12 ms·
Pa – a simple password manager based on age
- input_sh 4y agoage in question, in case you were as confused as I was by what that means: https://github.com/FiloSottile/age https://github.com/FiloSottile/age
- NikolaNovak 4y agoAhhhh.... so it does not automagically adjust UI complexity and recommendations based on the age (and/or computer skills) of the user? How disappointing and misleading! :->
- iamsaitam 4y agoI thought the same. Title is misleading imho.
- naribe 4y agoAgreed! I came for the meme! ;)
- onionisafruit 4y agoI’m already familiar with this “age”, but I still thought the same when I saw the title.
- deleted 4y ago[deleted]
- Tempest1981 4y agoNew to me. What is the meaning/history/pronunciation of the name?
- mcdonje 4y agoAccording to the github linked in the top level comment, it's pronounced like the Italian "Aghe", which translates to "needles". "Aghe" sounds like "Ah-gay". Not sure why they picked that name.
- worldsavior 4y agoAnother good encryption?
- FiloSottile 4y agoHah, I saw this just after sending a newsletter issue on my password management solution, which is based on passage [1] (a fork of password-store [2] that uses age [3]) and YubiKeys. My age+YubiKeys Password Management Solution — https://words.filippo.io/dispatches/passage/ https://words.filippo.io/dispatches/passage/ The main feature is some protection against post-compromise exfiltration: even if an attacker fully compromises my laptop, they can't extract the whole vault. [1]: https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage [2]: https://www.passwordstore.org https://www.passwordstore.org [3]: https://age-encryption.org https://age-encryption.org
- zikduruqe 4y agoI updated to 1.1.1 yesterday and hope to try with a Yubikey here soon.
- imiric 4y agoVery cool! Thanks for all your work! I was waiting for a solution to store age keys on a security key, and it's great that it's now possible with YubiKeys. I currently use smart cards to store my GPG keys, which works even on Android, as there are some that support NFC, so I can use them with the OpenKeychain and Password Store apps. I need to have passwords available on mobile, as often when I'm traveling I don't want to lug around a laptop. The QR code solution you suggest doesn't seem optimal. Would it be possible to achieve the same workflow with age and NFC YubiKeys? I suppose it would need a native mobile app for that to work.
- FiloSottile 4y agoIf using the OpenPGP applet over NFC is possible, then it's almost certainly possible to use the PIV one with age keys too! The Andorid password-store app is working on an implementation of age in Kotlin (https://github.com/android-password-store/kage https://github.com/android-password-store/kage) and I think they already support passage stores. Maybe you could open a feature request for age-plugin-yubikey compatibility? If you do, feel free to tag me, and I can help make sure the formats are well specified.
- Ciantic 4y agoThere is also Passage by Age's creator Filippo Valsorda: https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage
- deleted 4y ago[deleted]
- ladon86 4y agoWhat would people recommend for backup (perhaps even sync) of the vault?
- zikduruqe 4y agoA bare git repo. I keep mine on a Raspberry Pi at home synced via Tailscale or Wireguard depending on device or the network I'm on. git init --bare Then I can sync it to multiple devices via pull or push.
- j3s 4y agoI use a git repo to keep my passwords synced - then I have a shell alias that makes a commit and pushes it. pretty simple! I have thought about adding git support directly to pa, but I think it's out of scope.
- deleted 4y ago[deleted]
- jrm4 4y agoBecause I'm lazy and you're here. Here's what I do now: Encrypted volume synced with syncthing, everything basically stored as plain text and (like you, i think) a few shell scripts to throw passwords into the clipboard. Would your thing work with a simple synced volume?
- j3s 4y agoyep! pa has absolutely no problem with that.
- jszymborski 4y agomy KeePass vault is backed up with the rest of my files using Borg. I sync between my computers using SyncThing.
- toastal 4y agoIt's been a long times since I saw a nice, clean, legible plaintext README
- mtlmtlmtlmtl 4y ago>pronounced "paw" What? Call it "paw" then. No one is gonna see "pa" and think it's pronounced "paw", and no one is gonna hear you say "paw" and think the invocation is "pa" Why the intentional confusion?
- aconbere 4y agoI would pronounce pa as “paw”, like papa. Would you say it like the a in “apple”?
- nulbyte 4y agoIf papa is a stand-in for father, I'd pronounce it with a long a, as in father. If papa is a stand-in for grandfather, I'd pronounce the first a as in apple, and the second as in paw. But of also spell it papaw. Seeing 'pa' in its own, I'd never think it was pronounced like paw, unless I was reading something written in Hungarian.
- appletrotter 4y agoI pronounce 'pa' like 'paw.' Short for papa I guess. Always have, always will.
- mtlmtlmtlmtl 4y agoNone of the above. No one pronounces "aw" like the a in Apple. And most people do dinstinguish between "a" and "aw" by pronouncing the latter more like the a in "awe".
- FPGAhacker 4y agoMerriam-Webster at least gives one of two possible pronunciations for “pa” as identical to “paw.” https://www.merriam-webster.com/dictionary/pa https://www.merriam-webster.com/dictionary/pa Relevant for the US.
- aconbere 4y agoRight I’m just confused how you would pronounce it. Because I would almost certainly default to saying pa like “awe”.
- yakattak 4y agoThis is interesting. I’ve been using Bitwarden for a long time now but I didn’t realize how convenient a command line password manager would be. Still though, not being integrated with iOS is a non-starter for me but I really like this idea. It would be cool to see the other apps like Bitwarden adopt a CLI to use passwords with other command line tools. Kind of like the Apple Keychain API but easier to work with in a *nix environment.
- davidrusu 4y agoyou're in luck, bitwarden has got a cli see: https://bitwarden.com/help/cli/ https://bitwarden.com/help/cli/
- rollcat 4y agoThe hard part of building a (good) password manager is not actually the encryption backend (gpg, age, etc...), or the frontend (CLI, dmenu, GUI...), or the sync (git, CRDTs, whatever), or even integrating the biometric unlock -- but correctly integrating it with every app and website that expects to take your passwords. AWS console has three fields (account, user, password), most websites will take your password and/or MFA code on a separate page, some apps will use Electron, some will use native widgets, some will use NON-native widgets (like GTK/Qt on Mac/Windows), some apps (like games) will be running in full screen... It's a world of madness and I have huge respect for the password managers that actually try to solve these problems (even if most do it only half-decently).
- TedDoesntTalk 4y ago> integrating it with every app and website Yes, and I would add password device sync for multiple operating systems and browser extensions. Without sync, hundreds of unique, unmemorable passwords are not much value.
- TillE 4y agoThis is precisely why I stopped using KeePass, the browser extensions just weren't good enough. Bitwarden is significantly better, though it also occasionally does the thing where the prompt to save a new password disappears, because of redirects or something.
- latchkey 4y agoI've retrained myself to always just create the account first in BW instead of rely on that prompt mechanism. Once the account is created in BW, you can just auto-fill it into the u/p fields.
- ricardobeat 4y agoI've been using a homegrown solution that is very similar to this, for about three years now. The way I access it is via Blink app on iPad/iPhone, the terminal on mac, WSL on Windows. Copy and paste the password, clear the clipboard (done automatically when using the terminal). It takes a few extra seconds but works anywhere, and I can add password-specific notes for cases like your AWS example. Putting the password in the clipboard is the least safe part, but I definitely prefer this over giving some random app full access to my browser / system.
- woodruffw 4y agoFrom a cursory scan, this looks like it doesn't support key wrapping -- the private key ("identity" in age's parlance) is stored unencrypted on disk. This is arguably a non-issue for most use cases (disk access is "game over" under most threat models), but it's nice to have e.g. for sharing configurations between multiple machines over a public channel (like a dotfiles repository). It would also bring this roughly up to "spec" with what other password managers do (i.e., in terms of requiring a "master" password that unlocks the vault).
- j3s 4y agovery true, and thank you for pointing this out. this is an intentional design decision - you can see me rationale here: https://j3s.sh/thought/storing-passwords-with-age.html https://j3s.sh/thought/storing-passwords-with-age.html it boils down to exactly what you noted - disk access is game over in most cases anyways, and i like the convenience of plaintext on the disk. i will be exploring the yubikey model that filippo recently outlined though https://words.filippo.io/dispatches/passage/ https://words.filippo.io/dispatches/passage/ - so stay tuned! :D
- woodruffw 4y agoThanks for sharing your rationale! I tend to agree -- the practical alternative for Linux anyways is some kind of key agent, and it's unclear to me (having written a few password managers at this point, including an age-based one[1]) that the attacker model for an agent is any different. The only advantage is the "public" channel one I mentioned, and that can of course be done out of band. And since I forgot to say it earlier: excellent work! [1]: https://github.com/woodruffw/kbs2 https://github.com/woodruffw/kbs2
- j3s 4y agowow, extremely cool, ty! i'm excited to play with kbs2 when i find a little free time.
- upofadown 4y agoI don't think age does any real password extension. So if you are used to something that does (GnuPG's 0.1 second extension for example) you might want to add an extra word or two to your passphrase. Pet usability peeve triggered here. If we create a system that completely depends on the strength of a password/passphrase we have to give the user concrete advice on how to create a password/passphrase that will be strong on that particular system.
- tptacek 4y agoPlease stop trolling.
- woodruffw 4y agoI'm not following. This encryption model here is a master private key, so there's no master password involved. Are you referring to the generated passwords? If so, the default seems reasonably long (and is outside of age's scope anyways, since it's just the encrypted content).
- upofadown 4y agoSorry. I missed that. The ultimate security of the saved passwords here depends on the security of the operating system and file system. So I really should of complained that this fact was not made very clear to the user... :)