News for hackers. Stuff that matters.
Re:Horcrux: A Password Manager for Paranoids by Ajedi32 on Monday June 19, 2017 @12:25PM (#14588135)
Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass.

1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on.

2. No decent browser autofill. Yes, there's browserpass, but as far as I can tell it requires manually searching your password database for the site you're on, which is somewhat inconvenient and doesn't help at all against phishing attacks.

3. No InputStick support. This means if I ever have to enter a password on a computer that doesn't have pass installed, I need to open my password DB on my phone and manually retype the necessary password instead of being able to just auto-type it.

4. No autotype on desktop - This isn't quite as big of a deal, since most programs will let you copy/paste passwords just fine, but as far as I can tell no pass desktop clients include support for auto-typing login credentials. For many non-web apps that require passwords that feature is extremely helpful.

If these ever get fixed, there's a decent chance I'd switch.

Re:Horcrux: A Password Manager for Paranoids by tanderson92 on Monday June 19, 2017 @01:32PM (#14588703)
> 4. No autotype on desktop - This isn't quite as big of a deal, since most programs will let you copy/paste passwords just fine, but as far as I can tell no pass desktop clients include support for auto-typing login credentials. For many non-web apps that require passwords that feature is extremely helpful.

I may not understand what you mean by "autotype on desktop", but I use the dmenu password-store extension which is the executable "passmenu". It allows the command line option "--type" which is quite close I think to what you desire.

Re:Horcrux: A Password Manager for Paranoids by Ajedi32 on Monday June 19, 2017 @01:57PM (#14588913)
Yeah, that's basically what autotype is on KeePass; except KeePass is a bit more flexible since it lets you configure custom autotype sequences (e.g. `<username><tab><password><tab><enter>`) on a per-application basis.

This seems like a fairly decent substitute if you're on Linux. Doesn't look like it'll work on Windows or MacOS though.

Re:Horcrux: A Password Manager for Paranoids by Shoop on Monday June 19, 2017 @02:11PM (#14589032)
rofi-pass (based on rofi, a dmenu alternative) allows for custom autotype sequences.
Re:Horcrux: A Password Manager for Paranoids by haberman on Monday June 19, 2017 @01:31PM (#14588691)
I use KeePassX, but I haven't figured out how to do any of these fancy things. What do you use for browser autofill, InputStick, autotype, etc?

Also how do you store your password file and sync across devices?

And what do you use on iOS? I haven't found a very convenient workflow for my phone. No phone app I've found can keep synced with a password file that's stored on Google Drive.

Re:Horcrux: A Password Manager for Paranoids by Ajedi32 on Monday June 19, 2017 @02:09PM (#14589017)
I'm using KeePass Professional Edition, not KeePassX. Pretty sure they both use the same database format and are both cross-platform, so you should be able to switch pretty easily if KeePassX doesn't do everything you want.

For browser autofill I'm using the KeePassHttp plugin with ChromeIPass.

For InputStick I'm using Keepass2Android with KP2A InputStick.

Autotype is a built-in feature of KeePass on desktop.

Password database is stored on Google Drive, encrypted with a 2-part file and password based key. The file-based component of the key is stored locally offline on all my devices. Changes to the database get synced automatically by Google Drive on my PCs and by Keepass2Android on my phone.

I'm not sure about iOS, unfortunately. My phone is running Android, so I haven't really looked into KeePass clients for iOS.

Re:Horcrux: A Password Manager for Paranoids by haberman on Monday June 19, 2017 @02:34PM (#14589231)
What is KeePass Professional Edition? When I Googled for that the best thing I could find is "Professional Edition" on this page: http://keepass.info/download.html

Is that what you mean? It looks like it's written using Mono for non-Windows platforms. I might have shied away for that reason. What platform do you use it on? I'd love to know if it works well on non-Windows platforms (OS X, Linux).

Re:Horcrux: A Password Manager for Paranoids by Ajedi32 on Monday June 19, 2017 @02:41PM (#14589295)
Yes, that's what I'm referring to. I mostly use it on Windows, so I can't really comment on how well it works on MacOS or Linux. My understanding though is that it's basically a straight port, so most of the same functionality should be available.

Another option you might want to look at is KeePassXC. It's a fork of KeePassX, and it has built-in (though off-by-default) support for keepasshttp.

Re:Horcrux: A Password Manager for Paranoids by gerdesj on Monday June 19, 2017 @06:57PM (#14591053)
"so I can't really comment on how well it works on MacOS or Linux."

Linux: rock solid for several years now. We have several KP databases shared by 20 odd people that contain several thousand entries. I use it on Gentoo and Arch desktops. It runs under Mono plus a few extras to do things like sending links to browsers and autotype etc.

Re:Horcrux: A Password Manager for Paranoids by bumblebeard on Monday June 19, 2017 @02:24PM (#14589137)
Not OP but I do some of these things with KeePass as well.

For autofill, KeeFox works well for me on Firefox - there's probably something similar for Chrome. I think KeePass will do autotype if you right-click on an entry but it's not a feature that I really use so I'm not sure.

I store my password DB in my home folder and use syncthing to synchronize it to my other computers and my phone.

I don't know about iOS but I use KeePassDroid on Android and it works pretty well.

Re:Horcrux: A Password Manager for Paranoids by 0x6c6f6c on Monday June 19, 2017 @12:36PM (#14588225)
1. Check out [pass-tomb](https://github.com/roddhjav/pass-tomb). Unfortunately this only resolves that issue on Linux. Their websites [here](https://www.dyne.org/software/tomb/).

The others are things I've noticed as well, and do wish to see implemented.

Re:Horcrux: A Password Manager for Paranoids by tom4000 on Monday June 19, 2017 @01:08PM (#14588517)
1. In pass everything is encrypted but you have to give names to each gpg encrypted password file.

2. Right. I use rofi-pass on Linux which fills in the selected password or other login data without any clipboard action.

3. True. Never thought about this but sounds clever.

4. Same answer as in 2.

Plus I have a good password history through the git commits. Of course I push it just in my local network.

And I use more then just one password store. And inside you can folder based decide who can decrypt the passwords and who not.

Re:Horcrux: A Password Manager for Paranoids by Ajedi32 on Monday June 19, 2017 @02:30PM (#14589201)
1. Right, that's what I meant; the file and directory names aren't encrypted, which probably reveals which sites you have an account on. Sorry for the confusion.

2. Is that really auto-fill though? Seems more like KeePass's auto-type. I meant like a browser extension that knows what site you're on and fills in the appropriate username/password combo automatically.

4. Cool, that looks like a decent solution for auto-typing. I hadn't heard of that before. Linux-only though from what I can tell, so it won't work for me in the general case.

KeePass has built-in password history too, but I do really like the idea of using git for that; that's one of the reasons why I'm interested in pass.