15 ms·
Clever uses of pass, the Unix password manager
- simonmales 5y agoRecently used pass to share passwords between colleagues (3 in total). Files are encrypted against three different GPG public keys and shared via Git. Works well enough for us.
- tata71 5y agoHardware U2F to unlock would make this my dream.
- kitotik 5y agoI use YubiKeys setup for gpg with pass, so unlocking the keyring requires both a yubikey and a PIN, but I haven’t figured out how to do the U2F part.
- stevelosh 5y agoIf your goal is to force a touch to decrypt passwords, https://www.palkeo.com/en/blog/perfect-password-manager.html https://www.palkeo.com/en/blog/perfect-password-manager.html works. You can keep the GPG private key on a Yubikey and require a touch to decrypt.
- deleted 5y ago[deleted]
- INTPenis 5y agoMight as well link this blog[1] that helped me recently when I created a new GPG key for my yubikey and wanted to re-encrypt all my passwords for two keys. 1. https://medium.com/@davidpiegza/using-pass-in-a-team-1aa7adf36592 https://medium.com/@davidpiegza/using-pass-in-a-team-1aa7adf...
- zaik 5y agoFor teams there is also gopass (https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass) which is compatible with pass I believe.
- mauli 5y agoFor the curl command though written like it won't show up in history, this will still show up in process parameters To fix this as well pass it into curl as a config via eg: curl [...] -K- <<< "--header auth:$(pass mysecret)"
- vesinisa 5y agocurl -H/--header itself also takes a file name prefixed by @, including - for stdin. So you could go curl -H@- <<<'API-Key: Foobar', or if you need to specify multiple sensitive headers, curl -H@<(echo API-Key: Foo) -H@<(echo Pre-Shared: Bar)
- remram 5y ago<() is a bash extension and won't work in another `sh` like dash.
- hvdijk 5y agoAnd this matters a lot because history is normally only accessible to the current user (and root), but process command line arguments are normally accessible to all users.
- throwawayboise 5y agoI've long thought that was a general problem. Why should I see the command line arguments from other users' processes? What if non-root could see their own processes in detail, but only the program name for other users' processes? Would that break a lot of other things?
- user3939382 5y agoFYI for those interested in CLI password management, there is a pretty good CLI for LastPass called lpass that even supports your Yubikeys. https://github.com/lastpass/lastpass-cli https://github.com/lastpass/lastpass-cli
- RMPR 5y agoThat's quite ... Clever. Now I can version my mbsyncrc and even my shell history without worrying about secrets leak.
- chrisweekly 5y agoBe sure to protect those secrets though -- see eg peer comments about process params (made shortly after yours)
- tyingq 5y agoRegular gpg does have a --passphrase-fd argument that's nice for this sort of thing. Where you can specify which file descriptor the passphrase/password is coming from. Very handy for integrating with scripts.
- mike-cardwell 5y agoIn my ansible.cfg I have: vault_password_file = tools/vault.sh In my tools/vault.sh I have: echo -n $(pass infrastructure/ansible-vault) This lets me store my ansible vault master password for managing my personal infrastructure inside pass. I like it.
- VTimofeenko 5y agoAnsible also has a collection that allows to work with pass's password store directly[1]. Have been using it with a dedicated pass repo for a while now, the PASSWORD_STORE_DIR variable can be loaded through direnv when entering directory with ansible playbooks to separate infrastructure credentials from user ones. [1]: https://docs.ansible.com/ansible/latest/collections/community/general/passwordstore_lookup.html https://docs.ansible.com/ansible/latest/collections/communit...
- encryptluks2 5y agoThank you.. Just setup isync yesterday. So close to having freedom to move from Google whenever I want
- syx 5y agobeen using pass for more than 3 years now never had an issue, great CLI tool
- gspr 5y agoYeah. I think it might be the tool that's given me the most quality of life per line of code :-) Stellar. Absolutely stellar piece of software. Always does exactly what I want it to, never gets in my way ever!
- tialaramex 5y agoI still really like how it makes random passwords given a permitted character set. It uses tr -cd to read only matching character bytes - discarding any others - from the random device. If you instead try to be less wasteful in turning random bytes into characters from the chosen set, you are in a sticky situation very quickly where your passwords might be less random than they should be, whereas bytes from the random device are cheap, so just throw away all the ones that aren't suitable and get more. So simple and yet I'm sure it wouldn't have occurred to me.
- wizzwizz4 5y agoIt means password generation takes variable time; this: • opens you up to timing attacks on your PRNG (unlikely to be a problem in real life, but you never know) • might run forever
- marcosdumay 5y agoThe timing depends on your charset. You may not want to tell it to everyone on the street, but it's not something you need to keep secret either.
- assbuttbuttass 5y agoIt has probability 0 of running forever
- 5y ago
- crawl_soever 5y agoI use pass along with passff and my yubikey for gpg decryption of the password store and gpg-ssh syncing from my home git pass db. Works great
- fooqux 5y agopassff and other tools like them scare me too much. That browser extension has too much power. All it would take is the author to sell it to some bad actors (or turn into one) and a lot of people will be having a very bad day. Pasting my password into a form isn't that bad, and it feels far safer.
- danuker 5y agoYou can disable automatic updates for the extension, download it manually, and inspect the XPI file before installing it. Instead of clicking "Add to Firefox", you can right-click and "Save Link As..."
- OJFord 5y agoI use a couple of little scripts to do something somewhere in the middle that I'm happy with: `fzf-dmenu` spawns an alacritty window running fzf over given input. `pass-dmenu` calls the former with available password names; takes the result (if any) and decrypts & types it with `pass show $result | xdotool type --file -`.
- OJFord 5y ago(And if it's not obvious, that's bound to a keypress, so from the browser I just hit F4, type e.g. 'hn<CR>' and my password is entered into the focussed input area.)
- C4K3 5y agoSome distros package browser extensions, so you can install them via your regular package manager. For example arch packages firefox-extension-passff (I haven't personally used it though)
- hestefisk 5y agoLooks very neat; nice Unix’y solution. Would love this to integrate with Bitwarden which I use on my phone.
- zikduruqe 5y agoAre you referring to Pass? There is... https://mssun.github.io/passforios/ https://mssun.github.io/passforios/ Works wonderfully and with OTPauth also. Run a bare git repo on your own network and there is no reason to use Bitwarden. Edit - and for those that are in AWS, you can use pass along with aws-vault to keep your ~/.aws creds in check. https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault
- watchdogtimer 5y agoIs there an equivalent for Android?
- an6n 5y agoSadly no yubikey support though - https://github.com/mssun/passforios/issues/42 https://github.com/mssun/passforios/issues/42
- ossusermivami 5y agothere is a pass import pluging allowing you to import bitwardn csv https://github.com/roddhjav/pass-import https://github.com/roddhjav/pass-import maybe you can "bridge it" with bitwarden-cli via some export/import commands or may as well use bitwarden-cli directly (but i find the pass ui much bettwer than bw cli command)
- Ciantic 5y agoUsing single file for single password entry is very good idea. It's far better than any tools that opens the whole password database at once (KeePass, LastPass, Bitwarden etc). Reason is that you can use e.g. YubiKey to unlock individual entries on touch, this means that you can't lose whole password database on ransomware attack, (unless the ransomware has been there for a very long time). Filippo Valsorda wrote about this: https://blog.filippo.io/touch-to-operate-password-store-yubikey-4/ https://blog.filippo.io/touch-to-operate-password-store-yubi...
- invokestatic 5y agoThis is still susceptible to ransomware. Ransomware will simply encrypt over each file with its own key, regardless of if the file is already encrypted or not.
- Ciantic 5y agoBackups is of course required. I was talking about Ransomware which also enters your password database and steals the passwords in order to do more harm. With YubiKey you can make the GPG private key on offline machine and upload it to YubiKey. This way you can always have a offline backup of your private key, and thus you can backup your password database too.
- invokestatic 5y agoThe term “ransomware” is never used to describe malware that steals passwords, thats the point of confusion.
- Xylakant 5y agoIt also has a few downsides: Adding a new key requires re-encrypting every entry. Touching your yubikey hundreds of times gets old, fast.
- jehteh 5y agoIf you are using GPG keys and have the master key backed up somewhere you can fairly easily use that on an offline machine to add the new key to the full batch of password files without needing to perform a million button presses.
- loudmax 5y ago`pass` was written by Jason Donenfeld, the developer who gave us WireGuard. It's is a bash script that makes it convenient and easy to use gpg2, the OpenPGP encryption tool. Frankly, I'm kind of shocked at how difficult it is to use the gpg2 command line utility. Clearly it's an extremely powerful tool, but it's written with the assumption that the user has a very deep understanding of how encryption and key signing work. To use `pass` effectively you should have a basic understanding of encryption, but unlike gpg2 you don't need to dedicate a week to grok the manpage.
- jamal-kumar 5y agoAs much as I love Jason Donenfeld's work, I tried to use pass and the gpg requirement just rubbed me the wrong way. It's basically just gpg-encrpyting a text file and unlocking that along with some wrappers for basic password manager functionality (I guess most important is clipboard functionality and clearing it automatically after some seconds), but somehow that seems like a weak point to me. It's a whole lot of reliance on one extremely bloated suite of applications when I feel like something standalone and about as compact would be better somehow.
- yepguy 5y agoA few pass-related projects are working on an age[1] backend in addition to gpg. I think gopass already has support for it. [1]: https://age-encryption.org/ https://age-encryption.org/
- MayeulC 5y agoIs there a way to use it with the D-Bus org.freedesktop.secrets service?
- assbuttbuttass 5y agoI'm shocked no one mentioned passmenu, a secret script that comes with pass located in usr/share/doc/pass/examples/dmenu/passmenu Bind this script to a keybinding, and it will load all your passwords into dmenu and let you type the first few characters of a website name, then copy the password to the clipboard. No CLI needed.
- sam_lowry_ 5y agoSecond that. passmenu is very useful, although most of the time I use Chromium or FF plugins for that. Also, Password Store by Harsh Shandilya on Android is a wonderful little tool. Too pity is has only two sponsors on Github.
- INTPenis 5y agoIt's actually a separate package on Fedora called passmenu. Maybe because dmenu is not standard for Fedora users by default.
- edoceo 5y agoWould love to see more examples of how to use this across teams - any pointers?
- janikvonrotz 5y agohttps://janikvonrotz.ch/2018/04/03/using-pass-in-teams/ https://janikvonrotz.ch/2018/04/03/using-pass-in-teams/
- chpatrick 5y agoI wouldn't recommend it unless you like GPG key management. (re)encrypting passwords for all your team members is a real pain. We recently switched from pass to BitWarden and it's been far more convenient.
- ahnick 5y agoFor those interested in pass for use in shell script based contexts, you may also find encpass.sh (https://github.com/plyint/encpass.sh https://github.com/plyint/encpass.sh) useful. This is a simple tool I wrote (a while ago now) to encrypt/decrypt secrets and store them in a manner very similar to pass, except it uses OpenSSL instead of GPG. Since it is also just a shell script and it's only real dependency is OpenSSL, then it can be used in a wide array of environments where installing additional software may not be an option. It also has hooks in the code to write your own extensions, which can be used to add features or utilize an entirely different backend instead of OpenSSL. Check out the Keybase extension as an example. (https://github.com/plyint/encpass.sh/blob/master/extensions/keybase/KEYBASE.md https://github.com/plyint/encpass.sh/blob/master/extensions/...)
- sam_lowry_ 5y agoThe stdout from `pass` is awful, even for copy-pasting. OTOH, gopass [1], an otherwise 100% compatible drop-in replacement does the job much better and has some neat collaborative features as well. [1] https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass
- kenmacd 5y agoWow, I just tried it and found `gopass show -o ___` works perfectly to scripts that want just the password without any null bytes or newlines in it. You've converted me. Thank you for mentioning it, I never thought to look for a compatible drop-in.
- matoro 5y agoI also use this for OTP tokens instead of my phone! https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
- woile 5y agoI wrote a cheatsheet[0] for gopass, which I've been using with different teams and personal with great success. It's the same as pass but with support for multiple stores. I'd like to see something similar but with age support . [0]: https://woile.github.io/gopass-cheat-sheet/ https://woile.github.io/gopass-cheat-sheet/
- teddyc 5y agoThe article doesn't mention how well `pass` integrates with `git`. Once you do that, you get revision history, you can push it to a private repo (github, gitlap, etc), and keep your passwords in sync across multiple devices
- zaik 5y agoOn Android the app which supports pass+git is called 'Password Store' and can be found on F-Droid: https://f-droid.org/packages/dev.msfjarvis.aps https://f-droid.org/packages/dev.msfjarvis.aps
- twp 5y agoWith chezmoi you can use pass to store secrets in your dotfiles, for example if you want to set a secret API token in your ~/.bashrc you can use: export SECRET_API_TOKEN={{ pass "api/token" | quote }} For more info see https://github.com/twpayne/chezmoi/blob/master/docs/HOWTO.md#use-pass https://github.com/twpayne/chezmoi/blob/master/docs/HOWTO.md... and https://github.com/twpayne/chezmoi/blob/master/README.md https://github.com/twpayne/chezmoi/blob/master/README.md.
- cycomanic 5y agoYou could also use secret-tool for this, which is compatible with many tools that support the secret tool, I use keepassxc for example.
- ryanianian 5y agoWhat is the `quote` command that example pipes to? Seems handy but unsurprisingly hard to search for.
- iudqnolq 5y agoI think it's this? I found it by googling "shell quote command". https://askubuntu.com/questions/354915/quote-command-in-the-shell https://askubuntu.com/questions/354915/quote-command-in-the-...
- virchau13 5y agoAlso note that `printf "%q"` is an alternative to this.
- twp 5y agoIn this example, `quote` is a function from sprig [1] which chemzoi uses with Go's text/template language [2]. [1] https://masterminds.github.io/sprig/strings.html https://masterminds.github.io/sprig/strings.html [2] https://pkg.go.dev/text/template https://pkg.go.dev/text/template
- parasew 5y agoCheck out sicuit, also GPG based. https://codeberg.org/simonrepp/sicuit https://codeberg.org/simonrepp/sicuit
- cjauvin 5y agoI use pass with Emacs, using this package [1], and it's very nicely integrated and useful. [1] https://melpa.org/#/pass https://melpa.org/#/pass
- tempodox 5y agoPrevious discussion: https://news.ycombinator.com/item?id=14819136 https://news.ycombinator.com/item?id=14819136
- choiway 5y agoI got stuck at init
- mongol 5y agoI think use of the copy buffer is the weakness of pass. Can't it be read by any process?
- INTPenis 5y agoThis is a very good point about infosec that a lot of password manager users overlook. Me included. In wayland you can pipe the password into wl-copy -o so it will only be pasted once then disappear. In Xorg you'd need a callback after running pass that runs xclip -i /dev/null some time after the password is copied. There is no good solution to this in Linux that does not involve discipline.
- tyingq 5y agoThe clipboard? How well it's protected varies by distro, X11 vs Wayland, etc.
- captn3m0 5y agoDocker supports a credential-helper module[0], which supports 4 different backends for fetching the docker registry credentials: osxkeychain, pass, wincred, and secretservice. pass lets you use GPG-smartcards, and many of those (such as Yubikeys) will let you enforce touch-policies for signing/encruption. As a combination of both these however, I must touch my Yubikey every time I pull a new docker image. Another cool use-case is that I use the terraform-pass-provider to save secrets for my personal terraform project. [0]: https://github.com/docker/docker-credential-helpers https://github.com/docker/docker-credential-helpers
- vinceguidry 5y agoOne thing I love to use pass with is direnv. The problem direnv solves for me is: how can I have persistent local config/settings in a shared repo without having to push code? Invariably at work there is always the 'shared access credentials to third-party services'. Usually you just throw these in a .env file. This leaves them on your drive in plaintext. Instead, stuff the creds into pass, and since dotenv leverages bash, you can put substitutions in your .envrc file. Bonus, now that the creds are in a personal secured repo, you don't have to go hunting for the creds every time you want to spin up a new dev machine. (you do unfortunately still have to migrate your .envrc, I tried writing git tooling to make it easier but I could never find a convenient place to store them. I have ideas to extend git to try out the next time I want to iterate on this) This does require your app to be properly configurable with environment variables, meaning if an envvar is present, it should override all other settings. Envvars don't get set by accident so they should be treated as the ultimate settings. This is usually the case with most frameworks but I've run into Node apps where this wasn't the case. Maddening.
- ohazi 5y agoAnother useful thing to store as `pass` secrets is credit card numbers / parameters. This makes it easy to fill in card info online using the same password tools you're already using (passmenu, rofipass, etc.), without needing to go find your wallet, or rely on your browser's form auto-fill database (and worry about hidden fields attempting to exfiltrate that auto-fill data). I'm tempted to use `pass` to store TOTP seeds as well, but this seems like a bad idea because you'd be putting both factors in one place. Maybe a separate pass db stored offline or something...
- kenmacd 5y agoAll great, but I wish `pass` was usable in scripts without having to pipe it through `head -n 1 | tr -d '\d'`
- waynesonfire 5y agoincredible tool, works so well with yubikeys and cross platform. use it and recommend it all the time.
- GauntletWizard 5y agoAt a previous job, I set up all our Kubernetes secrets such that their canonical location was in pass; Creating or updating them was a simple shell script: kubectl create secret generic -o yaml --dry-run \ --from-literal "foo=$(pass show foo)" foo | kubectl apply -f - I was very pleased with it - It was simple enough for developers to use where necessary, easy to distribute passwords, and worked very well. The next guy ripped it out and replaced with Vault and none of the passwords have been rotated since.