6 ms·
There's one problem here: by storing passwords in a series of flat files, you give away that a password to a given site or location exists. That alone can be d
by YokoZar 13y ago
There's one problem here: by storing passwords in a series of flat files, you give away that a password to a given site or location exists. That alone can be data that a user doesn't want to share.
I use a similar (and old) solution using GPG for password management, however it differs in one important way: it stores passwords in a database rather than a series of flat files. If I combine it with private browsing, I can simultaneously store passwords for particular websites while not letting a random trespasser know I even visit them.
- richdougherty 13y agoRight, if pass had a way to have a mini-database within a file that would be great. You could still organise into multiple database files. I guess you could do something with pass's multiline option. What database do you use?
- YokoZar 13y agoI use pwman: http://pwman.sourceforge.net/ http://pwman.sourceforge.net/
- ama729 13y agoAn alternative would be to use KeePass, works very well on linux. It's one file, and that's it. https://en.wikipedia.org/wiki/KeePass https://en.wikipedia.org/wiki/KeePass
- nodata 13y agokeepass database+rw cli access: http://kpcli.sourceforge.net/ http://kpcli.sourceforge.net/
- Leynos 13y agoThanks. This will come in especially handy if I mess up my X driver configuration again. :)
- pacmon 13y agoJust seconding the KeePass notion. It works very well on other platforms as well. This is my preferred option for storing my passwords.
- api_or_ipa 13y agokeypass is only available for Linux systems though an unofficial port. I would be hesitant to adopt security critical applications without developer approval.
- XorNot 13y agoIt's not unofficial - KeePass 2 runs as a Mono app natively. There's a few rough edges, but the developer accepts patches fairly readily.
- ama729 13y agoIt's even in the official Debian/Ubuntu repositories for ages, so I'm not that much worried.
- sparkie 13y agoThe developer doesn't have a public facing repository and instead just dumps the source code for each new version - making it really difficult to see what has actually changed. You can see the commit activity for KeePassX, which would make it more obvious if a bug or malicious snippet might get inserted into it.
- metachris 13y agoKeepassX [1] is available (open source) for OSX, Windows, Linux, with great third party apps for Android, iOS. With the db file in Dropbox it works like a charm across all platforms! [1] http://www.keepassx.org/downloads http://www.keepassx.org/downloads
- api_or_ipa 13y agokeypass is only available for Linux systems though an unofficial port. I would be hesitant to adopt security critical applications without developer approval.
- api_or_ipa 13y agokeypass is only available for Linux systems though an unofficial port. I would be hesitant to adopt security critical applications without developer approval.
- Spittie 13y agoThumbs up for KeePass. I use it with the great PassIFox (https://addons.mozilla.org/en-US/firefox/addon/passifox/ https://addons.mozilla.org/en-US/firefox/addon/passifox/) to get a nice "Fill user/password" in the contextual menu. I also use it on my Android phone with Keepass2Android: https://keepass2android.codeplex.com/ https://keepass2android.codeplex.com/
- endymi0n 13y agoActually, thumbs down for KeePass from me - it's excellent on a multi user system. It totally sucks for a shared password store (like we tried to do in a company) though as you just can't effectively merge binary files in a Git repo. Pass could totally save the day here. I like!
- tvon 13y agoYou might find a site a colleague of mine runs useful: http://www.teampassword.com/ http://www.teampassword.com/
- ycombasks 13y agoSame here, using the official one with Mono. It's a bit buggy, but still works properly most of the time. Do you use keepassx on Linux, and if so, does it work well? KeePass is the program for linux I've found that fills in your details in the browser for you (short of LastPass, which I don't trust).
- Spittie 13y agoI don't use KeePassX. While it run/looks better on Linux (which is my main system), it doesn't support plugins (so no PassIFox, I could live without it but I'm lazy) and the interface is less mature.
- spindritf 13y agoby storing passwords in a series of flat files, you give away that a password to a given site or location exists Those file names are arbitrary. While it's certainly easier to just name them after the site or resource you access with the password within, you can give them some cryptic identifiers.
- jxf 13y agoHow would you remember that <cryptic identifier> corresponds to <your email site>?
- andrelaszlo 13y ago$ pass insert mapping -m :)
- rmc 13y agoSsh used to store "known hosts" in the plain, but they changed it for exactly that reason. Noe it stores the hash of the host your connecting to.
- ghoul2 13y agoI have a (WIP!) fork which fixes this exact problem here at: https://github.com/abgoyal/password-store2 https://github.com/abgoyal/password-store2 Take a look. I am using it personally, Its not in a release-able state yet, though. I have had no time to work on it.
- akjs3786hasd 13y agoCheck out https://github.com/catch22/pw https://github.com/catch22/pw
- rpdillon 13y agoFunny you should mention this. I have a post-in-progress I'm writing about my experiences moving from KeePassX to Pass. I sync my password information online, so Pass has obvious problems. I ended up mounting the Pass directory as an EncFS volume, which still gives up information about how many entries there are, but not what they are. http://www.arg0.net/encfs http://www.arg0.net/encfs