4 ms·
pass We use it because PGP has been through hell and back with security audits. Combined with the fact that everyone gets their own key gives you a lot of cont
by exabrial 4y ago
pass
We use it because PGP has been through hell and back with security audits. Combined with the fact that everyone gets their own key gives you a lot of control over the ecosystem. At the end of the day it's just git + pgp, two bulletproof technologies you probably are already familiar with.
All shared passwords suffer from irrevocability, no matter your password storage solution.
- tomrod 4y agoCan you elaborate on what "pass" is?
- exabrial 4y agoyep: https://www.passwordstore.org https://www.passwordstore.org
- tomrod 4y agoGotcha. Any possibility for sync capability across systems? Similar to the encrypted hidden file solution below, this has risks for hardware/OS failure & online backup cracking. Offline backup solutions are good, but represent some risk as well. (Not that cloud services are risk free either)
- exabrial 4y ago> Any possibility for sync capability across systems? It's a git repository. You can push it to a private github repo shared by your team. You could rsync. You could host the git repository on a flash drive and pass it around. Any method of syncing a git repository will work with password-store! > this has risks for hardware/OS failure & online backup cracking PGP is absolutely battle tested. You'd really have to screw the pooch on password selection to be subjected to a brute force offline attack. Even then, set your s2k-count setting for you PGP keys to something that takes 250ms or more and you'll make it impossible for even a state-level actor to brute force your keys. For the ultra-ultra paranoid, users can keep PGP private keys on a hardware device like a Yubikey. This prevents the keys from ever being leaked (save local side channel attacks, but at the point your long screwed anyway).
- tomrod 4y agoThis is awesome!