5 ms·

I'd still much rather stick with https://www.passwordstore.org/ https://www.passwordstore.org/. It's encrypted with your keys (which I didn't see on Bitwarden's

by sdan 7y ago

I'd still much rather stick with https://www.passwordstore.org/ https://www.passwordstore.org/. It's encrypted with your keys (which I didn't see on Bitwarden's site) and has plugins for Chrome/Firefox (you can setup keyboard shortcuts to fill in your info automatically as well) and works with Git. Although it is a bit of a hassle to setup on mobile devices (I use Pass for iOS), the security and functionality it provides is worth it.

edoceo 7y ago
How about sharing password with a team?
- notpiika 7y ago
  You can use gopass[0] for that. It's pass but with syncing capabilities. [0]: https://www.gopass.pw https://www.gopass.pw
  - edoceo 7y ago
    I should have said non-technical team. Currently we're kicking around passbolt - but, if there is time on Feature-Friday I want to eval BW
    - sdan 7y ago
      In this case, Pass is probably not the right solution for you. It's a bit hard to setup keys and then share them over Git... which is most likely a bit too complicated. This being said, QtPass is a GUI for Pass, but not the best when compared to stuff like Bitwarden (presumably, haven't used it) or Lastpass.
pedrogpimenta 7y ago
I'm interested. Is it more secure than KeePass?
- jsmith99 7y ago
  Not especially, but it supports multi user and organisations, so different use cases, although it's a decent choice for personal use too.
georgyo 7y ago
I would argue that pass isn't that secure other than when your computer is off. Namely that it requires copy and pasting. Any program on your computer can read your clipboard. And for a normal user who are more vulnerable to phishing, there isn't automatic domain checking. It would be their normal work flow to copy a password into a malicious site.
- Thorrez 7y ago
  Can't any program on your computer also just keylog your master password and get your whole database? That's worse than getting individual passwords from the clipboard.
  - singlow 7y ago
    Only a program with elevated priveleges can record keystrokes when not focused. Unpriveleged programs can see the clipboard data much more freely.
    - Thorrez 7y ago
      Hmm, what if a malicious program modifies your PATH (or creates a bash alias) so that whatever command you use before you enter your master password is now replaced with a backdoored one?
      - aorth 7y ago
        You should specify the full path to the real "pass" when you configure the browser extension. This is a very common problem—with a known solution—in shell scripts since forever.
        Thorrez 7y ago
        Is the browser extension configuration owned by root? I thought that would be owned by your user. So the malware could modify that configuration.
- 7y ago
ngrilly 7y ago
> It's encrypted with your keys (which I didn't see on Bitwarden's site) Same with Bitwarden: https://help.bitwarden.com/article/can-bitwarden-see-my-passwords/ https://help.bitwarden.com/article/can-bitwarden-see-my-pass...

by sdan 7y ago

edoceo 7y ago

How about sharing password with a team?

notpiika 7y ago
You can use gopass[0] for that. It's pass but with syncing capabilities. [0]: https://www.gopass.pw https://www.gopass.pw
- edoceo 7y ago
  I should have said non-technical team. Currently we're kicking around passbolt - but, if there is time on Feature-Friday I want to eval BW
  - sdan 7y ago
    In this case, Pass is probably not the right solution for you. It's a bit hard to setup keys and then share them over Git... which is most likely a bit too complicated. This being said, QtPass is a GUI for Pass, but not the best when compared to stuff like Bitwarden (presumably, haven't used it) or Lastpass.

pedrogpimenta 7y ago

I'm interested. Is it more secure than KeePass?

jsmith99 7y ago
Not especially, but it supports multi user and organisations, so different use cases, although it's a decent choice for personal use too.

georgyo 7y ago

I would argue that pass isn't that secure other than when your computer is off. Namely that it requires copy and pasting. Any program on your computer can read your clipboard. And for a normal user who are more vulnerable to phishing, there isn't automatic domain checking. It would be their normal work flow to copy a password into a malicious site.

Thorrez 7y ago
Can't any program on your computer also just keylog your master password and get your whole database? That's worse than getting individual passwords from the clipboard.
- singlow 7y ago
  Only a program with elevated priveleges can record keystrokes when not focused. Unpriveleged programs can see the clipboard data much more freely.
  - Thorrez 7y ago
    Hmm, what if a malicious program modifies your PATH (or creates a bash alias) so that whatever command you use before you enter your master password is now replaced with a backdoored one?
    - aorth 7y ago
      You should specify the full path to the real "pass" when you configure the browser extension. This is a very common problem—with a known solution—in shell scripts since forever.
      - Thorrez 7y ago
        Is the browser extension configuration owned by root? I thought that would be owned by your user. So the malware could modify that configuration.
7y ago

ngrilly 7y ago

> It's encrypted with your keys (which I didn't see on Bitwarden's site) Same with Bitwarden: https://help.bitwarden.com/article/can-bitwarden-see-my-passwords/ https://help.bitwarden.com/article/can-bitwarden-see-my-pass...