"brew install pass" -- the simple unix password manager now released for mac

http://zx2c4.com/projects/password-store/#macintosh

by zx2c4 • 14 years ago

61 80 14 years ago

patrickod2• 14 years ago

For what it's worth I'd take the #macintosh out of the URL as teh more important thing for me is seeing what this does / how it works. It's a neat utility but I had to do a double-take when the link opened installation instructions without an overview of what it actually does.

zx2c431• 14 years ago

Yea, this would have been better. Will keep in mind for next time -- can't change it now.

crcastle• 14 years ago

Also (and I realize this is nit picky) you should change the section heading to "Mac" or "OS X".

"Macintosh" as a term to refer to a computer doesn't exist now. I can't find a link to support it, but I'm pretty certain Apple officially uses Mac, not Macintosh, even though the former was originally a shortened version of the latter.

p.s. Thanks for this software. Awesome to have choice in this area.

pixard2• 14 years ago

If this could be integrated to work with Alfred that would be amazing.

zx2c431• 14 years ago

I'm not really a Mac guy so I haven't played with Alfred, but from what I understand it's a launcher of sorts. Will it run executables that are in PATH with supplied arguments? If so, then you should be good to go. Or is there potential for tighter integration? What do you have in mind?

pixard2• 14 years ago

It can run shell commands directly by just prefixing them with > which then opens Terminal and runs the line. What I'd love is an extension (basically just a shell script) that would provide shortcuts to interact with it.

I really loathe 1Password, KeePass, LastPass etc. but what they do is provide me with a FAST way to get to my passwords.

If I could do this with Alfred and this app it would be killer:

pass find ycomb (and then it gives you results that match this and if you hit enter it copies the password to the clipboard) pass add [name/url] [password] pass rm [name/url]

etc. If only I knew how to code this. :)

evoxed• 14 years ago

I haven't slept in a couple of days otherwise I'd take a crack at it myself, but Alfred extensions accept shell scripts. Just typing > in the Alfred bar gives you access to the shell, but I suppose you could use a script for more advanced automation (i.e. take this file/webpage/whatever and autofill).

mbreese• 14 years ago

This does look pretty handy. I'd almost rather have my passwords stored in something like this, as opposed to LastPass where they are stored externally.

However, it would be great if this could work with Chrome as an extension. You'd probably want to avoid writing a native plugin for it, because that would require compiling and would be a headache for managing the extension (and gpg versions, etc). Instead, one thing you could do is setup a daemon that the extension could talk to, bound to localhost. But then you'd have to manage authenticating Chrome to the client, etc... perhaps I found something to tinker with over the weekend.

zx2c431• 14 years ago

This would be totally awesome if you tinkered with this. I've been thinking about something similar too. It doesn't even have to be super complex, either. Shoot me an email (bottom of the page) and let's talk.

r00fus• 14 years ago

Seems useful, but aren't 1Password and Keepass better solutions?

1Password integrates with browsers, basically even avoiding the clipboard to autofill. It also prevents accidentally filling the wrong password as you can only autofill passwords that are for that domain. You can also sync to your iOS/Android devices.

Keepass is nearly as good (autofill isn't as refined), but it's free and available on linux too.

zx2c431• 14 years ago

The point is to avoid the horrible bloat of 1pass and kees. I don't want a new database format. I just want simple files in simple folders, nothing fancy, nothing schmancy, easy to maintain, portable, standard.

rpearl• 14 years ago

1password is all JSON. Here's some python written by a friend of mine to read keychains:

https://github.com/drakedevel/pyagilekeychain/blob/master/ag...

Not that standard (the encryption is standard AES, but not OpenPGP format) but it is certainly portable.

patrickod2• 14 years ago

I've been happily using 1Password for years now and have always been very happy with it. It syncs via Dropbox and I can access it anywhere I want. I have it on my Android phone via their Android reader. I don't see it as being horrible bloatware at all, in fact quite the opposite

SiVal2• 14 years ago

So do I, but I don't see where you enter the master password to access it before typing "pass". If I walk away from my desk for a minute or two, and someone points my browser at my bank, he'll have to enter a password. If he tries to ssh to my server, he'll have to enter the password. If he tries a sudo, he'll have to enter a password. I assume someone who typed "pass" at my command line wouldn't be given full access to my entire password store without having to enter, well, a password, right?

bbwharris• 14 years ago

I'm not comfortable keeping all my passwords in a single companies database. They are good products, it's just a personal preference.

zx2c431• 14 years ago

amen brotha

nextstep2• 14 years ago

I can't tell from the landing page: can this also save usernames/emails/security questions? Is there a "notes" field for each entry? I'd love to find a better alternative to KeePassX but I need to store these other pieces of info.

zx2c431• 14 years ago

You can name the files whatever you want and put them in whatever kind of directory organization you want. You can also use multi-line mode to store additional information. (One thing I suppose I should add, then, is the ability for the clip mode to only put the, say, first line on the clipboard.)

Alternatively, and perhaps this is cleaner and nicer, you put the password in Amazon/bookreader and the meta/additional data in Amazon/bookreader.meta. Or come up with your own scheme that works for you. The system is really flexible.

nextstep2• 14 years ago

Is it flexible enough to support separate fields? Having a multi-line "password" is kind of ugly... And if I want to save security questions, username, password and email, I'd need at least four files?

greghinch• 14 years ago

I have a question for those of you who use password managers like this: I have 3 computers, an iPhone, and an iPad, on all of which I interact with a lot of the same sites and applications for which I need passwords. How would I go about managing passwords for all the devices? Mobile devices in particular seem problematic.

zx2c431• 14 years ago

More bloated password managers (like 1pass, for example) come with mobile clients and cloud services. This thread will probably include many such replies.

Pass comes with integrated git support, for syncing and logging. This is what I use with my mobile phone and additional computers, and it works really well.

samf• 14 years ago

Not being argumentative, I just don't understand.

How do you use it on your mobile phone? Is there a git app that lets you browse files? How would you decrypt them? Can you update them?

Or do you just use a shell on your mobile phone?

brown9-2• 14 years ago

Syncing via git (an active process) sounds like more work than passive DropBox syncing.

herge• 14 years ago

Google Drive or Dropbox.

zx2c431• 14 years ago

Awesome idea. Since pass is just normal files, dropbox & friends can do things seamlessly. Didn't have that in mind originally, but it seems like it'd work really well.

fredsted• 14 years ago

I just put a KeePass file on my DropBox which automatically syncs to my devices.

JamesLeonis• 14 years ago

I do the same. Portability of the password manager was as important as how it was stored. If I couldn't get it on my many machines, it wasn't any good to me. Highly recommended.

SquareWheel• 14 years ago

This is my method as well. I use iKeePass on my iDevice. It's not pretty, but it works.

zx2c431• 14 years ago

Cool. You can put pass's password-store in Dropbox too!

nuttendorfer3• 14 years ago

>With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password.

Is the filename cleartext or encrypted?

piffey• 14 years ago

Filename is cleartext.

nuttendorfer3• 14 years ago

Thanks, I won't use it then.

soldermont001• 14 years ago

How would mobile phone usage work? Are there plans for an app? Or some easy way to use it when you don't have a full keyboard.

zx2c431• 14 years ago

Should be pretty easy to write such an app, considering the design of pass is so simple.

yorhel• 14 years ago

Odd-sounding request: Is it possible to have an option to not use gpg, or any encryption, at all? I only store my passwords on a LUKS loopback file, which I mount/umount as I need to access some information on it. The double-encryption does not really add any better security, but does add another password to type. I'd love to make use of the nice looking pass interface: A password generator, copy-to-clipboard, and simple management operations.

zx2c431• 14 years ago

I'd still recommend using gpg so you get the nice time-out features of gpg-agent, but otherwise, if you still don't want to use it, sure, it's trivial.

Change calls to "gpg" to "cat" in the source code. It's less than 300 lines of simple shell script. Poke around and it shouldn't take more than 2 minutes to alter.

zvzgfghvjvthfzt2• 14 years ago

Here's another take on the problem: https://github.com/catch22/pw

zx2c431• 14 years ago

Throwing everything in a single database file with a designated schema, YAML or whatever else, is exactly what I was trying to avoid.

Keep it simple. Single files are the way to go.

zvzgfghvjvthfzt2• 14 years ago

Wait, you password directory is stored unencrypted. Not the way to go.

lvh• 14 years ago

The principal difference of opinion is that pass thinks usernames and sites are public information. Some of the alternatives do not.

While in some cases the difference is moot (I'm sure I have a bunch of registrations on things like forums where membership is public anyway), there are cases where it's not.

timrogers2• 14 years ago

Can someone explain a little more of how one would implement this for use on a phone as well as a computer? I have a Windows Phone personally, but an explanation for any platform would help conceptually.

zx2c431• 14 years ago

If anyone has the motivation to port this to Windows-anything, I will laugh, cringe, and then give you a nice pat on the back.

That said, the design is pretty simple. There are gpg text files in folders. Decrypt them to reveal passwords, encrypt them to add passwords.

simonz05• 14 years ago

I was looking for something like this (today) to keep some database passwords I need from time to time in git without storing them in plain-text.

Thanks for solving another man's problem.

zx2c431• 14 years ago

My pleasure! Glad you dig.

SoftwareMaven3• 14 years ago

This is the feature I would use this for. I've written custom solutions to do this in the past, and while I'm confident in them, it induces a large cognitive load to make sure they are secure. I would much rather trust another, well-vetted solution (meaning, of course, this has to reach well-vetted stage, but if I were in need, I'd spend time vetting).

zx2c431• 14 years ago

GPG is well-vetted. The encryption here is GPG.

tzs2• 14 years ago

From the subtitle of the page: "the standard unix password manager".

I had thought that in 30+ years of Unix use, I had noticed all the standard Unix components. I was quite surprised to overlook that there was a standard Unix password manager!

timrogers2• 14 years ago

Is there any way to make the completion on this work with zsh?

tammer• 14 years ago

I found this thread searching for the same answer.

"brew install pass" -- the simple unix password manager now released for mac

Related Stories