5 ms·

i’ve used `pass` for 4-ish years now. i stopped last month. the interactions between pass and gpg-agent are too opaque for someone who’s not a regular PGP user.

i’ve used `pass` for 4-ish years now. i stopped last month. the interactions between pass and gpg-agent are too opaque for someone who’s not a regular PGP user. what happens when i let my PGP key expire? what’s the right way to share passwords between multiple machines — can i just clone the ~/.gnupg folder, do i need to `export` and then `import` the keys? should i create subkeys for each machine? i want my password manager to be decently transparent, because if i misunderstand its failure modes that’s a big deal. anyway, i’m using SOPS now [1]. it comes with a different set of tradeoffs (doesn’t integrate with keyrings quite as well as GPG does), but it’s way more transparent and pluggable. i generate distinct pubkey/privkey pairs per logical user and i can grant any subset of keys access to specific secrets. so e.g. my desktop and laptop can decrypt my banking secrets, but my phone cannot. i have a nightly backup cronjob which has to run unattended: i encode my Backblaze API key to the `duplicity` user’s privkey, and can safely check the encoded key into public repos and such. it’s simple and easy to grok. more so than pass, IMHO. 1: https://github.com/mozilla/sops https://github.com/mozilla/sops

robinoh 4y ago
Just add any second or third (sub)key to .gpg-id inside the password-store dir. I use pass with two separate gpg sub-keys loaded on 2 separate Yubi keys. To unlock passwords, I must have one of the yubikey or my backup master key that's on a encrypted usb. It also works over ssh without cloning the pass repo to a separate machine.
mariusor 4y ago
I use multiple keys for encrypting the secrets. It's been going fine for about 5 years and at least two key rotation events. I usually have a key for each device that requires access, sometimes they overlap for all secrets and sometimes they only have access to specific folders (think a work vs. personal separation). It's a high friction environment for sure, but I'm happy with it.
pxc 4y ago
> what happens when i let my PGP key expire? You can't encrypt new passwords to it, but you can still read old ones that are encrypted to it. > what’s the right way to share passwords between multiple machines — can i just clone the ~/.gnupg folder, do i need to `export` and then `import` the keys? should i create subkeys for each machine? if the keys are on a hardware smartcard like a Yubikey, I just reuse the key. if not, I use separate keys for separate hosts and encrypt my pass secrets to all of them using the .gpg-id files > anyway, i’m using SOPS now I think SOPS is awesome, too! it's my favorite way to securely store secrets in IaC projects
fallat 4y ago
Yes you just clone the folder and that's it... I've moved machines several times and this "just works". I think you're making a big mistake leaving pass :). pass is just a UX for PGP. PGP enables a lot more. Learn one and it enables a lot of other things...! As you've been able to see.
- colinsane 4y ago
  > Yes you just clone the folder and that's it... well i think you have to launch gpg-agent and such too. and what channel do the two use to communicate with eachother? do you need PAM configured and running? i was trapped in my initrd earlier, desperately wanting to access my passwords, and when i ran `pass <path/to/file>` it... failed. some "can't connect to gpg-agent" message or something. so then i had to figure out how to interact directly with the GPG utilities. `gpg --decrypt <path/to/.pass/word> --gpg-private-key <path/to/.gnupg/privkeys>` (my rough recollection) was giving me obscure errors. i stumbled across some random stack overflow post telling me to use `--pinentry-mode=loopback`: i guess it wanted to show me a x11 prompt and couldn't because X wasn't running? or maybe it was some PAM thing? idk. reading passwords off an unbootable system is a super edgecase but somebody you'll find yourself in an unexpected situation and you _really don't want to have to worry about how to get out of it_ when it comes to something as critical as a password database. if you know the ins and outs of GPG, you're probably fine. if you don't, something with fewer interactions might make more sense.

robinoh 4y ago

Just add any second or third (sub)key to .gpg-id inside the password-store dir. I use pass with two separate gpg sub-keys loaded on 2 separate Yubi keys. To unlock passwords, I must have one of the yubikey or my backup master key that's on a encrypted usb. It also works over ssh without cloning the pass repo to a separate machine.

mariusor 4y ago

I use multiple keys for encrypting the secrets. It's been going fine for about 5 years and at least two key rotation events. I usually have a key for each device that requires access, sometimes they overlap for all secrets and sometimes they only have access to specific folders (think a work vs. personal separation). It's a high friction environment for sure, but I'm happy with it.

pxc 4y ago

> what happens when i let my PGP key expire? You can't encrypt new passwords to it, but you can still read old ones that are encrypted to it. > what’s the right way to share passwords between multiple machines — can i just clone the ~/.gnupg folder, do i need to `export` and then `import` the keys? should i create subkeys for each machine? if the keys are on a hardware smartcard like a Yubikey, I just reuse the key. if not, I use separate keys for separate hosts and encrypt my pass secrets to all of them using the .gpg-id files > anyway, i’m using SOPS now I think SOPS is awesome, too! it's my favorite way to securely store secrets in IaC projects

fallat 4y ago

Yes you just clone the folder and that's it... I've moved machines several times and this "just works". I think you're making a big mistake leaving pass :). pass is just a UX for PGP. PGP enables a lot more. Learn one and it enables a lot of other things...! As you've been able to see.

colinsane 4y ago
> Yes you just clone the folder and that's it... well i think you have to launch gpg-agent and such too. and what channel do the two use to communicate with eachother? do you need PAM configured and running? i was trapped in my initrd earlier, desperately wanting to access my passwords, and when i ran `pass <path/to/file>` it... failed. some "can't connect to gpg-agent" message or something. so then i had to figure out how to interact directly with the GPG utilities. `gpg --decrypt <path/to/.pass/word> --gpg-private-key <path/to/.gnupg/privkeys>` (my rough recollection) was giving me obscure errors. i stumbled across some random stack overflow post telling me to use `--pinentry-mode=loopback`: i guess it wanted to show me a x11 prompt and couldn't because X wasn't running? or maybe it was some PAM thing? idk. reading passwords off an unbootable system is a super edgecase but somebody you'll find yourself in an unexpected situation and you _really don't want to have to worry about how to get out of it_ when it comes to something as critical as a password database. if you know the ins and outs of GPG, you're probably fine. if you don't, something with fewer interactions might make more sense.