5 ms·

While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud servi

While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. As long as you understand its limitations pass is nice precisely because it's simple and basically just a wrapper around git + gnupg. In comparison, most cloud password managers don't have these specific issues, but they are also very likely less secure in other ways.

nixpulvis 4y ago
I know there are people who wrap their entire PASSWORD_STORE in another layer of encryption (ideally through the filesystem) to solve this. But it can be cumbersome to maintain wrappers.
- deleted 4y ago
  [deleted]
gruez 4y ago
>While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? >I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. How are people using pass then? Do they only keep one copy of their password database on their computer? Are they manually copying loose files between their devices?
- resoluteteeth 4y ago
  I said github, not git. You don't need to use a cloud service to use git for synchronization.
  - gruez 4y ago
    You don't, but are people really manually running "git pull" between their various devices, or are they using a (self) hosted git service? Even in the self hosted case, I wouldn't want the security of all my passwords to be dependent on my $5/month VPS not being compromised.
    - eptcyka 4y ago
      I believe that people do just sync got repos between machines. 5$ VPSes, Raspberry Pi's, laptops from 2009. Why not? Also, what is there to compromise on a machine that basically runs just sshd with password authentication disabled?
      - gruez 4y ago
        > I believe that people do just sync got repos between machines. 5$ VPSes, Raspberry Pi's, laptops from 2009. Why not? it's a pain because of NAT/port forwarding, not to mention the chore of making sure every device is up to date. You can get around the NAT/port forwarding issue by having a $5 VPS, but then you're essentially storing your password database on dropbox. >Also, what is there to compromise on a machine that basically runs just sshd with password authentication disabled? 1. Same way that dropbox can be compromised: your account gets hacked or the provider gets hacked. 2. While I agree that a server with only sshd and auto-updates enabled would be pretty hard to compromise (foregoing the above), I doubt that's the typical setup. Most people probably have a "general purpose" VPS that they use to host all sorts of stuff, which means there's lots blindly typing in "npm install ..." or even "curl ... | sh" going on.
        resoluteteeth 4y ago
        > it's a pain because of NAT/port forwarding Tailscale or zerotier. It's a solved problem. You don't need to use a vps at all.
        jkepler 4y ago
- phoe-krk 4y ago
  Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. Uploading your whole password tree to a public repository is a bad idea for reasons explicitly mentioned in the article (i.e. pass does not encrypt metadata about the file/directory names, git stores all creation/modification/deletion dates and times).
  - gruez 4y ago
    >Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. I'm not sure whether that's actually better than storing it on github (or any other professionally managed git instance). Sure, you gain some security by obscurity (because your VPS isn't a juicy target like github is), but that's about it. If the FBI is after you, they can send a letter to your VPS provider just like they can send a letter to github. I probably also expect github to do a better job at keeping their systems secure than an amateur sysadmin. In both cases the chance of getting hacked is fairly low, but the whole point of a password manager is that you don't have to rely on the storage service being secure to keep your passwords safe. If you need to rely on the storage service (eg. git server) to be not compromised for your passwords to be safe, then that kills a large benefit of using a password manager.
    - phoe-krk 4y ago
      The VPS does not have my private GPG key, stored locally, and hence cannot use it to decrypt the passwords.
      - gruez 4y ago
        Right, but if an attacker has access to the VPS, it can pull off the various shenanigans that's described in the OP? That's the whole thesis of the article. If you have access to the underlying storage of pass (eg. the git instance if you're using git to sync everything), then you can perform some attacks. The attacks aren't catastrophic (ie. attackers being able to decrypt your passwords with no intervention), but they're still pretty bad nonetheless.
- oats 4y ago
  When I used `pass`, I synced the password store between all my personal devices with Syncthing (non-centralized file syncing tool) and kept the store history with git. This worked surprisingly well and was even pleasantly usable on my phone with a third-party android app I found.
- gnoack 4y ago
  Git over SSH to the Raspberry Pi. You do not need a "hosted" git environment to keep a repo in a central location; a simple Unix account is enough.
monopoliessuck 4y ago
> except for the site names not being encrypted I just use ctmg authored by the same guy and a simple script to open and close both. If you want, you can then throw this anywhere. https://git.zx2c4.com/ctmg/about/ https://git.zx2c4.com/ctmg/about/
avgcorrection 4y ago
> but pass also isn't a cloud service [...] In comparison, most cloud ... cloud cloud cloud The authors recommends KeepassXC instead.

nixpulvis 4y ago

I know there are people who wrap their entire PASSWORD_STORE in another layer of encryption (ideally through the filesystem) to solve this. But it can be cumbersome to maintain wrappers.

deleted 4y ago
[deleted]

gruez 4y ago

>While they're real, most of these issues don't really seem worth worrying about except for the site names not being encrypted, but pass also isn't a cloud service so I'm not convinced that's a big deal? >I guess it's an issue if you're storing the repository in github or backing it up without additional encryption, but I suspect that's not how most people are using it anyway. How are people using pass then? Do they only keep one copy of their password database on their computer? Are they manually copying loose files between their devices?

resoluteteeth 4y ago
I said github, not git. You don't need to use a cloud service to use git for synchronization.
- gruez 4y ago
  You don't, but are people really manually running "git pull" between their various devices, or are they using a (self) hosted git service? Even in the self hosted case, I wouldn't want the security of all my passwords to be dependent on my $5/month VPS not being compromised.
  - eptcyka 4y ago
    I believe that people do just sync got repos between machines. 5$ VPSes, Raspberry Pi's, laptops from 2009. Why not? Also, what is there to compromise on a machine that basically runs just sshd with password authentication disabled?
    - gruez 4y ago
      > I believe that people do just sync got repos between machines. 5$ VPSes, Raspberry Pi's, laptops from 2009. Why not? it's a pain because of NAT/port forwarding, not to mention the chore of making sure every device is up to date. You can get around the NAT/port forwarding issue by having a $5 VPS, but then you're essentially storing your password database on dropbox. >Also, what is there to compromise on a machine that basically runs just sshd with password authentication disabled? 1. Same way that dropbox can be compromised: your account gets hacked or the provider gets hacked. 2. While I agree that a server with only sshd and auto-updates enabled would be pretty hard to compromise (foregoing the above), I doubt that's the typical setup. Most people probably have a "general purpose" VPS that they use to host all sorts of stuff, which means there's lots blindly typing in "npm install ..." or even "curl ... | sh" going on.
      - resoluteteeth 4y ago
        > it's a pain because of NAT/port forwarding Tailscale or zerotier. It's a solved problem. You don't need to use a vps at all.
        jkepler 4y ago
phoe-krk 4y ago
Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. Uploading your whole password tree to a public repository is a bad idea for reasons explicitly mentioned in the article (i.e. pass does not encrypt metadata about the file/directory names, git stores all creation/modification/deletion dates and times).
- gruez 4y ago
  >Use a VPS that uses SSH with key-based authentication, store the git tree of your passwords there. I'm not sure whether that's actually better than storing it on github (or any other professionally managed git instance). Sure, you gain some security by obscurity (because your VPS isn't a juicy target like github is), but that's about it. If the FBI is after you, they can send a letter to your VPS provider just like they can send a letter to github. I probably also expect github to do a better job at keeping their systems secure than an amateur sysadmin. In both cases the chance of getting hacked is fairly low, but the whole point of a password manager is that you don't have to rely on the storage service being secure to keep your passwords safe. If you need to rely on the storage service (eg. git server) to be not compromised for your passwords to be safe, then that kills a large benefit of using a password manager.
  - phoe-krk 4y ago
    The VPS does not have my private GPG key, stored locally, and hence cannot use it to decrypt the passwords.
    - gruez 4y ago
      Right, but if an attacker has access to the VPS, it can pull off the various shenanigans that's described in the OP? That's the whole thesis of the article. If you have access to the underlying storage of pass (eg. the git instance if you're using git to sync everything), then you can perform some attacks. The attacks aren't catastrophic (ie. attackers being able to decrypt your passwords with no intervention), but they're still pretty bad nonetheless.
oats 4y ago
When I used `pass`, I synced the password store between all my personal devices with Syncthing (non-centralized file syncing tool) and kept the store history with git. This worked surprisingly well and was even pleasantly usable on my phone with a third-party android app I found.
gnoack 4y ago
Git over SSH to the Raspberry Pi. You do not need a "hosted" git environment to keep a repo in a central location; a simple Unix account is enough.

monopoliessuck 4y ago

> except for the site names not being encrypted I just use ctmg authored by the same guy and a simple script to open and close both. If you want, you can then throw this anywhere. https://git.zx2c4.com/ctmg/about/ https://git.zx2c4.com/ctmg/about/

avgcorrection 4y ago

> but pass also isn't a cloud service [...] In comparison, most cloud ... cloud cloud cloud The authors recommends KeepassXC instead.