8 ms·
Pass: The standard unix password manager
- slayeright 13y agoThis is awesome, I might even switch from LastPass to this. But I can't brew install it because the pinentry dependency is broken. Great idea though.
- Qantourisc 13y agoIt's a small bash-script, if you have the time add an option to use something else then pinentry ?
- wyager 13y agoWhat's wrong with pinentry? It seems to work OK on my mac.
- pkulak 13y agoWhat's this GPG stuff? Do I just make a key and then I can open any of these files when I'm logged in? How do I go about doing that?
- ecma 13y agoThe script delegates to the GPG binaries where necessary. From the 'Using...' section: "There will be a nice password input dialog using the standard gpg-agent (which can be configured to stay authenticated for several minutes), since all passwords are encrypted." When setting up the pass store, you also specify the identity of a GPG key to use (or set of keys which may be used).
- harrystone 13y agoI've been using this for about a month now and it's great. It's just encrypted text files but that's all it really needs to be.
- YokoZar 13y agoThere's one problem here: by storing passwords in a series of flat files, you give away that a password to a given site or location exists. That alone can be data that a user doesn't want to share. I use a similar (and old) solution using GPG for password management, however it differs in one important way: it stores passwords in a database rather than a series of flat files. If I combine it with private browsing, I can simultaneously store passwords for particular websites while not letting a random trespasser know I even visit them.
- richdougherty 13y agoRight, if pass had a way to have a mini-database within a file that would be great. You could still organise into multiple database files. I guess you could do something with pass's multiline option. What database do you use?
- YokoZar 13y agoI use pwman: http://pwman.sourceforge.net/ http://pwman.sourceforge.net/
- ama729 13y agoAn alternative would be to use KeePass, works very well on linux. It's one file, and that's it. https://en.wikipedia.org/wiki/KeePass https://en.wikipedia.org/wiki/KeePass
- pyritschard 13y agoAn alternative that doesn't leak information on site, very barebones, but you can just drop-it to your .bash_profile or similar https://gist.github.com/pyr/9870029 https://gist.github.com/pyr/9870029
- yason 13y agoI've considered a password management system many times but I can't think of something that's not over-engineered. So, for the last 20 years or so, I just have a single GPG encrypted file that contains the list of my passwords for various sites and services, ssh keys, and whatnot. I usually read and write that file in Emacs, or gpg -o - out to shell with an alias for quick read-only access. The file is easy to backup and easy to distribute even carelessly: I even had it on my public www server at some point when I needed access to the passwords over the network. I can't think of a simpler scheme than that. Of course, the GPG keys themselves can lock and unlock my life completely. I have them in a separate backup file that is also encrypted using GPG but with a symmetric cipher. Thus, I don't depend on any extra files to decrypt my GPG keys. As the passphrase for that symmetrically encrypted file is basically the master password to my life and because I've never needed it yet I store the password in a suitable physical location. But I can still distribute the backup file itself: even obtaining the passphrase to the symmetric cipher doesn't really expose my secrets yet. It will only give access to my GPG keys which in turn need my regularly-used private-key-passphrase to be useful at all.
- corndoge 13y agoI used to do the exact same thing as you, actually -- all the way down to keeping your keys with a symmetric pass & storing that in a secure physical location (for me, a safe deposit box). I switched to pass about a year ago because: -it's the same scheme, the only difference is that your passwords are broken into individual encrypted text files instead of just one (potential SPOF advantage). -it's more secure because you can set it up so your passwords never reach stdout (or any human readable display at all for that matter) with pass -c. -it's just as easy to backup: gpg-zip --symmetric ~/.password-store -pass itself is extremely portable. -pass is way more convenient: pass -c my/password is far quicker and several orders of magnitude less annoying than gpg -dao passwordfile.gpg <unlock private key> <copy password> <kill terminal> <use password> <clear clipboard> Speaking from experience, I would say you're better off using pass than a single gpg'd text file.
- yason 13y agoThanks for the comprehensive comparison. Pass does have advantages, I think I'll evaluate it myself too. The main selling point is the clipboard support.
- doesnt_know 13y agoI came across Pass when I was looking for a password manager a while ago. I don't use it, but it is responsible for the idea behind my super simple workflow. I have a folder, ~/pass. It contains gpg encrypted text files. They are named by category. So, a product key would be keys.ftl.gpg. A website would be sites.hackernews.gpg. I create and edit files with emacs. It handles gpg files and lets you choose which key to use to encrypt. For random password generation, I use pwgen. That's it. Being files, you can ls and grep to see if you already have an account somewhere or find out the file name that belongs to a site. If you are concerned with "giving away" where you have accounts if the system is compromised, you can create larger generic files like "sites" and then use your text editor to search through them. It's simple, easy to backup via rsync and cross platform because gpg, emacs and pwgen are on every platform. When the SSD in my Linux machine failed I was stuck using Windows for a month while the RMA went through. It was trivial to get up and running with cygwin.
- hengheng 13y agoCan your describe your exact process? How do you plug pwgen into emacs? I know emacs an do things like that, but I never bothered enough to find out if it's as smooth to use as keepass2.
- doesnt_know 13y agoThere would be ways to plug it into emacs, but I don't bother since it's only 1 of 2 or more destinations for the password. Browser usually being the second. pwgen has a bunch of options. They are fairly easy to learn, but you can always alias them out to something descriptive. Usually I have to specify some arbitrary length based on the "recommendation" of the site in question. Eg: pwgen 10 Will poop out a bunch of passwords to the console in columns that are 10 characters long. Probably less then ideal. I usually like to use the secure option and make them as long as the site will allow. To make things easier, you can just make it generate a single password and pipe it to the clipboard. pwgen -s 20 1 | xclip -i LSm4BfnGADLG0WAxStUW Middle click (paste) into emacs and the web browser. Save the file in emacs and submit the browser registration form. Run the pwgen/xclip command again to put a different unused password in your clipboard just in case.
- jon_black 13y agoI use ccrypt to encrypt a file containing my passwords. To find a password you can do: ccat password-file | grep <some-keyword>. Simple and to the point.
- jzelinskie 13y agoIs it really worth it to do this rather than just using the keychain that comes with your OS/DE which fully integrates with your browser's auto fill functionality without extension?
- doesnt_know 13y agoCan you easily back that up and take it across platforms?
- k2enemy 13y agoI recently switched from 1Password to pass (on a mac). At first I missed how easy it was to hit "cmd+\" to fill in a web login form, but I made a little shortcut that has similar functionality. First, I created an automator action that grabs the current URL from Chrome and strips out the hostname. This gets passed to a new Terminal window that runs a shell script that calls "pass -c" for the hostname.[0] Then the script calls terminal-notifier [1] and a notification pops up that reminds me of the username and any other info for that site (but not the password). [2] Then I bind that service to the "cmd+\" keyboard shortcut and I have something that ends up being more reliable than 1password's often flaky form filling functionality. It includes the extra work of entering username manually and pasting in a password, but so far I like this system a lot better. Also, for sites that use the same login from multiple hostnames, I just create symlinks to a "canonical" pass entry. Hope this is useful to some people on a mac! [0] I couldn't figure out how to have pass ask for a gpg pinentry window when it was getting run from a non-interactive shell. So I use automator to create a new terminal window, then destroy it at the end. [1] https://github.com/alloy/terminal-notifier https://github.com/alloy/terminal-notifier [2] all of my pass entries are of the form: password --- username: user other info: foo other info 2: bar
- 3rd3 13y agoI think there are official 1Password browser extensions which allow for the shortcut cmd-# to fill forms automatically.
- deleted 13y ago[deleted]
- king_magic 13y agoThis is useful - thanks for this. I think I'm going to give something like this a try. 1Password has been getting incredibly flakey over the past few years, and I'm just tired of dealing with it (especially in Safari). The reason I stuck with it so long was so that my passwords would easily sync to my iPad/iPhone, but with iCloud Keychain, I think I'm finally ready to give up on 1Password.
- 13y ago
- asuffield 13y agoThis looks cool. There's one piece missing that would make it ideal for me: I want to replicate the encrypted files onto my android tablet and access them from an app there.
- zastavka 13y agoYeah, if there were an Android app I'd try this out in a heartbeat. I use Lastpass currently but I haven't been liking the direction it's recently taken. This seems like a much more elegant solution, but it's a no-go if I can't use it on my phone.
- jsprodc 13y agoCreate a new document in vim, save with the :X command and enter an encryption key. If you open the file afterwards it will ask for the key. I've been using this for years, works like a charm.
- icebraining 13y agoBeware: the default encryption method is very weak and can be brute-forced by anyone who knows a few characters of the original file. Since v7.3, Vim supports Blowfish, which is much stronger. http://vim.wikia.com/wiki/Encryption http://vim.wikia.com/wiki/Encryption
- vesinisa 13y ago> Since v7.3, Vim supports Blowfish, which is much stronger. No. Even the designer of Blowfish thinks you should not use it anymore: https://www.schneier.com/news-048.html https://www.schneier.com/news-048.html
- icebraining 13y agoThat doesn't contradict what I wrote, though. As far as I know, Blowfish hasn't been broken, and while it's theoretically less secure than its successors, it's still a valid choice if you want to use Vim's built-in encryption, which only supports pkzip and blowfish.
- gnuvince 13y agoI use an GPG-encrypted .org file. With Emacs' built-in support to open GPG files, it's simple and convenient.
- dijit 13y agoI do the same with vim, but I suspect this is better for isolation of the database, since you're not unlocking the whole thing every time. also if it starts using hashed versions of hostnames to store files, I don't see why a single file is better.
- helper 13y agoRegardless of what editor you use, be careful that it isn't leaving copies of your passwords other places on your filesystem. For example vim will save your recent yank registers in ~/.viminfo by default. You can avoid this with vim -i NONE or you can chmod your .viminfo to 000.
- daGrevis 13y agoI've been using this for the last couple of months with syncing through Dropbox and it works just fine! For quicker password access, one should try passmenu[0]. It's a dmenu-based menu with all the entries and selecting one copies password to your clipboard. [0] https://github.com/cdown/passmenu https://github.com/cdown/passmenu
- caio1982 13y agoHonest question: despite work-related stuff (like, for a sysadmin or whatever), in a personal scenario how many passwords do you guys have to manage so it's worth using an app for that? I only have 5 active (and other 2 old) entirely different passwords for types of usage and each have between 13-18 chars with capitals, numbers and all the shit. I just store them in my mind. What's the real/basic use case for passwords managers?
- riffraff 13y agoApparently, i have 887 entries in the osx keychain. Mind you, some sites show up multiple times. I try to use a different password for each new account. Since the password manager handles the credentials for me it's not much more effort than reusing the same login/password everywhere.
- droptableusers 13y agoI have 25 passwords managed by pass, all personal and not work related.
- zokier 13y agoPassword reuse is really bad for security. And without password reuse it is easy to see how the number of passwords explode even in moderate use.
- Spittie 13y agoI use a different 32 chars alphanumeric password for every site I'm registered at (http://a.pomf.se/zpubyy.png http://a.pomf.se/zpubyy.png), so it's easy to have 20+ passwords to remember (I have ~35 in my keepass database), which is a bit hard to do without a password manager. I guess the use case is if you're a bit paranoid and want to use a strong/different password for everything.
- vertex-four 13y agoIt's recommended that you have a different password for every site, not just for every type of site. If, for example, someone discovered your forum password, under your system attackers could take over all of your forum accounts. Lots of us sign up for lots of sites to try out things, engage in one-off discussions, etc, so it's pretty necessary to have a password manager. I'll point out that if you creates those passwords yourself, rather than using an entirely random generator, they likely have less entropy than you think, and so are more crackable. A password manager helps with that.
- spektom 13y agoGreat utility, though is less useful than browser extension that makes it easier to store/restore credentials. Also, lack of mobile support would prevent me from switching to it from Lastpass.
- ss64 13y agoThis looks like a very neat tool, but the difficulty with many of these systems is the need to install the password software and have access to a copy of the password data file(s) If you login to many different systems, possibly on different OS platforms, then they all need to be kept in sync every time you change or add a new password. Here I've listed a few other password management options with pros and cons: http://ss64.com/docs/security.html http://ss64.com/docs/security.html
- nox_ 13y agoAnd what exactly is standard about this?
- infinity0 13y agoAny plan on making this follow the "Secret Service" (system keyring) freedesktop standard? Then it will be accessible to programs via libsecret.
- rongenre 13y agoI've been using pass for over a year and am really happy with it, particularly the part which keeps passwords in sync over multiple machines. No mishaps so far. My default behavior with new sites now is to just let pass generate a secure pw and give up any hope of remembering it. And yeah, I'd definitely use a mobile version.
- rafaqueque 13y agoI like this stuff. I'm crazy about terminal utilities and this one is a must, but when it comes to passwords, I have them stored in my head, with a pattern. I can go to a website after 5 years and still remember what I'm supposed to type, so I guess I'll stay with this option. Known issues: - If you're drunk, it's a bit difficult to remember anything - If you're sick, probably won't work properly as well - If you're dead, won't work, 100% sure