5 ms·

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to

by ghoul2 13y ago

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to use. Until I came across this: http://www.zx2c4.com/projects/password-store/ http://www.zx2c4.com/projects/password-store/ It is simply the easiest, most intuitive password manager out there. One of those things that, once you come across them, you wonder why it took so long for something this logical to come into existence. I am not associated with the project, but these are just a few things I love about "pass" 1. Command-line based: which means I can script it, I can run it remotely, etc. 2. Uses Git to store the passwords: full revision history, changelog, and remote push/sync features that git is SO good at. Other password managers have to reinvent that whole wheel and none seems to do a good job. This also eliminates the need for "hosted" solutions - which I just simply refuse to use. 3. GPG for password encryption: once again, such a natural, awesome way to do things. GPG is already the safest way practical way to secure data-at-rest. I can rest easy that no silly homegrown encryption system was invented. Also, as long as I have the keys, in the worst case I can do the decryption myself, if I do not have access to "pass". The only thing I believe it might lack is the fact that the names of the entries are in the clear. Which means I cannot setup a github(private) repository as remote for my pass store: the passwords themselves would still be gpg encrypted, thus safe, but the repository will leak names of all websites and userIDs. In anycase, kudos and thanks to the devs!

mrsteveman1 13y ago
Indeed, I love pass. I found that the majority of the time, typing 'pass <servicename>' is faster than clicking through a GUI anyway, and far more convenient if I'm already in the terminal. And on the web, all the other password managers have browser extensions to autofill data from their own database, but every common browser already does password storage and autofill natively. So once I grab a password from pass the browser remembers it anyway, making extensions unnecessary. Oh, and the other thing I LOVE about pass is that because it uses GPG, the key encrypting all the data can be held in a nice portable smartcard, since GPG supports them directly, and it all just works when my smartcard is plugged in. I use a yubikey neo with openpgpcard applet for this and it's been great. I did start writing an OS X dropdown menu for accessing my passwords from pass, but I haven't been in such a hurry to get it done because it doesn't seem all that necessary in practice :)
- Bassetts 13y ago
  As someone who does not have my browser remember my passwords I find the auto fill feature of KeePass a necessity.
BorisMelnik 13y ago
you make some really good points, as a programmer/scripter but for most end users and consumers they need something intuitive and keeppass is just that. personally I've used roboform now for over 5 years and have never been so happy to pay a yearly subscription fee. stores notes/passwords etc.
- ghoul2 13y ago
  I agree. As a programmer/admin, my password storage needs are different than that of an average enduser. Security of my passwords, keys, etc is also significantly more critical and failure cause much more damage. So while KeePass/Lastpass etc might work for an average end user, they suck for my usage scenario. Never used roboform - its not available for linux, so can't comment there.
ygra 13y ago
I think just pressing a hotkey to auto-type the correct password and username based on the currently active web page, program, window, etc. is easier still than opening a terminal and running a command. To me at least.
- weland 13y ago
  Unfortunately, that's useless if you need to store passwords for anything other than web use, if you need to automate the entering of passwords and so on.
  - ygra 13y ago
    I routinely use it for entering passwords to SSH or RDP sessions, and various other non-web passwords. Why would auto-type work only on the web anyway? You can also customise how the password is entered depending on where you invoke auto-type, e.g. if you need username/password, separated with a tab key in one place, but only the password in another.
    - weland 13y ago
      Oh, I didn't know that. Sorry!
- ghoul2 13y ago
  Well, I always have guake running, so for me doing it all on the command-line is WAY faster and more convenient. I forgot to mention that "pass" also has command line completion - which makes retrieval trivial. I would also be surprised if someone somewhere hasn't already written an "autotype" layer over pass, but thats not something I am personally interested in. I do agree that for end users this may not be the case. For non-technical people (my parents, for example), I mostly recommend writing their passwords down on paper. They have very few passwords as-it-is, and almost none of them are critical. My own use case, where I have literally hundreds of pieces of info I need to secure (passwords, key-files, gpg keys, ssh keys, etc), is very different from that of such users. Hence different tools. Oh, also, "pass" can copy the password to the clipboard, making the copy-paste scenario trivial. In fact, it goes even further by clearing the pass from the clipboard after a preset time.
revasm 13y ago
> the passwords themselves would still be gpg encrypted, thus safe, but the repository will leak names of all websites and userIDs. Consider encrypting the filenames with Fuse+EncFS. This flaw is pretty huge elsewise; it's why I changed to using gnupg.vim+SublimeGPG.
- ghoul2 13y ago
  I went with using a small truecrypt volume mounted at .password-store.
hanru 13y ago
Looks interesting and geeky. Will definitely try this someday. Thanks for the recommendation.
xr09 13y ago
We use Keepass at work, but pass is beautiful, the unix way, I'll use it for my personal passwords.
BCM43 13y ago
assword is similar. http://finestructure.net/assword/ http://finestructure.net/assword/

by ghoul2 13y ago

mrsteveman1 13y ago

Indeed, I love pass. I found that the majority of the time, typing 'pass <servicename>' is faster than clicking through a GUI anyway, and far more convenient if I'm already in the terminal. And on the web, all the other password managers have browser extensions to autofill data from their own database, but every common browser already does password storage and autofill natively. So once I grab a password from pass the browser remembers it anyway, making extensions unnecessary. Oh, and the other thing I LOVE about pass is that because it uses GPG, the key encrypting all the data can be held in a nice portable smartcard, since GPG supports them directly, and it all just works when my smartcard is plugged in. I use a yubikey neo with openpgpcard applet for this and it's been great. I did start writing an OS X dropdown menu for accessing my passwords from pass, but I haven't been in such a hurry to get it done because it doesn't seem all that necessary in practice :)

Bassetts 13y ago
As someone who does not have my browser remember my passwords I find the auto fill feature of KeePass a necessity.

BorisMelnik 13y ago

you make some really good points, as a programmer/scripter but for most end users and consumers they need something intuitive and keeppass is just that. personally I've used roboform now for over 5 years and have never been so happy to pay a yearly subscription fee. stores notes/passwords etc.

ghoul2 13y ago
I agree. As a programmer/admin, my password storage needs are different than that of an average enduser. Security of my passwords, keys, etc is also significantly more critical and failure cause much more damage. So while KeePass/Lastpass etc might work for an average end user, they suck for my usage scenario. Never used roboform - its not available for linux, so can't comment there.

ygra 13y ago

I think just pressing a hotkey to auto-type the correct password and username based on the currently active web page, program, window, etc. is easier still than opening a terminal and running a command. To me at least.

weland 13y ago
Unfortunately, that's useless if you need to store passwords for anything other than web use, if you need to automate the entering of passwords and so on.
- ygra 13y ago
  I routinely use it for entering passwords to SSH or RDP sessions, and various other non-web passwords. Why would auto-type work only on the web anyway? You can also customise how the password is entered depending on where you invoke auto-type, e.g. if you need username/password, separated with a tab key in one place, but only the password in another.
  - weland 13y ago
    Oh, I didn't know that. Sorry!
ghoul2 13y ago
Well, I always have guake running, so for me doing it all on the command-line is WAY faster and more convenient. I forgot to mention that "pass" also has command line completion - which makes retrieval trivial. I would also be surprised if someone somewhere hasn't already written an "autotype" layer over pass, but thats not something I am personally interested in. I do agree that for end users this may not be the case. For non-technical people (my parents, for example), I mostly recommend writing their passwords down on paper. They have very few passwords as-it-is, and almost none of them are critical. My own use case, where I have literally hundreds of pieces of info I need to secure (passwords, key-files, gpg keys, ssh keys, etc), is very different from that of such users. Hence different tools. Oh, also, "pass" can copy the password to the clipboard, making the copy-paste scenario trivial. In fact, it goes even further by clearing the pass from the clipboard after a preset time.

revasm 13y ago

> the passwords themselves would still be gpg encrypted, thus safe, but the repository will leak names of all websites and userIDs. Consider encrypting the filenames with Fuse+EncFS. This flaw is pretty huge elsewise; it's why I changed to using gnupg.vim+SublimeGPG.

ghoul2 13y ago
I went with using a small truecrypt volume mounted at .password-store.

hanru 13y ago

Looks interesting and geeky. Will definitely try this someday. Thanks for the recommendation.

xr09 13y ago

We use Keepass at work, but pass is beautiful, the unix way, I'll use it for my personal passwords.

BCM43 13y ago

assword is similar. http://finestructure.net/assword/ http://finestructure.net/assword/