News for hackers. Stuff that matters.

A comment on Clever uses of pass, the Unix password manager. Parent comment

Re:Clever uses of pass, the Unix password manager by jamal-kumar on Thursday December 16, 2021 @09:47AM (#29578635)
As much as I love Jason Donenfeld's work, I tried to use pass and the gpg requirement just rubbed me the wrong way. It's basically just gpg-encrpyting a text file and unlocking that along with some wrappers for basic password manager functionality (I guess most important is clipboard functionality and clearing it automatically after some seconds), but somehow that seems like a weak point to me. It's a whole lot of reliance on one extremely bloated suite of applications when I feel like something standalone and about as compact would be better somehow.
[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by HotHotLava on Thursday December 16, 2021 @11:03AM (#29579567)
As a user, I also often feel like `gpg` brings a lot of annoying accidental complexity to `pass`, (like the need to "ultimately trust" keys before they become usable) but on the other hand it enables integration with hardware tokens like Yubikeys and in extension mobile devices (via openkeychain) that as far as I know wouldn't be possible with a more modern age-based backend.
[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by upofadown on Thursday December 16, 2021 @05:10PM (#29584687)
>like the need to "ultimately trust" keys before they become usable

Did you have to do that manually at one time? All the keypairs that I make start out that way when created.

When creating a keypair for pass all you have to do is generate the key using defaults while remembering a bit of the user ID to give to pass.

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by HotHotLava on Thursday December 16, 2021 @07:01PM (#29585770)
Yes, every time I want to set it up on a new device I have to import and trust all public keys that it should encode to; and if that device gets its own gpg key then that key also has to be distributed to and trusted at all prior sites. Which isn't very often, but still somewhat regularly (ie. new laptop, new yubikey, formatted hard drive, etc.)

I think it would be a great addition if pass could actually automate this by storing all relevant public keys internally.

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by upofadown on Thursday December 16, 2021 @09:40PM (#29587042)
Ah, yes that is a nuisance. GPG has the "--export-ownertrust" and "--import-ownertrust" commands to make that sort of thing less tedious.

In general I think you are supposed to only have a one or a few "ultimately trusted" keys and then distribute that trust by signing the rest. So once you change the trust on one key the trust distributes automatically.

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by loulouxiv on Thursday December 16, 2021 @06:26PM (#29585469)
I had to do it when importing keys on another device
[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by GekkePrutser on Thursday December 16, 2021 @03:35PM (#29583520)
Yep the integration with Yubikey is amazing. Both on mobile and desktop <3
[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by yepguy on Thursday December 16, 2021 @03:59PM (#29583843)
https://github.com/str4d/age-plugin-yubikey
[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by beagle3 on Thursday December 16, 2021 @01:27PM (#29581824)
SSH has included file encryption for a few versions now, and iirc supports yubikeys — probably would be more useful a backend than age.
[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by tialaramex on Thursday December 16, 2021 @02:46PM (#29582904)
> SSH has included file encryption for a few versions now

Mmm. I don't think so. Recent OpenSSH includes file signatures not encryption.

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by beagle3 on Saturday December 18, 2021 @01:52AM (#29602354)
Ahh, you are correct, I misremembered.
[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by vngzs on Thursday December 16, 2021 @04:12PM (#29583987)
Besides that, pass leaks metadata.

If your passwords are the only part of your password manager you think are secret, then you're probably not considering the utility of an enumeration of all your network handles. Mine aren't very interesting, but I wouldn't post that on GitHub, even in a private repo.

I love pass and use it. But when I need to carry my password database around, I don't rely on pass alone - I throw the pass database in a Veracrypt container. That way if my flash drive is stolen, it's just an encrypted blob.

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by karlding on Thursday December 16, 2021 @09:38PM (#29587034)
There's also the pass-tomb extension [0] which stores the directory in a tomb [1].

[0] https://github.com/roddhjav/pass-tomb

[1] https://www.dyne.org/software/tomb/

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by ayushnix on Friday December 17, 2021 @12:01AM (#29587989)
Besides pass-tomb, there's also pass-coffin which doesn't need to rely on a 3k+ line ZSH script. I'll add support for using age and signify in pass-coffin soon.

https://github.com/ayushnix/pass-coffin

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by yepguy on Thursday December 16, 2021 @10:24AM (#29579053)
A few pass-related projects are working on an age[1] backend in addition to gpg. I think gopass already has support for it.

[1]: https://age-encryption.org/

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by zikduruqe on Thursday December 16, 2021 @10:47AM (#29579353)
Here's one I have been playing with success.

https://github.com/chrisswanda/passage

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by tex0 on Thursday December 16, 2021 @11:19AM (#29579805)
Correct. Gopass has very early age support. It fully works but the UX is not great (yet).
[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by pqb on Thursday December 16, 2021 @11:52AM (#29580328)
Oh dammit. I have stopped using Gopass and rewrote pass just for that reason - missing AGE encryption. At least I have learned something new and I feel I have better UI - fuzzy finder instead of their TUI. However, big kudos to Gopass team for awesome work and really useful tool.

Before I start working on next project... Do you recognize any mobile app, which could replace PasswordStore app for Android [0] but with AGE support?

[0]: https://github.com/android-password-store/Android-Password-S...

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by yepguy on Thursday December 16, 2021 @12:05PM (#29580518)
Android Password Store itself is keen to add age support[1], but I don't know of anything usable right now. You could probably use gopass in termux in the mean time.

[1]: https://github.com/android-password-store/Android-Password-S...

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by pqb on Friday December 17, 2021 @06:30AM (#29590799)
Oh, that's an awesome news. Thank you!
[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by cobby on Thursday December 16, 2021 @03:00PM (#29583128)
> missing AGE encryption

I am just curious. What makes AGE backend better than GPG one?

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by pqb on Friday December 17, 2021 @06:46AM (#29590926)
As yepguy mentioned AGE is simpler. I can also mention few things:

- It works smoothly with SSH keys (generated from ssh-keygen), which are perfectly recognized by possibly any developer.

- No need for external client, such as GpgWin/Kleopatra for Windows.

- Embed-able in Rust[0] and Go[1] (there are libraries), no need to call `gpg --decrypt ...` from the command line.

- Encrypted files by pass and keys are smaller. I guess it is thanks to ecliptic-curve encryption.

[0]: https://github.com/str4d/rage

[1]: https://github.com/FiloSottile/age

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by yepguy on Thursday December 16, 2021 @04:03PM (#29583883)
Age is much simpler to use in nearly every way, whether that's interactively (keys are just files!), in scripting, or in implementation.

I'm still sticking to gpg for the foreseeable future, but between age and sequoia[1] I'm hopeful that things will soon be much easier to use.

[1]: https://sequoia-pgp.org/

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by rank0 on Thursday December 16, 2021 @11:09AM (#29579657)
I get what you’re saying but it’s just different philosophies no?

Seems like pass wants to use the Unix philosophy of “do one thing well” so it relies on gpg for encryption instead of rolling its own.

[ Parent | on HN ]
Re:Clever uses of pass, the Unix password manager by ayushnix on Thursday December 16, 2021 @11:57PM (#29587949)
FWIW, adding support for age in pass is listed as one of the goals of age. I'm considering sending an upstream patch in pass to support age and signify as well.
[ Parent | on HN ]