3 ms·

I give this article a chance, but some assumptions are outright false. For example: > No Post-Quantum security Yeah, no. The beauty of PGP is being able to se

I give this article a chance, but some assumptions are outright false. For example: > No Post-Quantum security Yeah, no. The beauty of PGP is being able to select your encryption algorithm. Somehow, arguing that AES-256 is more resistant to for example Ed25519 is just factually incorrect and people that use KeePass are not memorizing 40 character passwords to unlock their password manager. > No Service Privacy / Leaks Changes Pass doesn't make assumptions. If you want to encrypt filenames then wrap it with gocryptfs or cryfs or pass-tomb. The nice thing about syncing with pass is having auditable changes that doesn't require a complete database resync. Imagine someone modifying your password store with KeePass. You are not going to have diff to tell what has been changed. With Password Store, you can see exactly what has been changed between syncs. > No authentication of values Again, something that you can change in your PGP settings. I'm not going through the full article, but in all honesty it just sounds like this person doesn't like GnuPG and doesn't understand it. Lest not forget that pass is by the same individual that created wireguard and a slew of other security-focused tools and I think their reputation speaks for itself.

culpable_pickle 4y ago
> people that use KeePass are not memorizing 40 character passwords to unlock their password manager. I use a pass phrase that is substantially longer then 40 characters. It doesn’t take too long to sink in.
- encryptluks2 4y ago
  Fair, but I think that is more of an exception than the norm. For people that may want to more frequently lock their password database, having a 40 character password would quickly become a PITA.
  - throw0101a 4y ago
    > […] having a 40 character password would quickly become a PITA. Do you have a a favourite song/poem/nursery rhyme? "Hey diddle diddle, the cat and the fiddle," * https://en.wikipedia.org/wiki/Hey_Diddle_Diddle https://en.wikipedia.org/wiki/Hey_Diddle_Diddle And you only have to unlock it perhaps once at the beginning of the work day (set auto-lock/forget to 8 hours), or twice a day (morning, after lunch; auto-lock to 4 hours). Once unlocked maybe only ask for confirmation for use.
    - encryptluks2 4y ago
      To me it makes more sense to use a longer password for FDE, and maybe have it have it cached into the TPM but with a shorter unlock code for resuming, locking, etc. It might make sense to have a two tier password for password managers though. Like a hot/cold.
    - sowbug 4y ago
      Using a phrase in a book or a poem is not much stronger than using a single word as a passphrase. Attackers include such phrases in their cracking dictionaries, including variations on spelling and punctuation. After the initial hashing of the candidate passphrase, a five-letter word takes exactly as long as a 100-character lyric from a song. There are lots of sad stories of people losing funds in the early days of Bitcoin when "brain wallets" were briefly popular. Victims used quote-based passphrases that seemed unguessable. The threat model is a little different when it includes getting access to your encrypted password-manager database or OpenPGP smart card. But the point stands that a well-known phrase might as well be a dictionary word.
- jamal-kumar 4y ago
  I find it easier to remember a short sentence than a short password with a bunch of weird characters in it for sure
bertman 4y ago
There is also "passage": https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage It's pass with age-encryption instead of pgp. Discussed here: https://news.ycombinator.com/item?id=29597729 https://news.ycombinator.com/item?id=29597729
- upofadown 4y ago
  The use of age doesn't seem to address any of the stuff in the linked article. At least the use of age would not make things worse in this particular application because pass does not authenticate the saved password files. Age famously can't do authorization for the asymmetrical encryption case.
underlines 4y ago
Using a dictionary, I was able to roll a funny and easy to remember Passphrase that fulfills the 40 character limit. I'm using it ever since for my KeePass file.
- yonrg 4y ago
  Correct horse battery staple I use that.. so not exactly that ;)

culpable_pickle 4y ago

> people that use KeePass are not memorizing 40 character passwords to unlock their password manager. I use a pass phrase that is substantially longer then 40 characters. It doesn’t take too long to sink in.

encryptluks2 4y ago
Fair, but I think that is more of an exception than the norm. For people that may want to more frequently lock their password database, having a 40 character password would quickly become a PITA.
- throw0101a 4y ago
  > […] having a 40 character password would quickly become a PITA. Do you have a a favourite song/poem/nursery rhyme? "Hey diddle diddle, the cat and the fiddle," * https://en.wikipedia.org/wiki/Hey_Diddle_Diddle https://en.wikipedia.org/wiki/Hey_Diddle_Diddle And you only have to unlock it perhaps once at the beginning of the work day (set auto-lock/forget to 8 hours), or twice a day (morning, after lunch; auto-lock to 4 hours). Once unlocked maybe only ask for confirmation for use.
  - encryptluks2 4y ago
    To me it makes more sense to use a longer password for FDE, and maybe have it have it cached into the TPM but with a shorter unlock code for resuming, locking, etc. It might make sense to have a two tier password for password managers though. Like a hot/cold.
  - sowbug 4y ago
    Using a phrase in a book or a poem is not much stronger than using a single word as a passphrase. Attackers include such phrases in their cracking dictionaries, including variations on spelling and punctuation. After the initial hashing of the candidate passphrase, a five-letter word takes exactly as long as a 100-character lyric from a song. There are lots of sad stories of people losing funds in the early days of Bitcoin when "brain wallets" were briefly popular. Victims used quote-based passphrases that seemed unguessable. The threat model is a little different when it includes getting access to your encrypted password-manager database or OpenPGP smart card. But the point stands that a well-known phrase might as well be a dictionary word.
jamal-kumar 4y ago
I find it easier to remember a short sentence than a short password with a bunch of weird characters in it for sure

bertman 4y ago

There is also "passage": https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage It's pass with age-encryption instead of pgp. Discussed here: https://news.ycombinator.com/item?id=29597729 https://news.ycombinator.com/item?id=29597729

upofadown 4y ago
The use of age doesn't seem to address any of the stuff in the linked article. At least the use of age would not make things worse in this particular application because pass does not authenticate the saved password files. Age famously can't do authorization for the asymmetrical encryption case.

underlines 4y ago

Using a dictionary, I was able to roll a funny and easy to remember Passphrase that fulfills the 40 character limit. I'm using it ever since for my KeePass file.

yonrg 4y ago
Correct horse battery staple I use that.. so not exactly that ;)