Clever uses of pass, the Unix password manager

Re:Clever uses of pass, the Unix password manager by HotHotLava on Thursday December 16, 2021 @11:03AM (#29579567)

As a user, I also often feel like `gpg` brings a lot of annoying accidental complexity to `pass`, (like the need to "ultimately trust" keys before they become usable) but on the other hand it enables integration with hardware tokens like Yubikeys and in extension mobile devices (via openkeychain) that as far as I know wouldn't be possible with a more modern age-based backend.

[ Parent | on HN ]

Re:Clever uses of pass, the Unix password manager by upofadown on Thursday December 16, 2021 @05:10PM (#29584687)

>like the need to "ultimately trust" keys before they become usable

Did you have to do that manually at one time? All the keypairs that I make start out that way when created.

When creating a keypair for pass all you have to do is generate the key using defaults while remembering a bit of the user ID to give to pass.

[ Parent | on HN ]

Re:Clever uses of pass, the Unix password manager by HotHotLava on Thursday December 16, 2021 @07:01PM (#29585770)

Yes, every time I want to set it up on a new device I have to import and trust all public keys that it should encode to; and if that device gets its own gpg key then that key also has to be distributed to and trusted at all prior sites. Which isn't very often, but still somewhat regularly (ie. new laptop, new yubikey, formatted hard drive, etc.)

I think it would be a great addition if pass could actually automate this by storing all relevant public keys internally.

[ Parent | on HN ]

Re:Clever uses of pass, the Unix password manager by upofadown on Thursday December 16, 2021 @09:40PM (#29587042)

Ah, yes that is a nuisance. GPG has the "--export-ownertrust" and "--import-ownertrust" commands to make that sort of thing less tedious.

In general I think you are supposed to only have a one or a few "ultimately trusted" keys and then distribute that trust by signing the rest. So once you change the trust on one key the trust distributes automatically.

[ Parent | on HN ]

Re:Clever uses of pass, the Unix password manager by loulouxiv on Thursday December 16, 2021 @06:26PM (#29585469)

I had to do it when importing keys on another device

[ Parent | on HN ]

Re:Clever uses of pass, the Unix password manager by GekkePrutser on Thursday December 16, 2021 @03:35PM (#29583520)

Yep the integration with Yubikey is amazing. Both on mobile and desktop <3

[ Parent | on HN ]

Re:Clever uses of pass, the Unix password manager by yepguy on Thursday December 16, 2021 @03:59PM (#29583843)

https://github.com/str4d/age-plugin-yubikey

[ Parent | on HN ]

Re:Clever uses of pass, the Unix password manager by beagle3 on Thursday December 16, 2021 @01:27PM (#29581824)

SSH has included file encryption for a few versions now, and iirc supports yubikeys — probably would be more useful a backend than age.

[ Parent | on HN ]

Re:Clever uses of pass, the Unix password manager by tialaramex on Thursday December 16, 2021 @02:46PM (#29582904)

> SSH has included file encryption for a few versions now

Mmm. I don't think so. Recent OpenSSH includes file signatures not encryption.

[ Parent | on HN ]

Re:Clever uses of pass, the Unix password manager by beagle3 on Saturday December 18, 2021 @01:52AM (#29602354)

Ahh, you are correct, I misremembered.

[ Parent | on HN ]