4 ms·

In that sense pass is no different from other password managers. What prevents the user of an "online" password manager from storing the passwords offline, reme

• lucb1e 2y ago
  Not sure what cookies have to do with it. If we would use a system where the client software only obtains the secret that the user is asking for, it can later say which credentials were accessed and thus need to be rotated when the employee leaves. If session cookies are still usable by an employee whose account was deleted, that's a vulnerability...
• usr1106 2y ago
  For online password managers it requires bad intent from the employee and manual work. For pass it's normal practice that everyone has a copy of the whole store. However, in reality the difference is probably marginal: The majority of the (ex-)employees has no bad intent and couldn't care less about old company stuff once they leave or change roles. Those who plan to do something bad, will also keep copies of passwords from an online system. To be safe you must rotate once someone leaves or trust your firewall. pass supports different access in different parts of the repo, just use different .gpg-id files. But the whole system is kind of geeky. If you employ others than hackers familiar with the command line, gpg and git, it's not really an option.