3 ms·

I used to do the exact same thing as you, actually -- all the way down to keeping your keys with a symmetric pass & storing that in a secure physical location (

I used to do the exact same thing as you, actually -- all the way down to keeping your keys with a symmetric pass & storing that in a secure physical location (for me, a safe deposit box). I switched to pass about a year ago because: -it's the same scheme, the only difference is that your passwords are broken into individual encrypted text files instead of just one (potential SPOF advantage). -it's more secure because you can set it up so your passwords never reach stdout (or any human readable display at all for that matter) with pass -c. -it's just as easy to backup: gpg-zip --symmetric ~/.password-store -pass itself is extremely portable. -pass is way more convenient: pass -c my/password is far quicker and several orders of magnitude less annoying than gpg -dao passwordfile.gpg <unlock private key> <copy password> <kill terminal> <use password> <clear clipboard> Speaking from experience, I would say you're better off using pass than a single gpg'd text file.

yason 13y ago
Thanks for the comprehensive comparison. Pass does have advantages, I think I'll evaluate it myself too. The main selling point is the clipboard support.
e12e 13y ago
> -pass is way more convenient: > > pass -c my/password > > is far quicker and several orders of magnitude less annoying than > > gpg -dao passwordfile.gpg > <unlock private key> > <copy password> > <kill terminal> > <use password> > <clear clipboard> I agree with your sentiment, but if you keep your passwordfile well-formed, say: site.com username password #assume no spaces in password or username -- or use tabs You could throw something like: gpg -dao passwordfile.gpg|awk "/${1}/ { print \$3 }" | xclip && sleep 15 ; echo XXXXXXXXXXXXXXXXXXXXXXXXXX | xclip In a script. With an agent managing your gpg passphrase (or not, depending on your pranoia) such a scheme would get most of the way there. Not sure why you would want to kill the terminal, but you could just <command-run> or whatever said script... In fact, for clearing your clipboard, just selecting some text should be enough -- but I supppose it might be considered a feature to have it in the script, in case one forgets.

yason 13y ago

Thanks for the comprehensive comparison. Pass does have advantages, I think I'll evaluate it myself too. The main selling point is the clipboard support.

e12e 13y ago

> -pass is way more convenient: > > pass -c my/password > > is far quicker and several orders of magnitude less annoying than > > gpg -dao passwordfile.gpg > <unlock private key> > <copy password> > <kill terminal> > <use password> > <clear clipboard> I agree with your sentiment, but if you keep your passwordfile well-formed, say: site.com username password #assume no spaces in password or username -- or use tabs You could throw something like: gpg -dao passwordfile.gpg|awk "/${1}/ { print \$3 }" | xclip && sleep 15 ; echo XXXXXXXXXXXXXXXXXXXXXXXXXX | xclip In a script. With an agent managing your gpg passphrase (or not, depending on your pranoia) such a scheme would get most of the way there. Not sure why you would want to kill the terminal, but you could just <command-run> or whatever said script... In fact, for clearing your clipboard, just selecting some text should be enough -- but I supppose it might be considered a feature to have it in the script, in case one forgets.