3 ms·

Another option you should consider: https://www.passwordstore.org/ https://www.passwordstore.org/ It's just a bash script that used gpg and git. I find it the

Another option you should consider: https://www.passwordstore.org/ https://www.passwordstore.org/ It's just a bash script that used gpg and git. I find it the most KISS solution. Not available on phones but I don't trust my phone with my secrets anyway.

ComodoHacker 6y ago
I can't count a requirement to have git wherever you need a password as a KISS solution.
- djagoo 6y ago
  You can set up your store with git but it's optional.
woile 6y ago
There's an android version: https://f-droid.org/en/packages/dev.msfjarvis.aps/ https://f-droid.org/en/packages/dev.msfjarvis.aps/ I use it and it works quite well. Also gopass exists, which is useful to share secrets with teams + your personals, same interface. I wrote about it [0] + a cheatsheet [1] [0]: http://woile.github.io/posts/sharing-team-secrets/ http://woile.github.io/posts/sharing-team-secrets/ [1]: https://woile.github.io/gopass-cheat-sheet/ https://woile.github.io/gopass-cheat-sheet/
djagoo 6y ago
Passwordstore is just awesome. We're using gopass (go port of the pass scripts) which supports multiple stores to be mounted so we can have different recipients i.e. for team1, team2 and private. In combination with browserpass for firefox and android-password-store for smartphone it's the simplest and best tool I ever used for password management. And the best part: it's just simple text files which are encrypted using gpg. So we just sync them with syncthing and even if the pass or gopass program would go away in the future we can use gpg decrypt.
c0bruhh 6y ago
I use "Pass - Password Store" [1] for iOS and it works a charm for me. You have to import your GPG key to it and set up your git connection to your server and you're all set. It also supports OTP generation which is really nice. [1]: https://apps.apple.com/us/app/pass-password-store/id1205820573 https://apps.apple.com/us/app/pass-password-store/id12058205...
- marcthe12 6y ago
  How is it compared to keepassxc.
dewey 6y ago
> Not available on phones but I don't trust my phone with my secrets anyway. Why is that? I trust my phone more than any other device because of it's encryption / secure enclaves / sandboxing etc.
- trabant00 6y ago
  I don't have root on it. I didn't pick the hardware.
adrianmonk 6y ago
I've heard claims that using the clipboard to transfer passwords is not very secure because a lot of different pieces of software may be able to read the clipboard. If so, then a browser plugin would seem to provide better security. So this might be a little too KISS. Does anyone have comments on how much of a concern it really is to have passwords travel by the clipboard?
- dspillett 6y ago
  > how much of a concern it really is to have passwords travel by the clipboard? As with many security matters, it will vary depending upon your threat model. I generally feel that if you have something installed watching your clipboard for nefarious reasons then you've already got a bigger problem, and I prefer that potential security issue over having all my credentials integrated into the browser via a plugin (a clipboard sniffer will catch one or two things passing by, a hacked browser with integrated or add-in based password store might reveal everything at once). If you use the clipboard for transfer, take the precaution of always clearing it soon after use. KeePass does this by default, as do some other similar tools.
ufo 6y ago
One thing that bugs me about passwordstore is that while passwords are encrypted, the names of the websites are stored in the clear. Last I saw there is an workaround you can use with "tombs" but IMO it would have been much better if they had done the right thing by default and stored the whole password database in a single file.

ComodoHacker 6y ago

I can't count a requirement to have git wherever you need a password as a KISS solution.

djagoo 6y ago
You can set up your store with git but it's optional.

woile 6y ago

There's an android version: https://f-droid.org/en/packages/dev.msfjarvis.aps/ https://f-droid.org/en/packages/dev.msfjarvis.aps/ I use it and it works quite well. Also gopass exists, which is useful to share secrets with teams + your personals, same interface. I wrote about it [0] + a cheatsheet [1] [0]: http://woile.github.io/posts/sharing-team-secrets/ http://woile.github.io/posts/sharing-team-secrets/ [1]: https://woile.github.io/gopass-cheat-sheet/ https://woile.github.io/gopass-cheat-sheet/

djagoo 6y ago

Passwordstore is just awesome. We're using gopass (go port of the pass scripts) which supports multiple stores to be mounted so we can have different recipients i.e. for team1, team2 and private. In combination with browserpass for firefox and android-password-store for smartphone it's the simplest and best tool I ever used for password management. And the best part: it's just simple text files which are encrypted using gpg. So we just sync them with syncthing and even if the pass or gopass program would go away in the future we can use gpg decrypt.

c0bruhh 6y ago

I use "Pass - Password Store" [1] for iOS and it works a charm for me. You have to import your GPG key to it and set up your git connection to your server and you're all set. It also supports OTP generation which is really nice. [1]: https://apps.apple.com/us/app/pass-password-store/id1205820573 https://apps.apple.com/us/app/pass-password-store/id12058205...

marcthe12 6y ago
How is it compared to keepassxc.

dewey 6y ago

> Not available on phones but I don't trust my phone with my secrets anyway. Why is that? I trust my phone more than any other device because of it's encryption / secure enclaves / sandboxing etc.

trabant00 6y ago
I don't have root on it. I didn't pick the hardware.

adrianmonk 6y ago

I've heard claims that using the clipboard to transfer passwords is not very secure because a lot of different pieces of software may be able to read the clipboard. If so, then a browser plugin would seem to provide better security. So this might be a little too KISS. Does anyone have comments on how much of a concern it really is to have passwords travel by the clipboard?

dspillett 6y ago
> how much of a concern it really is to have passwords travel by the clipboard? As with many security matters, it will vary depending upon your threat model. I generally feel that if you have something installed watching your clipboard for nefarious reasons then you've already got a bigger problem, and I prefer that potential security issue over having all my credentials integrated into the browser via a plugin (a clipboard sniffer will catch one or two things passing by, a hacked browser with integrated or add-in based password store might reveal everything at once). If you use the clipboard for transfer, take the precaution of always clearing it soon after use. KeePass does this by default, as do some other similar tools.

ufo 6y ago

One thing that bugs me about passwordstore is that while passwords are encrypted, the names of the websites are stored in the clear. Last I saw there is an workaround you can use with "tombs" but IMO it would have been much better if they had done the right thing by default and stored the whole password database in a single file.