Passage: A fork of password-store that uses age instead of GnuPG

Re:Passage: A fork of password-store that uses age instead o... by darkwater on Saturday December 18, 2021 @02:46AM (#29602624)

But in the "age binary replaced" threat scenario, isn't just gameover even with hardware keys? Eg. the same exact age code with an extra call after the print password to stdout that uploads it somewhere?

[ Parent | on HN ]

Re:Passage: A fork of password-store that uses age instead o... by FiloSottile on Saturday December 18, 2021 @05:27AM (#29603407)

The difference with hardware keys is that the primary key can’t be exfiltrated, and only one secret can be decrypted per physical touch, so rotation and recovery are possible without invalidating all secrets.

[ Parent | on HN ]