4 ms·

Pass user for many years, always loved it. There are a number of ways to integrate it into rofi too, so with the press of a few keys I can navigate to any site

Pass user for many years, always loved it. There are a number of ways to integrate it into rofi too, so with the press of a few keys I can navigate to any site and login instantly. To squash a few concerns: - Leaking data - If someone types "pass" in your terminal it will show a list of sites that you've stored. I don't find this any less obvious than if someone had LastPass installed on their machine. - Trusting different app developers - This can be true, but if you stick with the CLI then there's only one app to trust - and one person! You don't rely on a company to safegaurd your data, you trust yourself. YMMV, thoughts are my own. I happen to very much enjoy pass and I think others might too if you like owning your own data.

mumblemumble 6y ago
> If someone types "pass" in your terminal it will show a list of sites that you've stored. This is not really any different from Keychain on a Mac. I don't really see it as a major downside. If someone's logged into the computer as you, you're already hosed, and this is hardly the first place they're going to look to get a list of websites you've visited.
- cycomanic 6y ago
  But that's not the concern, anyone who gets their hand on your passwordstore (encrypted) gets the same information. That is not the case with a format that stores your password in one big database. The implications can be quite significant, because if I get my hands on your store, I might find out that you are User xx on yy which I can then use to try to compromise via social engineering (or it might has a known exploit) and use that as a springboard for other sites that I know from your pass store.
iudqnolq 6y ago
What people mean by leaking metadata is if you sync over git or dropbox you also leak the metadata to them. Whereas with 1password or something like it the sync server only sees an opaque blob.
- dopidopHN 6y ago
  I use a private git repo that I own on a machine I configured. Does that mitigate it
  - iudqnolq 6y ago
    That means only anyone with access to your laptop can know where you have accounts. Also make sure you're aware of https://news.ycombinator.com/item?id=26801155 https://news.ycombinator.com/item?id=26801155

mumblemumble 6y ago

> If someone types "pass" in your terminal it will show a list of sites that you've stored. This is not really any different from Keychain on a Mac. I don't really see it as a major downside. If someone's logged into the computer as you, you're already hosed, and this is hardly the first place they're going to look to get a list of websites you've visited.

cycomanic 6y ago
But that's not the concern, anyone who gets their hand on your passwordstore (encrypted) gets the same information. That is not the case with a format that stores your password in one big database. The implications can be quite significant, because if I get my hands on your store, I might find out that you are User xx on yy which I can then use to try to compromise via social engineering (or it might has a known exploit) and use that as a springboard for other sites that I know from your pass store.

iudqnolq 6y ago

What people mean by leaking metadata is if you sync over git or dropbox you also leak the metadata to them. Whereas with 1password or something like it the sync server only sees an opaque blob.

dopidopHN 6y ago
I use a private git repo that I own on a machine I configured. Does that mitigate it
- iudqnolq 6y ago
  That means only anyone with access to your laptop can know where you have accounts. Also make sure you're aware of https://news.ycombinator.com/item?id=26801155 https://news.ycombinator.com/item?id=26801155