7 ms·

https://www.passwordstore.org/ https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n"

https://www.passwordstore.org/ https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integration for syncing). There's another plugin: "password-tomb" which basically adds in a "zip -r tomb.zip ~/.passwordstore && unzip tomb.zip" with some extra encryption blobbing around things. I'm nudging towards wanting all that "junk" stored on a mostly-offline (or read-only USB, or doing something with fetching encrypted secrets over the network), and trying to figure out in a temporary ram-disk to try and reduce exposure-time. The reason it feels pretty good for me is that it degrades gracefully and can be used with standard tooling. It's totally possible to have a script which does: "foreach password => unlock && dump && append-to-pdf && qr-code => print.pdf" and print that out at intervals, so it's got great survivability characteristics. It allows me to self-host even completely offline using git. If I have the GPG key, I can recover the passwords w/o any tooling. Really it's kindof my ideal situation for trustworthiness.

npteljes 5y ago
Doesn't that 'echo' command go straight to the command history? It would reside in ~/.bash_history unencrypted until I type 2000 other commands.
- burntsushi 5y ago
  I think it's just an example to give you a conceptual idea of what 'pass' is doing under the covers. Of course, using 'pass' does not require 'echo'ing your password anywhere. Tangentially, if you precede a command with a space, then it won't show up in your shell history. (Double check to be sure, as this is likely a configurable option of your shell. e.g., 'histignorespace' in zsh.)
  - npteljes 5y ago
    I agree with your points, but why showcase a super secure system with a flawed example? Also, so many things can go wrong with this setup, I'm inclined to think that this is one of the upsides of a password manager like KeePass.
    - Anthony-G 5y ago
      I think you may have focused in on the tangential sentence rather than the point about it being a conceptual overview with Unix commands being used as a metaphor, i.e., not a literal example. E.g., they’re not typing `echo` commands in the same way that they’re not typing `gpg "make-key"` (which is not a real command).
    - burntsushi 5y ago
      No, you appear confused. 'pass' is pretty hard to misuse. It, at no point, makes it easy to put a password into shell history. You're getting caught up in a transcript to showcase the concepts. The actual implementation of 'pass' is quite secure. It does those things for you in a way that is secure, precisely so you don't have to worry about 'echo'ing passwords in plain text.
- PennRobotics 5y ago
  Adding a space before echo will keep the command out of .bash_history (if $HISTCONTROL == ignorespace or ignoreboth)
- harel 5y ago
  Start your command with a space to prevent it from reaching history
- ramses0 5y ago
  I just see asterisks?
  - Anthony-G 5y ago
    Is that you, Cthon98?
- mdellavo 5y ago
  I typically use the generate pass command to generate a new password - that isnt in history
qudat 5y ago
I've been using `pass` for years. Yes it's more manual but I'm in full control of the password management. There's also a mobile app for ios and ipad that work just fine, including storing OTP.
remram 5y ago
Is that "sign" supposed to be "encrypt"?
- ramses0 5y ago
  (yep, sorry)
panny 5y ago
In addition, plasma-pass, qtpass, android password store (https://github.com/android-password-store/Android-Password-Store https://github.com/android-password-store/Android-Password-S...) are nice as well. Throw in a NFC Yubikey and OpenKeychain on android, then you can lock them with hardware keys. Since pass uses git, syncing can be done to a private repo on your home network or even just a cheap usb stick.
nextaccountic 5y ago
Also, there's a firefox extension https://addons.mozilla.org/en-US/firefox/addon/passff/ https://addons.mozilla.org/en-US/firefox/addon/passff/ (on github: https://github.com/passff/passff https://github.com/passff/passff) It requires the user to run a daemon that reads ~/.passwordstore passwords and feed it to the extension https://github.com/passff/passff-host https://github.com/passff/passff-host - but the design is pretty transparent to inspection if you're inclined to check

npteljes 5y ago

Doesn't that 'echo' command go straight to the command history? It would reside in ~/.bash_history unencrypted until I type 2000 other commands.

burntsushi 5y ago
I think it's just an example to give you a conceptual idea of what 'pass' is doing under the covers. Of course, using 'pass' does not require 'echo'ing your password anywhere. Tangentially, if you precede a command with a space, then it won't show up in your shell history. (Double check to be sure, as this is likely a configurable option of your shell. e.g., 'histignorespace' in zsh.)
- npteljes 5y ago
  I agree with your points, but why showcase a super secure system with a flawed example? Also, so many things can go wrong with this setup, I'm inclined to think that this is one of the upsides of a password manager like KeePass.
  - Anthony-G 5y ago
    I think you may have focused in on the tangential sentence rather than the point about it being a conceptual overview with Unix commands being used as a metaphor, i.e., not a literal example. E.g., they’re not typing `echo` commands in the same way that they’re not typing `gpg "make-key"` (which is not a real command).
  - burntsushi 5y ago
    No, you appear confused. 'pass' is pretty hard to misuse. It, at no point, makes it easy to put a password into shell history. You're getting caught up in a transcript to showcase the concepts. The actual implementation of 'pass' is quite secure. It does those things for you in a way that is secure, precisely so you don't have to worry about 'echo'ing passwords in plain text.
PennRobotics 5y ago
Adding a space before echo will keep the command out of .bash_history (if $HISTCONTROL == ignorespace or ignoreboth)
harel 5y ago
Start your command with a space to prevent it from reaching history
ramses0 5y ago
I just see asterisks?
- Anthony-G 5y ago
  Is that you, Cthon98?
mdellavo 5y ago
I typically use the generate pass command to generate a new password - that isnt in history

qudat 5y ago

I've been using `pass` for years. Yes it's more manual but I'm in full control of the password management. There's also a mobile app for ios and ipad that work just fine, including storing OTP.

remram 5y ago

Is that "sign" supposed to be "encrypt"?

ramses0 5y ago
(yep, sorry)

panny 5y ago

In addition, plasma-pass, qtpass, android password store (https://github.com/android-password-store/Android-Password-Store https://github.com/android-password-store/Android-Password-S...) are nice as well. Throw in a NFC Yubikey and OpenKeychain on android, then you can lock them with hardware keys. Since pass uses git, syncing can be done to a private repo on your home network or even just a cheap usb stick.

nextaccountic 5y ago

Also, there's a firefox extension https://addons.mozilla.org/en-US/firefox/addon/passff/ https://addons.mozilla.org/en-US/firefox/addon/passff/ (on github: https://github.com/passff/passff https://github.com/passff/passff) It requires the user to run a daemon that reads ~/.passwordstore passwords and feed it to the extension https://github.com/passff/passff-host https://github.com/passff/passff-host - but the design is pretty transparent to inspection if you're inclined to check