6 ms·

I just use pass: https://www.passwordstore.org/ https://www.passwordstore.org/

by f00zz 5y ago

sam_lowry_ 5y ago
gopass [1] is a 100% compatible pass implementation that has some collaboration features added. However, I primarily use it for the `gopass search` output. This is where `pass` really sucks for those who copy-paste. [1] https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass
- creese 5y ago
  find ~/.password-store -name '*.gpg' -printf '%P\n' | sed -e 's:.gpg$::gi' | fzf | xargs pass -c There is also an extension: https://github.com/ficoos/pass-fzf https://github.com/ficoos/pass-fzf
  - sam_lowry_ 5y ago
    Good point, but `pacman -S gopass` is wa-a-ay easier ;-)
    - creese 5y ago
      I use a bash function: pass () { if [ $# -eq 0 ] || ( [ $# -eq 1 ] && [ $1 = "-c" ] ); then find ~/.password-store -name '\*.gpg' -printf '%P\n' | sed -e 's:.gpg$::gi' | fzf | xargs /usr/local/bin/pass $@; else /usr/local/bin/pass $@; fi } pass + fzf + bash > gopass. DOTADIW.
drstewart 5y ago
Correct. For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using pass on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.
- konart 5y ago
  Yeah... Will it also suggest me my passwords in iOS? Come on, guys, 1Password is not only about syncing passwords between N computers.
  - esclerofilo 5y ago
    Actually, yes, there's an open source "Pass for iOS" app. Not that I recommend this setup though.
- deleted 5y ago
  [deleted]
  - soshiito 5y ago
    Congratulations.
- xd1936 5y ago
  This comment has big "why use Dropbox when you can get an FTP account, mount it locally with curlftpfs, and then use SVN or CVS on the mounted filesystem"[1] energy. I think that's the joke you're making? 1. https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224
- apozem 5y ago
  For those who don't get the joke: https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 (If this is not a joke, yikes).
- bspammer 5y ago
  They’re not suggesting pass to the general population, but I’d expect the average HNer to find it useful. Syncing is also very easy for developers - just use git.
- jacurtis 5y ago
  This is like saying that you could replicate Instagram in a single evening, allowing people to upload pictures and post them to a feed. Sure, you could... but there is a monstrous gap between that and the real service that you are comparing it to.
jrm4 5y ago
No, but in all seriousness, I emphatically DO NOT UNDERSTAND the extent to which people place trust in external services to manage passwords. While I appreciate that they do have good skin in the game by being paid, etc -- your password storage on SOMEONE ELSE'S MACHINE fundamentally creates another huge attack vector/opportunity to screw it up, when they also must be accessed locally somehow. I appreciate it if you're like "look, the convenience outweighs the safety," but it really feels like most of these discussions hand-waves away this fundamental flaw. I say this especially as someone who doesn't do a lot of passworded services on my phone, because, you know, that stuff is really insecure no matter how good your password is.
- iudqnolq 5y ago
  Here's the mistake I made that made me decide to switch to 1password https://news.ycombinator.com/item?id=26801155 https://news.ycombinator.com/item?id=26801155 Also, depending on your phone, it might be significantly more secure against non-superpower actors.
  - jrm4 5y ago
    Fair, but I just have them backed up to a non-encrypted USB key, offline.
    - iudqnolq 5y ago
      If it works for you, that's good. It's less the specific issue and more it indicated to me I was rolling my own crypto and didn't know enough to avoid shooting my feet off.
  - nerdponx 5y ago
    KeepassXC is an option.
- octobus2021 5y ago
  Exactly. I have an open source password manager on my Linux laptop and the data files are backed up weekly to 2 different locations (along with other valuable information). Granted, I have little need for password management on the phone, but even if I did, why would I trust someone to keep track of my credentials? I just don't get it why so many people seem to be ok with this...
HotHotLava 5y ago
I do as well, but I have to admit that a browser-based solution has a real security advantage when it comes to phishing protection, since it has access to the URL and can compare it to the one stored for the password. It would be cool if there was some open password management API that browsers/password managers could implement to solve this without extensions.

I just use pass: https://www.passwordstore.org/ https://www.passwordstore.org/

by f00zz 5y ago

I just use pass: https://www.passwordstore.org/ https://www.passwordstore.org/

gopass [1] is a 100% compatible pass implementation that has some collaboration features added. However, I primarily use it for the `gopass search` output. This is where `pass` really sucks for those who copy-paste. [1] https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass

creese 5y ago
find ~/.password-store -name '*.gpg' -printf '%P\n' | sed -e 's:.gpg$::gi' | fzf | xargs pass -c There is also an extension: https://github.com/ficoos/pass-fzf https://github.com/ficoos/pass-fzf
- sam_lowry_ 5y ago
  Good point, but `pacman -S gopass` is wa-a-ay easier ;-)
  - creese 5y ago
    I use a bash function: pass () { if [ $# -eq 0 ] || ( [ $# -eq 1 ] && [ $1 = "-c" ] ); then find ~/.password-store -name '\*.gpg' -printf '%P\n' | sed -e 's:.gpg$::gi' | fzf | xargs /usr/local/bin/pass $@; else /usr/local/bin/pass $@; fi } pass + fzf + bash > gopass. DOTADIW.

drstewart 5y ago

Correct. For a Linux user, you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using pass on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software.

konart 5y ago
Yeah... Will it also suggest me my passwords in iOS? Come on, guys, 1Password is not only about syncing passwords between N computers.
- esclerofilo 5y ago
  Actually, yes, there's an open source "Pass for iOS" app. Not that I recommend this setup though.
deleted 5y ago
[deleted]
- soshiito 5y ago
  Congratulations.
xd1936 5y ago
This comment has big "why use Dropbox when you can get an FTP account, mount it locally with curlftpfs, and then use SVN or CVS on the mounted filesystem"[1] energy. I think that's the joke you're making? 1. https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224
apozem 5y ago
For those who don't get the joke: https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 (If this is not a joke, yikes).
bspammer 5y ago
They’re not suggesting pass to the general population, but I’d expect the average HNer to find it useful. Syncing is also very easy for developers - just use git.
jacurtis 5y ago
This is like saying that you could replicate Instagram in a single evening, allowing people to upload pictures and post them to a feed. Sure, you could... but there is a monstrous gap between that and the real service that you are comparing it to.

jrm4 5y ago

No, but in all seriousness, I emphatically DO NOT UNDERSTAND the extent to which people place trust in external services to manage passwords. While I appreciate that they do have good skin in the game by being paid, etc -- your password storage on SOMEONE ELSE'S MACHINE fundamentally creates another huge attack vector/opportunity to screw it up, when they also must be accessed locally somehow. I appreciate it if you're like "look, the convenience outweighs the safety," but it really feels like most of these discussions hand-waves away this fundamental flaw. I say this especially as someone who doesn't do a lot of passworded services on my phone, because, you know, that stuff is really insecure no matter how good your password is.

iudqnolq 5y ago
Here's the mistake I made that made me decide to switch to 1password https://news.ycombinator.com/item?id=26801155 https://news.ycombinator.com/item?id=26801155 Also, depending on your phone, it might be significantly more secure against non-superpower actors.
- jrm4 5y ago
  Fair, but I just have them backed up to a non-encrypted USB key, offline.
  - iudqnolq 5y ago
    If it works for you, that's good. It's less the specific issue and more it indicated to me I was rolling my own crypto and didn't know enough to avoid shooting my feet off.
- nerdponx 5y ago
  KeepassXC is an option.
octobus2021 5y ago
Exactly. I have an open source password manager on my Linux laptop and the data files are backed up weekly to 2 different locations (along with other valuable information). Granted, I have little need for password management on the phone, but even if I did, why would I trust someone to keep track of my credentials? I just don't get it why so many people seem to be ok with this...

HotHotLava 5y ago

I do as well, but I have to admit that a browser-based solution has a real security advantage when it comes to phishing protection, since it has access to the URL and can compare it to the one stored for the password. It would be cool if there was some open password management API that browsers/password managers could implement to solve this without extensions.