4 ms·

I continue to use `pass` [0]. Luckily I'm technically minded, so it's not too hard to manage my GPG keys or manage syncing the git repo every now and then. Wh

I continue to use `pass` [0]. Luckily I'm technically minded, so it's not too hard to manage my GPG keys or manage syncing the git repo every now and then. What it lacks in swish UI and automagically-configured browser extensions it gives in configurability, privacy, control over data, and freedom. [0]: https://www.passwordstore.org/ https://www.passwordstore.org/

gregod 7y ago
For Firefox there is https://addons.mozilla.org/en-US/firefox/addon/passff/ https://addons.mozilla.org/en-US/firefox/addon/passff/ which I'm quite happy with. When combined with a yubikey set to decrypt only on touch this setup has a very low attack surface compared to other browser password managers.
- tdons 7y ago
  This used to be my approach, but it prevented grepping through my password store (you have to touch the yubikey to decrypt each password separately) I since switched to a separate on-device key for "low value" passwords and keep the interesting stuff (e-mail pwds) under the yubikey protected key (which does requires touch). Did you find a better solution?
  - gregod 7y ago
    No. But i don't have an need for mass access so the basic case works fine for me. I keep a backup key on a separate yubikey that does not require touch for key maintenance. Apparently there is a new "cached" option for the touch settings "Touch is cached for 15s after use (valid from 4.3)." Which would work for your use case but also neglect some/most? of the security advantages.
jaifraic 7y ago
With the dmenu wrapper (passmenu) or something similar for rofi there is almost no need for a browser extension.
- beanaroo 7y ago
  I assume this approach doesn't auto-fill forms?
sigio 7y ago
Yup... also very happy with pass, with the addition of ansible's passwordstore plugin, qtpass, dpass and various other pass-addons. All my passwords are gpg-encrypted and versioned in git.
gspr 7y ago
Pass changed my life. I cannot recommend it highly enough!
maximente 7y ago
i love pass on GNU/linux but occasionally have to use OS X for a particular sponsor. the brew impl of pass using zsh does not seem to be autocompleting. i believe i have installed the correct autocompletions and mucked with .zshrc (.zshenv does not seem to be respected on OS X). any recommendations for OS X? is it worth building from source and/or getting it working outside of brew?
- stuzenz 7y ago
  I had the same issue at some point. I now have autocomplete working on my pass with .zshrc From memory I think autocomplete worked for pass once I started using antigen. I have the following plugins in my .zshrc plugins=( zsh-syntax-highlighting git iterm2 dotenv osx zsh-autosuggestions ) and also run antigen with user bundles for zsh-autosuggestions zsh-syntax-highlighting zsh-completions Some magic somewhere in the above provided autocomplete for me with pass. I hope it helps.
yjftsjthsd-h 7y ago
I really want pass or something like it, but the two times I've tried, I got stuck trying to figure out the gpg part. I suppose I should go and learn that properly anyways, since in spite of its UX it's still an extremely widely used and powerful tool, but it's a lot higher barrier to entry compared to "type in password, unlock vault".
- sigwinch28 7y ago
  The gist of it is that you need a keypair (a public and private key), which GPG can generate for you. Then whenever you insert something into the `pass` database (which is just a directory tree full of encrypted plaintext files) the tool uses the public key to encrypt the password (or anything else): pass generate --no-symbols shopping/ebay 16 Later, when you want to read a password, you ask pass to decrypt the file using the private key from your keypair: pass shopping/ebay 16 The difficulty is really all in managing the keys, which can be quite a faff to set up and then manage. If you're only using gpg for `pass`, IMO it's easiest to copy the keypair (which gpg generated) to all your other machines. A quick web search brought up a gist [0] which shows how to quickly get up and running on a single machine. If you want to use it on another laptop/desktop/*nix-like machine you'll need to export both your public and private gpg keys and then import them on the other machine. When using a phone you have to do something similar. The Android clients were fairly straightforward, but Pass for iOS had a very, very clunky way of getting the keys across. Regardless, it boils down to this: get the gpg keypair on all of the devices and then get them all using the same git repo for pass. [0]: https://gist.github.com/flbuddymooreiv/a4f24da7e0c3552942ff https://gist.github.com/flbuddymooreiv/a4f24da7e0c3552942ff
  - yjftsjthsd-h 7y ago
    Thank you:) That gist does look like what I need; I'll have to try it out!
- Evidlo 7y ago
  I would recommend Keepass. There are a variety of clients available for lots of platforms.

gregod 7y ago

For Firefox there is https://addons.mozilla.org/en-US/firefox/addon/passff/ https://addons.mozilla.org/en-US/firefox/addon/passff/ which I'm quite happy with. When combined with a yubikey set to decrypt only on touch this setup has a very low attack surface compared to other browser password managers.

tdons 7y ago
This used to be my approach, but it prevented grepping through my password store (you have to touch the yubikey to decrypt each password separately) I since switched to a separate on-device key for "low value" passwords and keep the interesting stuff (e-mail pwds) under the yubikey protected key (which does requires touch). Did you find a better solution?
- gregod 7y ago
  No. But i don't have an need for mass access so the basic case works fine for me. I keep a backup key on a separate yubikey that does not require touch for key maintenance. Apparently there is a new "cached" option for the touch settings "Touch is cached for 15s after use (valid from 4.3)." Which would work for your use case but also neglect some/most? of the security advantages.

jaifraic 7y ago

With the dmenu wrapper (passmenu) or something similar for rofi there is almost no need for a browser extension.

beanaroo 7y ago
I assume this approach doesn't auto-fill forms?

sigio 7y ago

Yup... also very happy with pass, with the addition of ansible's passwordstore plugin, qtpass, dpass and various other pass-addons. All my passwords are gpg-encrypted and versioned in git.

gspr 7y ago

Pass changed my life. I cannot recommend it highly enough!

maximente 7y ago

i love pass on GNU/linux but occasionally have to use OS X for a particular sponsor. the brew impl of pass using zsh does not seem to be autocompleting. i believe i have installed the correct autocompletions and mucked with .zshrc (.zshenv does not seem to be respected on OS X). any recommendations for OS X? is it worth building from source and/or getting it working outside of brew?

stuzenz 7y ago
I had the same issue at some point. I now have autocomplete working on my pass with .zshrc From memory I think autocomplete worked for pass once I started using antigen. I have the following plugins in my .zshrc plugins=( zsh-syntax-highlighting git iterm2 dotenv osx zsh-autosuggestions ) and also run antigen with user bundles for zsh-autosuggestions zsh-syntax-highlighting zsh-completions Some magic somewhere in the above provided autocomplete for me with pass. I hope it helps.

yjftsjthsd-h 7y ago

I really want pass or something like it, but the two times I've tried, I got stuck trying to figure out the gpg part. I suppose I should go and learn that properly anyways, since in spite of its UX it's still an extremely widely used and powerful tool, but it's a lot higher barrier to entry compared to "type in password, unlock vault".

sigwinch28 7y ago
The gist of it is that you need a keypair (a public and private key), which GPG can generate for you. Then whenever you insert something into the `pass` database (which is just a directory tree full of encrypted plaintext files) the tool uses the public key to encrypt the password (or anything else): pass generate --no-symbols shopping/ebay 16 Later, when you want to read a password, you ask pass to decrypt the file using the private key from your keypair: pass shopping/ebay 16 The difficulty is really all in managing the keys, which can be quite a faff to set up and then manage. If you're only using gpg for `pass`, IMO it's easiest to copy the keypair (which gpg generated) to all your other machines. A quick web search brought up a gist [0] which shows how to quickly get up and running on a single machine. If you want to use it on another laptop/desktop/*nix-like machine you'll need to export both your public and private gpg keys and then import them on the other machine. When using a phone you have to do something similar. The Android clients were fairly straightforward, but Pass for iOS had a very, very clunky way of getting the keys across. Regardless, it boils down to this: get the gpg keypair on all of the devices and then get them all using the same git repo for pass. [0]: https://gist.github.com/flbuddymooreiv/a4f24da7e0c3552942ff https://gist.github.com/flbuddymooreiv/a4f24da7e0c3552942ff
- yjftsjthsd-h 7y ago
  Thank you:) That gist does look like what I need; I'll have to try it out!
Evidlo 7y ago
I would recommend Keepass. There are a variety of clients available for lots of platforms.