4 ms·

pass (passwordstore.org) backed by a remote git repo works well across Linux, Windows, macOS, iOS, and Android, as all of them have decent clients available and

pass (passwordstore.org) backed by a remote git repo works well across Linux, Windows, macOS, iOS, and Android, as all of them have decent clients available and there is working browser integration for all popular browsers using browserpass (https://github.com/browserpass/browserpass-extension https://github.com/browserpass/browserpass-extension). The learning curve to understand all the moving pieces and the initial setup can be more hassle than many are willing to put up with, but after the initial legwork is done, adding new devices is not that much more complicated than what it is on paid services, and using it is as simple as any of the popular services, IMHO.

aborsy 3y ago
In my opinion, this is one of the most secure options. Pass is a short bash bash script (very little code). It passes the encryption to a dedicated utility GnuPG (out of which only the AES and cv25519 routines are used). You should use smart card to store the GPG key. Every touch of the security key gives out only one password. So if you copy the HN password, other passwords such as your bank password is not at risk. The missing part is integration with browsers, which increases the attack surface (although it’s minimal here, since only one password is at stake), but protects against phishing. Pass probably doesn’t need an audit, since you can just read the script.
- doubled112 3y ago
  Browserpass works pretty well. https://github.com/browserpass/browserpass-extension https://github.com/browserpass/browserpass-extension
- codethief 3y ago
  > In my opinion, this is one of the most secure options. Only if you disregard that pass doesn't encrypt file names.
  - aborsy 3y ago
    That’s part of the appeal. It allows for sandboxing each password to its own vault essentially (you pay a privacy cost, which I don’t mind anyways, and my disk is encrypted). Gopass does encrypt file names too.
  - chlorion 3y ago
    I don't think this is that big of a deal though. Also, I don't know if other people do this, but I don't actually use the pass scripts, and instead have my own scripts for managing things that just happens to be very similar to pass. I extend it in whatever ways I want to. If I cared about this issue I would probably consider putting the passwords in a file system on a loopback mounted luks volume backed by a regular file, or maybe just store them in a different format altogether. I do realize that the average user doesn't want to bother with all of this and wants something that "just works".
ufo 3y ago
I wish pass wouldn't store website names on cleartext by default.

aborsy 3y ago

In my opinion, this is one of the most secure options. Pass is a short bash bash script (very little code). It passes the encryption to a dedicated utility GnuPG (out of which only the AES and cv25519 routines are used). You should use smart card to store the GPG key. Every touch of the security key gives out only one password. So if you copy the HN password, other passwords such as your bank password is not at risk. The missing part is integration with browsers, which increases the attack surface (although it’s minimal here, since only one password is at stake), but protects against phishing. Pass probably doesn’t need an audit, since you can just read the script.

doubled112 3y ago
Browserpass works pretty well. https://github.com/browserpass/browserpass-extension https://github.com/browserpass/browserpass-extension
codethief 3y ago
> In my opinion, this is one of the most secure options. Only if you disregard that pass doesn't encrypt file names.
- aborsy 3y ago
  That’s part of the appeal. It allows for sandboxing each password to its own vault essentially (you pay a privacy cost, which I don’t mind anyways, and my disk is encrypted). Gopass does encrypt file names too.
- chlorion 3y ago
  I don't think this is that big of a deal though. Also, I don't know if other people do this, but I don't actually use the pass scripts, and instead have my own scripts for managing things that just happens to be very similar to pass. I extend it in whatever ways I want to. If I cared about this issue I would probably consider putting the passwords in a file system on a loopback mounted luks volume backed by a regular file, or maybe just store them in a different format altogether. I do realize that the average user doesn't want to bother with all of this and wants something that "just works".

ufo 3y ago

I wish pass wouldn't store website names on cleartext by default.