4 ms·
I can only say that using pass (https://www.passwordstore.org/ https://www.passwordstore.org/) is an absolute nightmare, in case anyone else is considering that
by lucb1e 2y ago
I can only say that using pass (https://www.passwordstore.org/ https://www.passwordstore.org/) is an absolute nightmare, in case anyone else is considering that
It seems like perfect simplicity built on time-tested cryptography: store pgp-encrypted files in a git repository. We already had an internal git server and used PGP internally, it was the perfect marriage. The tool provides the common functions like selecting which colleagues to encrypt for, finding an entry and copying it to clipboard... but think of the moment your organization changes. Everyone has access to everything offline, which is great if you need it in a rainforest or when the server is down, but also you'd need to rotate all exposed-to-them entries whenever someone leaves. Re-encrypting everything to remove an old key is pointless because the git history will provide an attacker with whatever version they need.
Offline access is useful for selected credentials (like the disk unlock password for some central servers) but, to avoid unnecessary rotations, should not be the default unless you're a sysadmin mentioned on disaster recovery team
Skimming the recommendations, so far there are no tools mentioned that don't require maintaining another service or that can't read your data. At least pass had that going for it
- Dibby053 2y agoIn that sense pass is no different from other password managers. What prevents the user of an "online" password manager from storing the passwords offline, remembering them, or not logging out and reusing cookies? You have to rotate the credentials themselves anyway.
- lucb1e 2y agoNot sure what cookies have to do with it. If we would use a system where the client software only obtains the secret that the user is asking for, it can later say which credentials were accessed and thus need to be rotated when the employee leaves. If session cookies are still usable by an employee whose account was deleted, that's a vulnerability...
- usr1106 2y agoFor online password managers it requires bad intent from the employee and manual work. For pass it's normal practice that everyone has a copy of the whole store. However, in reality the difference is probably marginal: The majority of the (ex-)employees has no bad intent and couldn't care less about old company stuff once they leave or change roles. Those who plan to do something bad, will also keep copies of passwords from an online system. To be safe you must rotate once someone leaves or trust your firewall. pass supports different access in different parts of the repo, just use different .gpg-id files. But the whole system is kind of geeky. If you employ others than hackers familiar with the command line, gpg and git, it's not really an option.
- poincaredisk 2y agoStrong disagree - I use pass and I love it. I switched from keepass and not looking back. I guess it's for personal use, never tried using it in a company.
- lucb1e 2y agoSure, I see what you like about it for personal use: nearly all downsides we ran into are sharing-related