6 ms·

There's one advantage to this approach that, as far as I've seen, no other password manager has been able to replicate. Pass is simple. It is literally a few

There's one advantage to this approach that, as far as I've seen, no other password manager has been able to replicate. Pass is simple. It is literally a few hundred lines of clear, easy to read bash shell script (yeah, that's a phrase I never thought I'd hear myself saying, ever). It's simple because it's created by composing standard, simple off-the-shelf technologies (bash, gpg, git). Compared to more monolithic solutions, it's easy to compose those very same technologies in a different way. That, in turn, makes it easy to adapt to new settings, and super resilient to new use cases like different sync technologies. (and yes, I do appreciate that this is not a feature that everyone wants/needs)

Kwpolska 6y ago
pass is simple on *nix. Pass is just painful on Windows and Android, probably on iOS too. I used to use pass for my passwords, but one day I switched to KeePassXC, which is a nice multiplatform GUI, has all the GUI niceties (and auto-type), there are mobile apps to work with it, and I keep my database synced with OneDrive.
- 8organicbits 6y ago
  I've been wary to trust the sync behavior of tools like dropbox or onedrive, as they permit concurrent edits of files. For things like encrypted password databases, there isn't an automated merge strategy that can be applied. I think they support versioning, so if two edits happened concurrently then the losing edit would be recoverable via versioning. Maybe that's not really a concern for a password database, as you'd likely be online when making a change? Anyone see issues with KeePass and sync tools?
  - caesarshift 6y ago
    Yes, in my experience, using dropbox, you end up with two versions of the keypass file (one listed as a conflict). I've been using this setup for ~10 yrs, and it has only happened 2 or 3 times, but as I'm the primary user, I would expect this to happen more often with a family sharing the same file. If things are working correctly, the keepass lock file created when opening a db is synced via dropbox, so any second attempt at opening the file on another system results in a warning to open it as readonly.
    - WorldMaker 6y ago
      Because Keepass uses GUIDs internally for most operations, merging the conflict files is usually trivial (use the Sync options in the Keepass UI of your choice from your main file, then you can safely delete the file marked as conflicting). (The GUIDs thing has also meant that I've had some success merging unrelated files too over the years, though that is probably less advisable.)
- burntsushi 6y ago
  pass works great on Android. There's an app for it: https://github.com/android-password-store/Android-Password-Store https://github.com/android-password-store/Android-Password-S...
- okanesen 6y ago
  Pass works great for me on iOS for years now and it's open source too [0]. [0]: https://github.com/mssun/passforios https://github.com/mssun/passforios
  - captn3m0 6y ago
    It's okay, not great. I use a second GPG key for the phone so as to reduce the number of passwords accessible there. While it works out of the box, getting it to work nicely needed a bit of plumbing[0]. Moreover, there isn't any support for Yubikey or smartcards. [0]: https://captnemo.in/blog/2020/01/04/security-setup/#mobile-passwords https://captnemo.in/blog/2020/01/04/security-setup/#mobile-p...
- dmtroyer 6y ago
  just dumped pass for the fact that it is extremely unpleasant on windows. it's actually pretty good on ios.
- deleted 6y ago
  [deleted]
- gitweb 6y ago
  One feature I like about pass is that it stores each password as a file. This makes syncing a lot more pleasant, rather than having to resync the entire DB each time a new password is added. Additionally, it is git-compatible and when you sync you can see what has been added/removed using standard *nix tools.
- throwaway201103 6y ago
  Your mention of OneDrive made me remember that pass creates a cleartext copy of your password file, while you are editing it. pass will try to create the file in /dev/shm but if this fails it will use $TMPDIR. If you're on a platform without /dev/shm you'll want to use some other equivalent such as a small ramdisk, or at the very least be sure your $TMPDIR is not synced into the cloud.
smoyer 6y ago
But the phrase "I’m aware of pass and tried it before I came to this setup, but I want to put more info than just a password string in my files, so that’s why pass doesn’t fit my need." is simply incorrect. Almost all my passwords in "pass" also have "url" and "login" fields defined. Many have additional fields including the passphrases for authenticators. I've got a pass file with all my credit card and bank information (in case I lose my wallet while traveling) and another with all the bonus programs I belong to.
Triv888 6y ago
last time I looked at it, it revealed too much information even if you didn't have the pass-phrase
mongol 6y ago
Yes it is simple. I like it a lot. But could it be made even simpler? For example, rather than gpg, which is in itself complex, could it use something else? What is the point of using a public key crypto for something entirely private?
- nickjj 6y ago
  > For example, rather than gpg, which is in itself complex, could it use something else? It's not too bad to set up. It takes about a minute to generate a gpg key pair minus the time it takes to generate a 4096 bit rsa key. I made a video (and cheatsheet) the other week going through the process of creating a gpg key pair with an expiration date, how to export / import, revoke and backup your keys at https://nickjanetakis.com/blog/creating-and-managing-a-gpg-key-pair https://nickjanetakis.com/blog/creating-and-managing-a-gpg-k.... It's totally worth it, I've been using pass for like 4 years and have hundreds of passwords in it. It works great. Also having a gpg key pair is handy to have around if you want to sign your git commits.
  - mdtusz 6y ago
    I'm an avid pass user too, but I think claiming that managing gpg keys is _simple_ is a bit of a stretch. Creating a single key on one machine is not hard. Following proper best practices for gpg using subkeys and setting up pass to work nicely on multiple devices is a bit more involved and requires a decent understanding of gpg keys in general, which (correct me if I'm wrong), even most developers aren't super well versed in.
    - nickjj 6y ago
      > but I think claiming that managing gpg keys is _simple_ is a bit of a stretch. It's not simple but it's really not too bad. Just make a key that expires and understand the details around revoking certs and backing up / restoring and you'll be good to go. All of that can be summed up in a few commands and a couple of minutes of video (and it is in the above video). Getting your gpg keypair and pass synced across multiple devices can be done with rsync or whatever mechanism you use to share data between machines (dropbox, etc.). I happen to use rsync to sync it between my workstation and a laptop.
Thorrez 6y ago
> this approach What is that? The article isn't about pass, but you seem to be talking about pass.
2ion 6y ago
pass has excellent terminal UX (shell completion), can be versioned using git. Currently it's a perfect fit for me in the private environment, because I keep browsers 100% jailed and all passwords out of browser context (so I wouldn't use a pass<>browser integration in any case). For multi-user, however, I use 1password. Its vault sharing and management, federation under an organization, onboarding/offboarding controls etc are a must-have when you have hundreds of people needing to share passwords. All organizations I've worked in before that had more than 20 users, any less-featureful alternative was absolutely not tenable. It becomes a shitshow as soon as teams cannot get SSO for internal systems under one roof and start trading credentials, or when teams have to trade API keys and so on because of disjunct secret management processes/platforms (unifying 1000s of developers and 100s of teams doesn't happen that fast, if at all). As of now, we have read-only vaults that internal customers can access right there on the desktop, in which we provide secrets that are being rotated, updated, etc in sync with our backend system password management, over 1password API. If 1p has one use for my team at my company presently, it's not so much the great password management, but as a corporate-approved terminal for end-user secrets, like API keys, and so on.

Kwpolska 6y ago

pass is simple on *nix. Pass is just painful on Windows and Android, probably on iOS too. I used to use pass for my passwords, but one day I switched to KeePassXC, which is a nice multiplatform GUI, has all the GUI niceties (and auto-type), there are mobile apps to work with it, and I keep my database synced with OneDrive.

8organicbits 6y ago
I've been wary to trust the sync behavior of tools like dropbox or onedrive, as they permit concurrent edits of files. For things like encrypted password databases, there isn't an automated merge strategy that can be applied. I think they support versioning, so if two edits happened concurrently then the losing edit would be recoverable via versioning. Maybe that's not really a concern for a password database, as you'd likely be online when making a change? Anyone see issues with KeePass and sync tools?
- caesarshift 6y ago
  Yes, in my experience, using dropbox, you end up with two versions of the keypass file (one listed as a conflict). I've been using this setup for ~10 yrs, and it has only happened 2 or 3 times, but as I'm the primary user, I would expect this to happen more often with a family sharing the same file. If things are working correctly, the keepass lock file created when opening a db is synced via dropbox, so any second attempt at opening the file on another system results in a warning to open it as readonly.
  - WorldMaker 6y ago
    Because Keepass uses GUIDs internally for most operations, merging the conflict files is usually trivial (use the Sync options in the Keepass UI of your choice from your main file, then you can safely delete the file marked as conflicting). (The GUIDs thing has also meant that I've had some success merging unrelated files too over the years, though that is probably less advisable.)
burntsushi 6y ago
pass works great on Android. There's an app for it: https://github.com/android-password-store/Android-Password-Store https://github.com/android-password-store/Android-Password-S...
okanesen 6y ago
Pass works great for me on iOS for years now and it's open source too [0]. [0]: https://github.com/mssun/passforios https://github.com/mssun/passforios
- captn3m0 6y ago
  It's okay, not great. I use a second GPG key for the phone so as to reduce the number of passwords accessible there. While it works out of the box, getting it to work nicely needed a bit of plumbing[0]. Moreover, there isn't any support for Yubikey or smartcards. [0]: https://captnemo.in/blog/2020/01/04/security-setup/#mobile-passwords https://captnemo.in/blog/2020/01/04/security-setup/#mobile-p...
dmtroyer 6y ago
just dumped pass for the fact that it is extremely unpleasant on windows. it's actually pretty good on ios.
deleted 6y ago
[deleted]
gitweb 6y ago
One feature I like about pass is that it stores each password as a file. This makes syncing a lot more pleasant, rather than having to resync the entire DB each time a new password is added. Additionally, it is git-compatible and when you sync you can see what has been added/removed using standard *nix tools.
throwaway201103 6y ago
Your mention of OneDrive made me remember that pass creates a cleartext copy of your password file, while you are editing it. pass will try to create the file in /dev/shm but if this fails it will use $TMPDIR. If you're on a platform without /dev/shm you'll want to use some other equivalent such as a small ramdisk, or at the very least be sure your $TMPDIR is not synced into the cloud.

smoyer 6y ago

But the phrase "I’m aware of pass and tried it before I came to this setup, but I want to put more info than just a password string in my files, so that’s why pass doesn’t fit my need." is simply incorrect. Almost all my passwords in "pass" also have "url" and "login" fields defined. Many have additional fields including the passphrases for authenticators. I've got a pass file with all my credit card and bank information (in case I lose my wallet while traveling) and another with all the bonus programs I belong to.

Triv888 6y ago

last time I looked at it, it revealed too much information even if you didn't have the pass-phrase

mongol 6y ago

Yes it is simple. I like it a lot. But could it be made even simpler? For example, rather than gpg, which is in itself complex, could it use something else? What is the point of using a public key crypto for something entirely private?

nickjj 6y ago
> For example, rather than gpg, which is in itself complex, could it use something else? It's not too bad to set up. It takes about a minute to generate a gpg key pair minus the time it takes to generate a 4096 bit rsa key. I made a video (and cheatsheet) the other week going through the process of creating a gpg key pair with an expiration date, how to export / import, revoke and backup your keys at https://nickjanetakis.com/blog/creating-and-managing-a-gpg-key-pair https://nickjanetakis.com/blog/creating-and-managing-a-gpg-k.... It's totally worth it, I've been using pass for like 4 years and have hundreds of passwords in it. It works great. Also having a gpg key pair is handy to have around if you want to sign your git commits.
- mdtusz 6y ago
  I'm an avid pass user too, but I think claiming that managing gpg keys is _simple_ is a bit of a stretch. Creating a single key on one machine is not hard. Following proper best practices for gpg using subkeys and setting up pass to work nicely on multiple devices is a bit more involved and requires a decent understanding of gpg keys in general, which (correct me if I'm wrong), even most developers aren't super well versed in.
  - nickjj 6y ago
    > but I think claiming that managing gpg keys is _simple_ is a bit of a stretch. It's not simple but it's really not too bad. Just make a key that expires and understand the details around revoking certs and backing up / restoring and you'll be good to go. All of that can be summed up in a few commands and a couple of minutes of video (and it is in the above video). Getting your gpg keypair and pass synced across multiple devices can be done with rsync or whatever mechanism you use to share data between machines (dropbox, etc.). I happen to use rsync to sync it between my workstation and a laptop.

Thorrez 6y ago

> this approach What is that? The article isn't about pass, but you seem to be talking about pass.

2ion 6y ago

pass has excellent terminal UX (shell completion), can be versioned using git. Currently it's a perfect fit for me in the private environment, because I keep browsers 100% jailed and all passwords out of browser context (so I wouldn't use a pass<>browser integration in any case). For multi-user, however, I use 1password. Its vault sharing and management, federation under an organization, onboarding/offboarding controls etc are a must-have when you have hundreds of people needing to share passwords. All organizations I've worked in before that had more than 20 users, any less-featureful alternative was absolutely not tenable. It becomes a shitshow as soon as teams cannot get SSO for internal systems under one roof and start trading credentials, or when teams have to trade API keys and so on because of disjunct secret management processes/platforms (unifying 1000s of developers and 100s of teams doesn't happen that fast, if at all). As of now, we have read-only vaults that internal customers can access right there on the desktop, in which we provide secrets that are being rotated, updated, etc in sync with our backend system password management, over 1password API. If 1p has one use for my team at my company presently, it's not so much the great password management, but as a corporate-approved terminal for end-user secrets, like API keys, and so on.