5 ms·
It feels nice and clean, but also like it is leaking the list of sites I use.
by bloaf 6y ago
It feels nice and clean, but also like it is leaking the list of sites I use.
- teddyh 6y agoLeaking to where?
- ufo 6y agoIn the default settings the names of the websites are stored unencrypted, in the filenames.
- battles 6y agoTo anyone who types pass in your terminal it looks like.
- cameronhowe 6y agocompared to other password managers which is just an encrypted database. pass uses normal folders to store your website/username information so in that way it is less protected.
- _jal 6y agoSomething to consider, sure. But the exposure is to anyone with access to your encrypted pass data. Which in the normal use case is going to be anyone with access to your user account, which means they could likely already see your shell and browser history.
- deleted 6y ago[deleted]
- iudqnolq 6y agoNot if you want to access it on multiple devices, in which case the built-in solution is to use git. In that case your git server sees all the metadata.
- bloaf 6y agoTo anything with read access to your chosen storage filesystem.
- woodruffw 6y agoI think this is outside of the threat model of most password managers -- your desktop search history (whether in your shell, Spotlight, or whatever) is leaking equivalent and probably more detailed information.
- ufo 6y agoIt can be a problem if you want to back up the password database to the cloud. That's part of the threat model for most other password managers, which use a single encrypted file for the database. Pass is the only popular one I know that stores part of the information in plaintext.
- woodruffw 6y agoI don't actually use pass, but as an idle thought: if you're concerned about this sort of metadata when syncing your `pass` store to a cloud provider, why not take advantage of the GPG key you already have and encrypt everything as a single blob in one shot? You pay a little more with each synchronization, but probably not enough to worry about for reasonably sized stores.
- ufo 6y agoThere are pass extensions that encrypt the metadata but I don't know why they are not the default.
- deleted 6y ago[deleted]
- encryptluks2 6y agoThat is what something like Gocryptfs would be good at masking: https://wiki.archlinux.org/index.php/Gocryptfs https://wiki.archlinux.org/index.php/Gocryptfs Or there is an extension called pass-tomb: https://github.com/roddhjav/pass-tomb https://github.com/roddhjav/pass-tomb