3 ms·
I'm a pretty big fan of plain text for many things, but in this case it seems significantly simpler to just use a more full-featured password manager. I'm not s
by tao_oat 6y ago
I'm a pretty big fan of plain text for many things, but in this case it seems significantly simpler to just use a more full-featured password manager. I'm not sure I really see the benefit of a system like this.
This setup (as well as pass) has one security downside over other password managers like 1Password, BitWarden, etc.: they leak information through the filenames you use to organize your passwords. Depending on who you are and your threat model, it could be pretty bad if someone gets a hold of your password store that contains an (encrypted) file called `silk road` or whatever.
- throwaway201103 6y agoThat's a valid critique for some use cases, I guess. Doesn't really apply to my uses, but there are some ways around this including having the presumably few very sensitive accounts saved using alias names that only you know.
- gnufx 6y agoIs pass-tomb not a decent solution to that? I've not considered it necessary in my threat model, so don't know.
- bobbylarrybobby 6y agoYou could use (say) UUIDs as the filenames and maintain an encrypted table containing the mapping between human readable filenames and UUIDs.