4 ms·
> For example, rather than gpg, which is in itself complex, could it use something else? It's not too bad to set up. It takes about a minute to generate a gpg
by nickjj 6y ago
> For example, rather than gpg, which is in itself complex, could it use something else?
It's not too bad to set up.
It takes about a minute to generate a gpg key pair minus the time it takes to generate a 4096 bit rsa key.
I made a video (and cheatsheet) the other week going through the process of creating a gpg key pair with an expiration date, how to export / import, revoke and backup your keys at https://nickjanetakis.com/blog/creating-and-managing-a-gpg-key-pair https://nickjanetakis.com/blog/creating-and-managing-a-gpg-k....
It's totally worth it, I've been using pass for like 4 years and have hundreds of passwords in it. It works great. Also having a gpg key pair is handy to have around if you want to sign your git commits.
- mdtusz 6y agoI'm an avid pass user too, but I think claiming that managing gpg keys is _simple_ is a bit of a stretch. Creating a single key on one machine is not hard. Following proper best practices for gpg using subkeys and setting up pass to work nicely on multiple devices is a bit more involved and requires a decent understanding of gpg keys in general, which (correct me if I'm wrong), even most developers aren't super well versed in.
- nickjj 6y ago> but I think claiming that managing gpg keys is _simple_ is a bit of a stretch. It's not simple but it's really not too bad. Just make a key that expires and understand the details around revoking certs and backing up / restoring and you'll be good to go. All of that can be summed up in a few commands and a couple of minutes of video (and it is in the above video). Getting your gpg keypair and pass synced across multiple devices can be done with rsync or whatever mechanism you use to share data between machines (dropbox, etc.). I happen to use rsync to sync it between my workstation and a laptop.