password). Rather than trudging some unknown third party developer on each mobile platform, I'd rather trust a more official provider on all platforms (which also gives me the increased usability and larger feature set). Since I absolutely need a cross platform password manager, especially on mobile, I felt this to be the most logical solution.
lasdfas 7y ago
It really surprises me that people are using pass or any other password manager developed as open source. Yes, the code is open source, but unless you download the code yourself and compile it, which not many people do on desktop and no one does for mobile clients, you have to trust the deploy process of a random group of people. None of the people even have to be malicious. They just have to have an insecure deploy process (which allows an attacker to insert code), which is extremely common in open source. Very few if any open source projects have audited their deploy process and have monitoring for vulnerabilities or exploits happening. It's just too time intensive/expensive for a side project someone isn't getting paid for. I prefer to trust an organization that has gone through tons of audits. Not just on whether the client is secure (can encrypt securely), but that their software development lifecycle is secure. They also have a huge financial incentive to keep things secure, which is not the case in open source.
- xhcudjchv 7y ago
  pass is a single ~700 line shell script wrapping gpg and optionally git. while long for a shell script, that's pretty easy reading for a password manager, and easy enough to understand.
  - lasdfas 7y ago
    Yeah absolutely. But have you audited the mobile apps or the chrome extensions, etc. (Extensions can update in the background without interaction)? Every time a new release happens? Those products are created by completely different developers. Not saying that a company could not have a malicious release. It could. I just think the odds are much lower because their release process has better security controls and is generally audited better.
lgunsch 7y ago
I used LastPass specifically because 1Password does not work on Linux. At least up till a year ago, which was the last time I checked, the 1Password extension doesn't run on Linux.

Boulth 7y ago

Not to mention pass, due to its connection to GnuPG, can protect secrets using Yubikey that require 6 digit PIN (will lock after 3 tries) and touching the blinking dot.

eropple 7y ago
Interesting. I've never used pass, but this thread is making it sound interesting. Does it support fallbacks (multiple keys, other forms of credentials) simultaneously?
- Boulth 7y ago
  Multiple keys: yes, through a config file (can be also useful for team access). I'm not sure about "other forms of credentials" though. Pass is just a simple GnuPG wrapper if gpg can do something pass can do it too.
SomeOldThrow 7y ago
How do access your passwords from your phone?
- Libbum 7y ago
  There's an Andriod client for that: https://github.com/zeapo/Android-Password-Store#readme https://github.com/zeapo/Android-Password-Store#readme Plenty of other extensions, managers here: https://www.passwordstore.org/#other https://www.passwordstore.org/#other
- Boulth 7y ago
  See sibling comment. Additionally it's possible to use the same Yubikey token on laptop and phone (through NFC or USB). Convenient and secure! Second benefit is Yubikey can hold authentication subkey that can be used to SSH to a server on a phone.

dancek 7y ago

I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?

spondyl 7y ago
I think GPG keys get a lot of flack for not being the most user friendly thing and probably fair enough. The nature of them having to remain secret, makes managing them a bit confusing. I don't use mine for anything more than signing commits and (rarely) encrypting secrets Personally, I use OpenKeychain[1] on Android, Kleopatra[2] on Linux, GPG Suite[3] on macOS and Pass[4] for iOS/iPadOS Phew, that's a lotta apps but you can just pick and choose whatever you prefer. I have no idea about Windows myself. Once I imported my keys (public + private) into each application, I never really had to touch them again. As I mentioned, I use my GPG key for signing my commits. I think I saved my password to my laptops keychain so it automatically signs my commits without my interaction. Similarly, Pass automatically encrypts and decrypts everything without my interaction. Whether that's a good idea security wise aside, it works fairly seamlessly. Pass on my iPad is quite literally just a pull to refresh. I would have thought it'd be much more painful with all the GPG nonsense in play! So, back to your questions: > Does your setup require copying the same key to each device? Yes but only once. It may also require entering your password anywhere from everytime to never depending on your settings. For my android device, I have to do it once every restart but after that, a process keeps my "store" open for example. > What would happen if someone got your gpg key? Presumably they could take all of my passwords and sign my Git commits as if they were me. Personally, I have no strong investment in my GPG key, nor am I someone well known so this would have little to no effect beyond being a big annoyance. I would still own my email account so I'd still be able to reset the majority of my passwords. Actually, I don't know my email password (since it's randomly generated) so I'd have to cross my fingers and hope the attacker hasn't revoked any of my sessions. Once again, no different than any other password manager. At least losing the key would be my fault, and not that of a third party I suppose. > What would happen if you lost the key? Presumably I'd lose all of my passwords but once again, that's no different than the single master password setup of those cloud based password managers. I didn't realize until I looked it up just now but you can apparently generate a revocation certificate, separate from your key. From what it says on the tin, I imagine you can keep that safe and if you did lose your key, use it to tell any of the popular key servers that it's gone. That wouldn't do anything to get your password back though, it would just signal to anyone looking up your key, that they shouldn't trust it. Anyway, that was a bit of a tangent but the best way to learn is to just play around with GPG keys. The only reason I know the little I do is purely through making mistake :) I went through heaps of keys myself (I forget why) before I finally settled on my current one. You can even see some revoked ones here http://keys.gnupg.net/pks/lookup?search=marcus%40thingsima.de&fingerprint=on&op=index http://keys.gnupg.net/pks/lookup?search=marcus%40thingsima.d... [1] https://www.openkeychain.org/ https://www.openkeychain.org/ [2] https://www.openpgp.org/software/kleopatra/ https://www.openpgp.org/software/kleopatra/ and https://kde.org/applications/utilities/org.kde.kleopatra https://kde.org/applications/utilities/org.kde.kleopatra [3] https://gpgtools.org/ https://gpgtools.org/ [4] https://github.com/mssun/passforios https://github.com/mssun/passforios

Fnoord 7y ago

Bitwarden has also had an external audit. With regards to Bitwarden, it has a wordphrase on the account which only you know. You can verify this when you connect to the cloud. You can run the server within your own cloud. With the cloud, you can assume that the government has access to the encrypted database. If you have a strong password, it will take them longer to brute-force your database. We are talking about two governments here: the US government (most password managers are from US companies and are hosted in US clouds) and your own (who can attempt to ask for the data), this is no issue, but I believe you should by default not trust them. This is important because it should be part of your risk assessment. It would probably be easier to attempt a MITM (with help of the password manager sysadmin). I've once seen a fake Lastpass login page (back when I used Lastpass). Almost all password managers can import/export their database to CSV. This allows you to avoid a vendor lock-in.

octosphere 7y ago
> You can run the server within your own cloud For me there is a tradeoff. On one hand, Bitwarden's online offering where you trust them with your data is convenient, but also a single point of failure. If their server goes offline, you can't access your passwords (And servers do go down). On the other hand you can repair your own instance if it goes down and have full control over it. The only caveat with self-hosting being the overhead. Regular non-techie people just don't have the time or intellectual curiosity to experiment with self-hosting. For me personally I just sync a Keepass database with Dropbox and call it a day.
- Fnoord 7y ago
  Agreed w/your post in general. > On one hand, Bitwarden's online offering where you trust them with your data is convenient, but also a single point of failure. Put your network connectivity off, and try to relogin to Bitwarden. It will work. I just tried it. The only downside is that the database might not be synced (which, I admit, can be a problem). > The only caveat with self-hosting being the overhead. Regular non-techie people just don't have the time or intellectual curiosity to experiment with self-hosting. I don't know the password to connect to my (hypothetical) self-hosted Bitwarden instance. Because of the above though, that would not be an issue. Hence I am going to switch to self-hosting. There's a Rust implementation with Docker image.

tim333 7y ago

I'm guessing "regular ol' pass" is "pass the standard unix password manager" https://www.passwordstore.org/ https://www.passwordstore.org/ ? Just thought I'd stick that here to save others the googling.

spondyl 7y ago
Ah sorry, yes! I was tapping that out rapidly on my phone because I had gotten excited seeing a password manager thread. Maybe too much because I left the shower running before I realized I better wrap up my comment and stop being wasteful haha

tbrock 7y ago

Sadly this isn’t a modern solution. People have smartphones and occasionally have to login to Windows (without WSL). While I’d love for everything I use to provide an easily accessible *nix shell it just isn’t practical for phone use or modern computing environment where you can access cloud data using web services from any internet connected computers/devices.

yorwba 7y ago
There are other clients: https://www.passwordstore.org/#other https://www.passwordstore.org/#other FWIW, using Termux on Android enables practical phone use of many command line programs.
Gorgor 7y ago
I have a smartphone and use pass via the app Android Password Store [1]. You have to set up your GPG key of course and also an SSH key for the sync with the remote repository, but once that’s done, it works perfectly fine. [1] https://github.com/zeapo/Android-Password-Store https://github.com/zeapo/Android-Password-Store
333c 7y ago
On iOS I use this open-source client: https://itunes.apple.com/us/app/pass-password-store/id1205820573?mt=8 https://itunes.apple.com/us/app/pass-password-store/id120582...
e_proxus 7y ago
That's why I decided to trust a commercial password manager (in this case, 1Password). Rather than trudging some unknown third party developer on each mobile platform, I'd rather trust a more official provider on all platforms (which also gives me the increased usability and larger feature set). Since I absolutely need a cross platform password manager, especially on mobile, I felt this to be the most logical solution.

lasdfas 7y ago

It really surprises me that people are using pass or any other password manager developed as open source. Yes, the code is open source, but unless you download the code yourself and compile it, which not many people do on desktop and no one does for mobile clients, you have to trust the deploy process of a random group of people. None of the people even have to be malicious. They just have to have an insecure deploy process (which allows an attacker to insert code), which is extremely common in open source. Very few if any open source projects have audited their deploy process and have monitoring for vulnerabilities or exploits happening. It's just too time intensive/expensive for a side project someone isn't getting paid for. I prefer to trust an organization that has gone through tons of audits. Not just on whether the client is secure (can encrypt securely), but that their software development lifecycle is secure. They also have a huge financial incentive to keep things secure, which is not the case in open source.

xhcudjchv 7y ago
pass is a single ~700 line shell script wrapping gpg and optionally git. while long for a shell script, that's pretty easy reading for a password manager, and easy enough to understand.
- lasdfas 7y ago
  Yeah absolutely. But have you audited the mobile apps or the chrome extensions, etc. (Extensions can update in the background without interaction)? Every time a new release happens? Those products are created by completely different developers. Not saying that a company could not have a malicious release. It could. I just think the odds are much lower because their release process has better security controls and is generally audited better.

lgunsch 7y ago

I used LastPass specifically because 1Password does not work on Linux. At least up till a year ago, which was the last time I checked, the 1Password extension doesn't run on Linux.