Pass: A standard Unix password manager

https://www.passwordstore.org/

by jaybosamiya • 9 years ago

406 199 9 years ago

fwx• 9 years ago

How does this compare to other popular solutions? Specifically, KeepassX / Keepass2 which are the most common solutions I've seen most Unix / Linux users employ. Can we objectively state which one is a better solution?

jm2dev• 9 years ago

Pass encrypted passwords are kept in your computer, which I find safer than web based solutions. Optionally you can use git to share passwords between computers but you still need the gpg2 keys from the original repo.

nerdponx• 9 years ago

Huh? Keepass is just an encrypted XML file. No GPG or remote storage required.

aeorgnoieang7• 9 years ago

You can setup a password store with Pass to use multiple keys – much better than sharing keys among multiple devices.

scbrg2• 9 years ago

A few differences:

- There's no builtin GUI

- Each entry is its own file

- You control the storage format (meaning it's easy to store any kind of information, not just passwords)

- It relies on GPG, so you need to set that up first

dbdr• 9 years ago

You need to handle X integration yourself by piping to xclip, or similar (or just cut and pasting from terminal)

pass -c (or --clip) does that for you.

Sir_Cmpwn3• 9 years ago

- You need to handle X integration yourself by piping to xclip, or similar (or just cut and pasting from terminal)

Wrong, pass provides the -c flag which puts it in your clipboard and clears it after a timeout.

laurent123456• 9 years ago

- You control the storage format (meaning it's easy to store any kind of information, not just passwords)

In Keepass, there's a textarea associated with each password entry, which can be used to store extra data like security questions, etc.

marcv81• 9 years ago

Objective difference: KeePass encrypts the names of the websites where you have accounts. I would not want to live without this feature.

DavideNL• 9 years ago

https://github.com/roddhjav/pass-tomb

lower• 9 years ago

I've been using this for a while and am very happy. Especially the ability to use a private git repository for synchronization of laptop and desktop makes this convenient.

thesmallestcat2• 9 years ago

No, no it's not.

kps• 9 years ago

Ed is the standard password manager.

mdekkers• 9 years ago

Why?

thesmallestcat2• 9 years ago

"standard Unix $THING" has meaning beyond marketing-speak. https://en.wikipedia.org/wiki/Single_UNIX_Specification

allerhellsten• 9 years ago

Pass is pretty awesome, but nowadays I've switched to gopass: https://github.com/justwatchcom/gopass - much better support for teams, structured secrets, binary secrets and quite a few other improvements. Oh, and it's (mostly) drop-in compatible.

crypt1d5• 9 years ago

Looks nice. Unfortunately I would never use it for teams as it doesn't have audit logs. These are very useful in case a user is compromised - you can lookup which passwords he accessed and only change those. Same goes if the user left the team and u want to make sure all accesses are revoked.

jbg_9• 9 years ago

"you can lookup which passwords he accessed"

Really? What if s/he just decrypted the file themselves and had a look at the content, rather than using the convenient wrapper that a password manager provides?

mi100hael2• 9 years ago

For teams, I almost always go with Vault (http://vaultproject.io/)

nickjj2• 9 years ago

I've been using pass for a long time now. I have over 200 passwords stored.

I like it because you can use it to store sensitive info along with metadata, not just single field passwords. It's also super easy to access the info on the command line with ways to auto-copy passwords to your clipboard (which expires after 45 seconds).

I did a write up on it a while back at https://nickjanetakis.com/blog/managing-your-passwords-on-th....

amelius4• 9 years ago

How do you deal with multiple devices? Do you sync your password files regularly between them?

painted9• 9 years ago

Things like dropbox should be perfect for this, since the files are encrypted you don't need to trust anybody

jbg_9• 9 years ago

I use Git; pass has integration with it out of the box (makes a commit for each change to the password store). I just push and pull periodically myself, but this could be automated. There is an Android app called Password Store that is compatible with pass and has Git integration built in.

I remember seeing some guy who had his `pass` Git repository public on GitHub and challenged the world to crack any of them. Myself, it's just git+ssh to a repository on my own server.

nickjj2• 9 years ago

As others have mentioned, git / dropbox works well for this.

But personally I use a different approach. I rolled my own little rsync script that syncs files that I care about (passwords and other things) between my workstation and Chromebook (I run Linux natively on it).

aeorgnoieang7• 9 years ago

I use Dropbox but I also use git-remote-gcrypt[0] to encrypt the entire Git repo so that even the file names and sub-directories don't leak outside any of my computers or devices.

[0] https://github.com/spwhitton/git-remote-gcrypt

hasenj2• 9 years ago

If it becomes standard, people would use it without a master password, and then stealing passwords via malicious scripts will become very easy.

Sir_Cmpwn3• 9 years ago

What? How does this follow?

deong• 9 years ago

Well, I guess if you had no master password, any script you expect people to run could have a surreptitious "pass <some args> | curl" to post password data to some web service of your choosing.

Still, if you use a password manager without a master password, I don't think you can be protected from consequence, regardless of what your tools do. Pass could refuse to allow the no master password scenario, or could force some type of blatant user interaction to allow it to work, but ultimately, that user is screwed by something somewhere.

nzp• 9 years ago

Pass doesn't handle your "master password" at all, it's completely delegated to GnuPG (pass is really nothing more than a shell wrapper your file system, GnuPG, and Git). Does GnuPG let you easily get away without a password on your key, I don't remember ATM.

hasenj2• 9 years ago

It's completely possible to setup `pass` such that you can type `pass <name>` and it will print the password to stdout (you might has to pass an extra parameter or so) without ever asking the user to input anything to confirm they approve of this action.

Now if this were to become mainstream, it's almost guaranteed that some percentage of users will set it up to work that way.

And now you have the perfect opportunity to write a script that simply attempts to read passwords using pass and if it succeeds sends the results somewhere on the net.

JetSpiegel• 9 years ago

Using this and something like rofi-pass:

https://github.com/carnager/rofi-pass/

Gets me really close to the holy grail of password managers. Browser integration is possible too with PassFF:

https://github.com/passff/passff

da_n• 9 years ago

For me, browser integration is an anti-feature for password managers.

maccard• 9 years ago

I prefer to trust the browser integration than to trust the clipboard.

kronos292963• 9 years ago

Browser integration just means you trust the plugins that provide browser integration. May not always be secure. With the recent trend of popular browser extensions being made adware after purchasing them I wouldn't always trust them. A time out clipboard is sufficient for me.

enobrev• 9 years ago

That's true, but the GP posted a link to the source of the browser plugin, which is to assume that could be avoided in this case.

compuguy• 9 years ago

Pass/gopass really needs a good browser integration add-on. I have not found one that doesn't have some minor bug or issue.

adtac• 9 years ago

Isn't copying the password to clipboard a vulnerability?

I think a better idea would be to fill in the password through something like xdotool

thecopy• 9 years ago

Password managers clear the clipboard after 1 minute or so.

painted9• 9 years ago

there are so many clipboard listeners out there :D so the fact that you clear the clipboard doesn't really matter

Piccollo• 9 years ago

What about clearing after one instance of 'paste'?

reificator2• 9 years ago

The clipboard's biggest vulnerability is the user themselves, but most password managers automatically clear their own entries after a customizable timeout.

Sure other applications can see the clipboard, but if you've got software running on the user's machine you've already won.

simias• 9 years ago

It's trivial to script if you want (either by modifying the rather simple pass script itself or by wrapping around it).

Some programs support calling an external command to get a password, that's convenient (mutt and msmtp allow that for instance). I thought about integrating pass in my window manager directly but I didn't take the time to implement it yet.

pass also tries to clear the clipboard after 45 seconds.

But really if you can't trust your clibpoard what can you do? I didn't really feel a lot safer with lastpass' browser plugin.

planetjones2• 9 years ago

With all the discussion about 1password and its decision to "more or less" move to the web and a subscription based model, I had a TODO to look at what the open source community had; especially regarding browser plug-ins, mobile apps, etc. I don't understand why a simple problem like password management, needs a subscription and a private company to create software for the problem.

This post seems to have saved me the trouble of Googling myself. I am installing on the Mac and iOS as we speak.

nytesky• 9 years ago

This does seem attractive. Any feedback on iOS client passforios it's MIT licensed? And how is sync done,itunes?

jbg_9• 9 years ago

I haven't used the iOS client, but on Android the most common way to sync is to use your own Git repository accessed over SSH. You could use a private GitHub repo or one on your own server.

cpenner461• 9 years ago

I don't understand why a simple problem like password management, needs a subscription and a private company to create software for the problem.

Speaking from recent experience migrating non technical users to 1Password, while something like pass might work well for me/the typical HN user, there's no way I'd try to get family to use it. I have found the overall 1Password user experience to be very friendly and reliable, but am still semi regularly having to help family figure out/re-explain something about how it works. They'd be lost with something like pass.

dannysu• 9 years ago

Exactly. You're paying 1Password to maintain the various apps and browser plugins. Continuing to improve UX and add language support.

My parents don't speak English. Not everyone does.

That's what you're paying 1Password for.

pnutjam• 9 years ago

spider oak has a nice one for non-technical users, https://spideroak.com/personal/encryptr.

Encryptr uses their no-knowledge cloud. It's pretty cool and their processes are openly documented.

alex_duf• 9 years ago

I don't like the fact someone with access to my hard-drive can figure out all the services I'm using just by looking at the filenames.

It's convenient yes, but I prefer one encrypted file that contains it all.

YorickPeterse• 9 years ago

This shouldn't really be an issue if you're using full disk encryption.

jrochkind1• 9 years ago

That seems like saying why use an encrypting password manager at all if you're using full disk encryption, isn't it okay to just keep your passwords in plaintext on your encrypted disk?

chme• 9 years ago

This isn't how real security works.

There is a concept for 'defense in depth', saying that every component should be secure on its own and not rely on other components.

pavon• 9 years ago

Encryption only protects files at rest. The vast majority of attacks are against live systems connected to a network, where full disk encryption won't help you one bit. It is a nice extra layer of protection for when a device is lost/stolen, but I don't consider it a primary form of protection for any important data.

painted9• 9 years ago

yeah, from a security point of view it's similar to have one file or multiple ones encrypted with the same key

zamber3• 9 years ago

It's not. When you decrypt one file you have all of your passwords in-memory (terminal, clipboard, browser extension, qtpass). When you do that for one login/password pair you only expose that pair, not all of the others.

roddhjav2• 9 years ago

This "issue" has been fixed with the pass extension 'pass-tomb' that keep the whole tree of password encrypted inside a tomb

See https://github.com/roddhjav/pass-tomb

However keep in mind it's not always a big "issue", for instance only looking at your browser history will retrieve the same knowledge.

ufo2• 9 years ago

Oh well... I wonder why they didnt make something like this the default.

Tharkun• 9 years ago

I mount my pass dir with encfs. Mount when I need access to passwords, and no need to remember to close it before I shut down (or if the machine randomly crashes).

I can store the encfs encrypted tree on cloud storage (spideroak in my case) and have it synched across machines. Works pretty well.

gioele• 9 years ago

Check out pw, my alternative to pass, designed because of the reason you mentioned: I don't want my password manager to leak the list of services I use.

https://github.com/gioele/pw

In pw each password database is a single file, the internal indexes are random IDs. Each line in a database is a serialized GPG file with a password and associated metadata.

The file format is git-compatible and everything can be managed with standard command line tools.

amelius4• 9 years ago

Anybody else here simply hashing their master password with the domain name of the website?

I think this is something the browser should offer by default.

jimktrains2• 9 years ago

How do you rotate passwords?

hiq2• 9 years ago

If your master password leaks you are exposed on every website where you used this scheme (and you should then change every password), so on the security side this is inferior to a master password granting access to uncorrelated passwords.

amelius4• 9 years ago

Well, you can add a salt to this scheme.

I know, it's not perfect, but it beats carrying around password files between devices.

painted9• 9 years ago

What about websites that require to have special characters in your password, since the hash is just HEX? What about multiple accounts on the same website, same password?

jbg_9• 9 years ago

A hash is a value. You don't have to encode it in hex.

rkeene22• 9 years ago

Yes, I do something like this, along with storing the password requirements and username/domain in localStorage and allowing it to sync between devices: https://webpass.rkeene.org/

kronos292963• 9 years ago

Such ideas are already implemented in deterministic password managers (erm generators) which have a some key security issues related to portablility and weaker schemes that can be hacked and if your master password is compromised or insecure. A bad idea in my opinion.

rkeene22• 9 years ago

Related: hunter2[0], a password manager which uses a smartcard to manage the keys for each password, and supports multiple users.

[0] https://chiselapp.com/user/rkeene/repository/hunter2/

mrhigat43• 9 years ago

I use pass and love it. It provides a lot of flexibility. To fix the "website metadata is leaked in filenames" issue, I use another project by Jason, ctmg[0]. I changed the pass directory to be one directory deeper, encrypted it and just do `ctmg open` when I boot to open my password list (similar to unlocking a keypassX store) then use pass as normal. On shutdown, the opened folder is re-encrypted automatically. You could also set a ctmg close on a timer if you don't want the list to be available during your entire session after open.

Other things I do:

* store all the files as .toml files so I can rip specific keys with a custom script.

* Have a directory for web so `pass web` will give me all websites. Have a script to fill username pass for each.

* Have a directory for contacts. Then wrote a script to generate vCard files by crawling and pulling keys, base64 profile images and all.

* use syncthing to keep all devices up to date.

It's pretty slick workflow IMHO

[0] https://git.zx2c4.com/ctmg/about/

painted9• 9 years ago

looks like a nice setup, but what about mobile?

mrhigat43• 9 years ago

Syncthing has a mobile app and there's an app for pass called PasswordStore[0] using OpenKeychain[1] (pgp manager). I'm not a fan of putting my private key on my mobile, but if I were, this would be a nice setup.

[0] https://github.com/zeapo/Android-Password-Store

[1] https://github.com/open-keychain/open-keychain

Edit: yeah for ctmg support, probably have to hold out for something like PostMarketOS to save us.

roddhjav2• 9 years ago

Since pass supports extension, you can make your setup less complex using pass-tomb. 'pass-tomb' keep the whole tree of password encrypted inside a tomb, see https://github.com/roddhjav/pass-tomb

zx2c42• 9 years ago

Nice to hear somebody out there is using ctmg. I never bothered making packages for distros other than Gentoo, but ctmg is quite useful so maybe I'll do that.

mrhigat43• 9 years ago

Cheers. Yeah for sure, I was too lazy to make a PR on nixpkgs, but this[0] is what I wrote if anyone stumbles on this using NixOS. The nix package manager can be installed on top of most OS's too.

[0] https://pastebin.com/raw/FYMean1q

leshow• 9 years ago

I've used pass for years, it's great.

jbg_9• 9 years ago

I've used this for a long time, and along with its Git integration (pushing/pulling to/from a repository on my own server, accessed over SSH) and a GPG key stored on a Yubikey Neo, I've got basically seamless sync between two laptops, a desktop and an Android phone, without using any third-party service.

The "Password Store" app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo to decrypt the passwords.

emilecantin• 9 years ago

I've got the same setup, it's pretty great. One thing, though: make sure you have another way of decrypting your passwords! I lost my Yubikey once, and I lost all my passwords. Now I have a copy of that key on a USB drive I keep at home in a small safe.

jbg_9• 9 years ago

Yeah, my passwords are encrypted to two private keys. One is on the Yubikey, the other is printed and stored securely.

jethro_tell• 9 years ago

General recommendation is to have a backup for everything on a yubi key. Two keys or printed backup codes or whatever.

xur173• 9 years ago

What's the best way to backup the private key on your yubikey? Do you just generate it on your computer instead of on your device, and then back that up?

fps• 9 years ago

I have the same setup, but I haven't yet been able to get the Yubikey Neo to work as a GPG key on android via NFC. It prompts for a PIN, but the PIN I use for GPG on linux isn't accepted. There's also no working windows client for this setup, so I find I have to manually copy a lot of 20 character complex passwords by hand these days.

gant• 9 years ago

Why doesn't it work? From the top of my head, QtPass with gpg4win should work.

jbg_9• 9 years ago

Interesting. The same PIN that I use to unlock the card on my laptops works on my phone. I'm not sure what would lead to the behaviour you describe!

kranner• 9 years ago

I share a pass git repo between a Mac and a Windows machine. GPG4Win works fine on Windows.

tylorr• 9 years ago

I use Msys2 on Windows which then lets me install GPG and Pass from its package manager.

maeln• 9 years ago

The only problem I got with the password store application is that the Git integration seem to be a bit broken. It often refuse to push, pull or sync depsite having no conflict. But you just have to delete the store and pull everything again, so it's not a huge problem.

I definitly have to try the yubikey integration !

uggedal• 9 years ago

I use termux[1] to clone/pull my pass repo for "Password Store" on Android since I need ed25519 key support.

[1] https://termux.com

xiaomai2• 9 years ago

I don't think the git integration can be broken. You can go into the ~/.password-store directory yourself and see what is going on next time you have issues (it's just a regular git repo).

dsacco3• 9 years ago

Note that pass was developed (and is maintained) by Jason Donenfeld (zx2c4), the same person who developed Wireguard, the new VPN protocol.

Not that my opinion is worth a whole lot, but this is the password manager I would choose to use if I wasn't using 1Password. Where many other password managers use convoluted constructions with (e.g.) AES and PBKDF2, this is very straightforward GPG.

Spooky232• 9 years ago

Where many other password managers use convoluted constructions with (e.g.) AES and PBKDF2, this is very straightforward GPG.

That's a bonus until you need to demonstrate FIPS 140-2 validation.

dsacco3• 9 years ago

GPG is FIPS 140-2 compliant (though pass itself might not be, depending on the specific way it's used). Most likely pass would have to use GPG in a specific FIPS-compliant mode to pursue validation.

foobar__• 9 years ago

FWIW, the source code looks fairly solid to me, considering that it's a bash script meant to be used on trusted inputs.

To illustrate my point, look at the elaborate loop to iterate over *.gpg files: https://git.zx2c4.com/password-store/tree/src/password-store...

This looks to me like the correct way to do this in bash, as long as you can guarantee that $PREFIX does not start with whitespace (which may be a valid assumption here).

From what I can tell, the code quality is way better than what you see in your average bash script.

Aissen• 9 years ago

I've been using password managers for while now, but I've recently discovered pass-rotate: https://github.com/SirCmpwn/pass-rotate

It's basically a rotation manager ! Very powerful and lets you properly change your passwords regularly on many websites (like the proprietary Dashlane Password Changer or Lastpass' similar feature).

Sir_Cmpwn3• 9 years ago

I'm glad you like it! Please send patches with support for new services :)

tombert• 9 years ago

I love Pass, but the problem I've had is that I always feel like I have to spend a bunch of time setting it up when I'm on Windows.

I understand it's the standard UNIX password manager, so I suppose I don't have a ton of room to complain, and most of my computers are Mac or Linux, so it's not a huge deal, but I think it increases the barrier of entry a ton of people.

That said, I think Pass is awesome, and having my passwords stored in Github makes me really happy.

y4mi2• 9 years ago

the nonexistent browser support makes it even more troublesome to setup. there is some support on linux systems, but windows is plain out of luck

i Really like the idea of pass, but ill never accept copy pasting logins/passwords again. they'll need to be automatically inserted on a matching website. everything else is too much manual overhead for my taste.

Spivak• 9 years ago

In Windows or in general, because pass has a ton of browser extensions.

https://addons.mozilla.org/en-US/firefox/addon/passff/

https://addons.mozilla.org/en-US/firefox/addon/pass-manager/

aeorgnoieang7• 9 years ago

If you want passwords automatically inserted why not just use the browser's features that do that? I do that for some sites.

wyager• 9 years ago

Looks like the iOS app supports browser autofill and there's a Firefox plugin.

cookiecaper• 9 years ago

Please understand that browser integration is the Achilles' Heel of password managers. While you get the convenience of autofill, you're also bringing access to your password database into the browser's attack surface. Bugs in the browser sandbox or improper extension implementations can allow rogue sites to get the goods. There have been multiple instances of major password manager extensions leaking secrets just in the last year.

Copying and pasting may be annoying, but it's much safer, especially if you use a program that will autoclear your clipboard for you (KeePass 2 does this after 12 seconds by default).

aeorgnoieang7• 9 years ago

It's somewhat easier with Bash on Ubuntu on Windows, tho kinda broken (because the copy to clipboard feature doesn't work out of the box unless you're running an X server).

But yeah, I kinda don't like using Gpg4Win with Cygwin, which is what I'm guessing you've used too.

With the "Creators Update" there's now a `clip.exe` to which one can pipe so maybe it's not too hard to update Pass, which is itself just a Bash script.

zx2c42• 9 years ago

That's good to know. I'll add support for clip.exe with the next pass version. Send an email to the mailing list to remind me?

majkinetor• 9 years ago

Exactly my problem.

Today I found this, need to check it out: https://github.com/Baggykiin/pass-winmenu

darrmit3• 9 years ago

I think pass is awesome if you have the workflow that supports it, but for the vast majority (myself included) it's entirely too difficult to setup and maintain. Particularly if you're using Windows regularly.

aeorgnoieang7• 9 years ago

Setup is a bit of a pain, but what workflow is required? I just keep a Cygwin window or a Bash on Ubuntu on Windows window open and tab over when I need a password. With the shell auto-completion I find it easier to use than other password managers, tho I prefer not using my mouse so I'm surely biased about that aspect.

I was previously using Password Safe, on Windows, and various compatible alternatives on Linux and Mac OS. Years ago I had tried using a single 'safe' synced via Dropbox but that was a big pain in the ass because sometimes I'd inadvertently lock the safe file by, e.g. starting to add a new password but not finishing. So instead I created a separate safe file for each computer or device. To sync new passwords or changes to existing passwords I'd have to periodically merge all of the safes and manually cleanup any conflicts between them.

The main reason why I switched to Pass is that syncing the password stores on each of my devices is so much easier using Git.

darrmit3• 9 years ago

Well, I'm talking from a non-developer perspective. I don't use Git daily, so I had to stand up my own Git instance or pay Github for a private repo.

PassFF works well for Firefox on my Mac, but no equivalent for Windows. If you're willing to forgo browser integration then that's less of an issue.

Lack of browser integration might also be less of an issue in Linux with dmenu or rofi plugins like others have mentioned, but that still doesn't solve Windows issues.

I had considered the Bash/Ubuntu/Windows option (instead of qtpass) but haven't tried it yet.

ben0x539• 9 years ago

I've seen pass mentioned like a million times but I didn't realize there were so many third party extensions for it, the comments here are pretty helpful. Thanks for the submission!

zabil• 9 years ago

I started with pass and switched to gopass because it automatically pushes new passwords to your remote git repository.

I use a fish script to hook it up to https://github.com/junegunn/fzf for easy search and copying to the clipboard. https://github.com/zabil/thanksforallthefish/blob/6145e98691...

burnbabyburn• 9 years ago

you could already do that with git hooks and pass

    .git/hooks/post-commit

    #!/bin/sh
    git push origin master

leighflix• 9 years ago

Alright guys, I tried using this as I was curious, and miserably failed.

Found out I needed GPG, and some encryption key or ID and whatnot. I have no clue what these things are and would like to know.

How can I learn about this encryption stuff like keys and RAS and whatnot? (Books n Articles)

jolmg• 9 years ago

Archlinux wiki typically have very good guides:

https://wiki.archlinux.org/index.php/GnuPG https://wiki.archlinux.org/index.php/Pass

The simplest way to create your gpg-id is with:

$ gpg --gen-key

Fill in your name and email in the prompts. When it tells you it needs to generate a lot of random bytes, you'll probably want to do something like

$ find /

to generate disk entropy for gpg to pull enough random bytes from /dev/random to create your keys.

You can use the email you provided as the gpg-id you give to pass

$ pass init $email

spoopy01• 9 years ago

This is a great tutorial in setting up pass on multiple accounts: https://medium.com/@davidpiegza/using-pass-in-a-team-1aa7adf...

tobias2014• 9 years ago

If you're using XMonad, you definitely want to use the pass addon in the xmonad-contrib package: https://hackage.haskell.org/package/xmonad-contrib-0.13/docs...

I would claim that there isn't a more convenient password management solution than this.

xiaomai2• 9 years ago

If you're not using XMonad, 'passmenu' is a really handy way to get your passwords. I bind it to ctrl-alt-p and rarely run pass manually now.

molsson• 9 years ago

Implemented as 700 lines of shell script?! Why?

alexnewman• 9 years ago

I use pass on all my devices. IOS, chromebook and cli. I freaking love it! passforios is still on testflight but so good. Only a few issues with passforios:

- It forgets my github password everytime i upgrade - I honestly don't like the fact that I can't turn off the pin. 4 digits with unlimited retries. - It can't merge sometimes. I think they should be more aggressive about git rebase

0x6c6f6c• 9 years ago

You should be able to generate an SSH key that you can use in your application, right?

If you can't that's definitely gotta be an issue in their backlog. Seems more robust to have a key for an application to connect with that you can simply revoke.

mmagin• 9 years ago

Thanks for mentioning it. I previously couldn't have my passwords available from my phone.

I created a seperate ssh key and did this on my server https://superuser.com/a/444899

ViktorEvil• 9 years ago

Pass for iOS is now on the App store

guillaume20100• 9 years ago

I recommend using Pass or Keepass, because we can see the source code. But like all these password managers, you need to synchronize your password vault.

If you do not want to synchronize your vault among all your devices, but still want to have a unique password per site, try LessPass[1]. LessPass is a stateless open source password manager.

Disclaimer I am the creator of LessPass

[1] https://lesspass.com/

arthulia2• 9 years ago

This is pretty brilliant. My biggest concern is that if my password for a site gets compromised, it gets a lot more complicated. Presumably I'd have to memorize a separate master password for retrieving the new password for that site.

prophesi3• 9 years ago

They have a counter option that you can increment which allows you to generate a completely different password for the same site.

redthrow• 9 years ago

Lesspass seems nice but how about keeping all passwords in a .txt file and password protecting that file?

One benefit of the password-protect-text-file method over Lesspass is you can also save answers to so-called "security questions" (for those sites that still use them, like Paypal and government sites).

Alternatively, one can use Schneier's write-down-password-on-a-small-piece-of-paper method.

https://www.schneier.com/blog/archives/2005/06/write_down_yo...

c13k• 9 years ago

This method works very well. I have one large text file containing all my credentials, stored in a an encrypted VeraCrypt file.

I have all this stored in my Linux box. I backup to my server side encrypted AWS S3 bucket protected with 2FA. No need for me to sync anything, but if I need access to my VeraCrypt file, I can download it when required.

I've used this method for two decades now, first using OSX .dmg files, then TrueCrypt, now VeraCrypt. Simple, and works well.

ss64• 9 years ago

https://ss64.com/pass/ Is similar to LessPass but is entirely javascript in the browser, so you can save the page and run a local copy completely offline or upload to your own website. Theres also a command line version for both bash and PowerShell https://ss64.com/pass/command-line.html

nialv7• 9 years ago

I use KeePass and I only keep the database on my phone. When I need the database on my laptop, I use kdeconnect to share the file. Which basically uses sftp with a temporary key.

There is no need to put anything on someone else's computer.

rorosaurus3• 9 years ago

This appears to be very similar to MasterPassword. Do you have a minute to explain to me what advantages LessPass offers?

[1] http://masterpasswordapp.com/

tom4000• 9 years ago

Not at all. While Masterpassword does not save any passwords but generates it based on some unique parameters live - pass stores passwords and notes encrypted with GPG in a git repository.

The list differences to LastPass is long.

Pass is OpenSource. Pass doesn't store your information on anybody else's computer by default. Pass has not first party browser plugin and is therefore not open to attack through browser plugin holes.

On the other hand you control everything by yourself including batch updating your passwords. And there's no online service.

reledi• 9 years ago

Disclaimer: stateless/deterministic password managers have some serious flaws compared to stateful/vault password managers. See https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... for example

qrv3w• 9 years ago

For those interested, I've been working on something similar but for journal entries instead of passwords. [1]

[1] https://github.com/schollz/gojot

wallunit• 9 years ago

I wrote a similar password manager (without knowing that pass already exists): https://github.com/snoack/mypass

But I ended up storing everything into one single encrypted file, rather than having one file per password. Though I see the point about the UNIX philosophy (i.e. "everything is a file"), but that way you'd leak information, i.e. what the passwords stored are for.

Anyway, I'd appreciate any feedback on mypass.

Galanwe• 9 years ago

You miss the point. Having multiple files is not a matter of Unix philosophy. Pass works with GPG keys... Multiple of them! The pass repository is to be shared among your team, so every file can be encrypted for a different, specific set of keys/users.

Accacin• 9 years ago

I'm currently a Lastpass user. I know, trusting them to store my passwords is probably not a great idea but it works on Windows, macOS and Linux and my iPhone with no problems at all.

Would I like to move to something that isn't stored online? Yes, of course but I haven't found a decent solution that works everywhere.

Any recommendations?

homakov• 9 years ago

Did anyone here NOT write their own pw manager?

tuxninja• 9 years ago

If anyone needs a quick tutorial on pass I wrote about some it's features a while back http://tuxlabs.com/?p=450

Pass: A standard Unix password manager

Related Stories