5 ms·

Best to just use pass (https://www.passwordstore.org/ https://www.passwordstore.org/) with your own gpg key rather than rely on any 3rd party service. Then set

by msravi 4y ago

Best to just use pass (https://www.passwordstore.org/ https://www.passwordstore.org/) with your own gpg key rather than rely on any 3rd party service. Then set up a git repository on a (free) google cloud instance, (or even use github/gitlab), and you're set to sync your passwords to all your devices.

nequo 4y ago
I like this idea. Have you tried setting this up on iOS?
- b0afc375b5 4y ago
  Yes for me. On my iPad, using the Pass - Password Store app.
- heywoodlh 4y ago
  I have and it's fantastic: https://apps.apple.com/us/app/pass-password-store/id1205820573 https://apps.apple.com/us/app/pass-password-store/id12058205...
  - gleenn 4y ago
    Maybe this is terrible logic but I would never trust an app that had 120 reviews and what appears to be a single person as the app owner with all my passwords.
    - heywoodlh 4y ago
      No, I think that logic is completely fair. From my experience it is dead simple and works extremely well, however, I think it's definitely good to vet apps in your own way.
    - definitely-not 4y ago
      [dead]
  - user3939382 4y ago
    Does that work as a password manager provider that you can enable for iOS auto fill?
    - heywoodlh 4y ago
      Yes!
eternityforest 4y ago
That is way too much work. Doing work means stuff is happening and stuff means sidechannel attacks that someone else hasn't audited, because it's not an integrated product anyone would bother auditing. In particular, I don't see how 2FA is possible with this, so shoulder surfing is a bigger issue. I definitely trust Google or BitWarden more than a password I can memorize plus my own constant vigilance.
- zmmmmm 4y ago
  > In particular, I don't see how 2FA is possible with this You can use anything that integrates with GPG ... eg: you can do it with a Yubikey [0] [0] https://support.yubico.com/hc/en-us/articles/360013790259-Using-Your-YubiKey-with-OpenPGP https://support.yubico.com/hc/en-us/articles/360013790259-Us...
  - eternityforest 4y ago
    Ah, I stand corrected, I forgot about trusted hardware based 2FA. Still, it doesn't allow SMS or email based 2FA as far as I can tell, since that involves a trusted server and doesn't mean anything in a trustless model where the server owner could just add a bypass.
- msravi 4y ago
  > In particular, I don't see how 2FA is possible with this Umm, why not? First, you can use a different app (like aegis) to generate OTPs. Second, pass has an extension (https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp) that can be used to generate OTPs. Third, you can use something like oathtool to generate your otp using your totp secret oathtool -b --totp "your-totp-secret"
  - eternityforest 4y ago
    I'm not quite sure I understand this. It seems like a way to generate OTPs, but it doesn't solve requiring a second factor to access the vault.
TheDong 4y ago
This is less secure than using keepassxc, 1password, or another application with a 1st party well maintained browser extension. With keepassxc, 1password, or even chrome's password manager, if a phisher links you to "gmail.scammersite.info", even if it looks exactly like the real gmail login page, browser-integration will not fill in the password field. With pass, the default flow is to copy the password to your clipboard, and paste it into the password field manually. That allows the above phishing attack to succeed. For that reason, I would not rely on password store. If you want to control your own database, use keepassxc, and sync the kdbx file with either git, dropbox, or anything else you like. I am aware password-store technically has browser extensions, but few people use them in practice, and since password-store doesn't have an idiomatic "URI" field for a password, it doesn't actually auto-fill by default in a way that stops the above attack. As a bonus reason, password-store also leaks filenames (entry names), while keepassxc and most other options do not leak the entry name. As another bonus reason, using gpg is a fraught pain in the ass, and it's such a sharp and difficult to use tool that it's actually harder to securely make disaster recovery plans.
- tadfisher 4y ago
  There is a really good browser extension for pass, called BrowserPass. It has auto fill with phishing protection. There is also a good Android app, called Android Password Store, which does the same for all of my apps. Both use GPG keys stored on my Yubikey.
  - isthisthingon99 4y ago
    how do you use yubikey with android?
    - lalopalota 4y ago
      NFC or USB-OTG adapter.
  - NilsIRL 4y ago
    I wrote a little tool to sync my passwords on pass with Firefox passwords which enables that (differently). https://github.com/NilsIrl/pass-fxa/ https://github.com/NilsIrl/pass-fxa/
maccard 4y ago
This reintroduces phishing vulnerabilities that current password managers don't have, leaks metadata (which is exactly what's been verified to have happened with lastpass), requires separate management of your gpg keys, and lastly, hosting in git doesn't sync. If two devices change the same password file, you can't merge that.

by msravi 4y ago

nequo 4y ago

I like this idea. Have you tried setting this up on iOS?

b0afc375b5 4y ago
Yes for me. On my iPad, using the Pass - Password Store app.
heywoodlh 4y ago
I have and it's fantastic: https://apps.apple.com/us/app/pass-password-store/id1205820573 https://apps.apple.com/us/app/pass-password-store/id12058205...
- gleenn 4y ago
  Maybe this is terrible logic but I would never trust an app that had 120 reviews and what appears to be a single person as the app owner with all my passwords.
  - heywoodlh 4y ago
    No, I think that logic is completely fair. From my experience it is dead simple and works extremely well, however, I think it's definitely good to vet apps in your own way.
  - definitely-not 4y ago
    [dead]
- user3939382 4y ago
  Does that work as a password manager provider that you can enable for iOS auto fill?
  - heywoodlh 4y ago
    Yes!

eternityforest 4y ago

That is way too much work. Doing work means stuff is happening and stuff means sidechannel attacks that someone else hasn't audited, because it's not an integrated product anyone would bother auditing. In particular, I don't see how 2FA is possible with this, so shoulder surfing is a bigger issue. I definitely trust Google or BitWarden more than a password I can memorize plus my own constant vigilance.

zmmmmm 4y ago
> In particular, I don't see how 2FA is possible with this You can use anything that integrates with GPG ... eg: you can do it with a Yubikey [0] [0] https://support.yubico.com/hc/en-us/articles/360013790259-Using-Your-YubiKey-with-OpenPGP https://support.yubico.com/hc/en-us/articles/360013790259-Us...
- eternityforest 4y ago
  Ah, I stand corrected, I forgot about trusted hardware based 2FA. Still, it doesn't allow SMS or email based 2FA as far as I can tell, since that involves a trusted server and doesn't mean anything in a trustless model where the server owner could just add a bypass.
msravi 4y ago
> In particular, I don't see how 2FA is possible with this Umm, why not? First, you can use a different app (like aegis) to generate OTPs. Second, pass has an extension (https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp) that can be used to generate OTPs. Third, you can use something like oathtool to generate your otp using your totp secret oathtool -b --totp "your-totp-secret"
- eternityforest 4y ago
  I'm not quite sure I understand this. It seems like a way to generate OTPs, but it doesn't solve requiring a second factor to access the vault.

TheDong 4y ago

This is less secure than using keepassxc, 1password, or another application with a 1st party well maintained browser extension. With keepassxc, 1password, or even chrome's password manager, if a phisher links you to "gmail.scammersite.info", even if it looks exactly like the real gmail login page, browser-integration will not fill in the password field. With pass, the default flow is to copy the password to your clipboard, and paste it into the password field manually. That allows the above phishing attack to succeed. For that reason, I would not rely on password store. If you want to control your own database, use keepassxc, and sync the kdbx file with either git, dropbox, or anything else you like. I am aware password-store technically has browser extensions, but few people use them in practice, and since password-store doesn't have an idiomatic "URI" field for a password, it doesn't actually auto-fill by default in a way that stops the above attack. As a bonus reason, password-store also leaks filenames (entry names), while keepassxc and most other options do not leak the entry name. As another bonus reason, using gpg is a fraught pain in the ass, and it's such a sharp and difficult to use tool that it's actually harder to securely make disaster recovery plans.

tadfisher 4y ago
There is a really good browser extension for pass, called BrowserPass. It has auto fill with phishing protection. There is also a good Android app, called Android Password Store, which does the same for all of my apps. Both use GPG keys stored on my Yubikey.
- isthisthingon99 4y ago
  how do you use yubikey with android?
  - lalopalota 4y ago
    NFC or USB-OTG adapter.
- NilsIRL 4y ago
  I wrote a little tool to sync my passwords on pass with Firefox passwords which enables that (differently). https://github.com/NilsIrl/pass-fxa/ https://github.com/NilsIrl/pass-fxa/

maccard 4y ago

This reintroduces phishing vulnerabilities that current password managers don't have, leaks metadata (which is exactly what's been verified to have happened with lastpass), requires separate management of your gpg keys, and lastly, hosting in git doesn't sync. If two devices change the same password file, you can't merge that.