Show HN: Manage passwords with GPG

by noondip • 11 years ago

93 48 11 years ago

matkam• 11 years ago

Pass (http://www.passwordstore.org/) is password manager based on GPG that's been around for longer. It has some more tools available that are built around it and helps organize passwords as well.

andrewstuart2• 11 years ago

I'm definitely all for multiple options, but a tool that does exactly this exists already, and uses git so you never lose history and can easily pass the store around.

http://www.passwordstore.org/

nmrm24• 11 years ago

http://www.passwordstore.org/ is a similar solution, and I prefer it to this solution for a few reasons:

* git integration.

* Separate file for each secret, so that I can store the password on the first line and then other sensitive account details on subsequent lines.

* -c flag for copying passwords to clipboard (but only copies the first line of the file, so it doesn't interfere with the usecase above)

* tab completion for user account names. However, this comes at a slight cost to security -- anyone with access to your machine (or git repo) can see all of the websites / accounts for which you have a password.

* Everything happens via the file system and secrets are just gpg encrypted text files. So it's really easy to implement new utilities on top of your password store. This is true for this solution as well, but somehow having separate files for each account makes it safer to implement utilities that do account management.

jrcii2• 11 years ago

It would be nice if there were a way to integrate it with the OS X keychain, unfortunately I haven't gotten around to it and I haven't been able to find anyone who has done this already since it's tricky to google.

QuantumRoar2• 11 years ago

It would be nice if I could at least export from the OS X keychain (you can always write up a simple script to add them to pass). Internet accounts can be exported, but all the rest won't work.

I've given up on it, but I'd like to know if anyone might have found something that I overlooked.

mnem2• 11 years ago

Are you aware of the command line utility, security? https://developer.apple.com/library/mac/documentation/Darwin...

Some examples of using it: http://joshtronic.com/2014/02/17/using-keyring-access-on-the...

k2enemy2• 11 years ago

I'm not sure exactly what you mean by "integrate," but you can have gpg-pinentry use keychain to remember your gpg passphrase for pass.

bdamos• 11 years ago

Another reason for me is the cross-platform compatibility. With git, I'm able to synchronize passwords across OSX and Linux machines, and the features (even copying) work well on both platforms.

aidenn02• 11 years ago

Separate files for each secret is a downside for me, particularly since it exposes the lookup key.

[edit] deleted paragraph that was supposed to be added to a different comment.

nmrm24• 11 years ago

It's a definite tradeoff, I agree. But I think pass is on the correct side of this tradeoff:

1. ./blah.sh | grep LookupKey exposes just as much information as pass -c LookupKey. If someone has access to your machine and you don't carefully prune your bash history file, then you're screwed. However, in the latter case, at least you get something at the cost of giving up security -- namely, the convenience of tab completion.

2. The only way to solve problem #1 in general is to have multi-stage authentication, where you authenticate to access to lookup keys and then authenticate again to access the passwords. That's achievable using pass and some Bash -- obfuscate file names and store a obfuscated -> actual mapping in a gpg-encrypted file, and write a bash script that does the ln -s'ing. And then the command that does that dumps you into a shell that doesn't record history.

I did this for a while but found it's a bit of PITA. Also, I can almost always come up with names that would be difficult to exploit without a lot of information about my life (bank_primary, bank_secondary; email/personal, email/business, email/spammy; server/personal, server/2011; and so on. I won't remember these verbatim, but once tab-completion reminds me of my options I typically recall which is which. And in case you're afraid in several years you'll forget which server you first purchased in 2011, you can always just pass -e server/2011 and explain which one you meant in subsequent lines.

amelius• 11 years ago

May i ask how you would use this on a mobile device?

nmrm24• 11 years ago

I use Android. Here's an app: https://play.google.com/store/apps/details?id=com.zeapo.pwds...

edit: looks like there's an iPhone app as well. See http://www.passwordstore.org/

davej• 11 years ago

These tools really need a browser plugin for them to be useful to me.

mbrock• 11 years ago

There's one for Firefox.

tdkl• 11 years ago

Not to mention mobile.

DDub• 11 years ago

Has anyone tried using these?

- https://github.com/gustaebel/passext (Chrome)

- https://github.com/jvenant/passff (firefox)

k2enemy2• 11 years ago

For Safari (and Chrome) I made a little automator service that gets the url from the browser, strips the hostname, then feeds that into a shell script that calls pass and puts the password in the clipboard for 45 seconds.

It actually works better (for me) than 1password which was always a little flaky at recognizing a website after any kind of site update.

asimilator• 11 years ago

passwordstore just (with my distro) starting shipping a dmenu (http://tools.suckless.org/dmenu/) script that I think is great, and personally removes the need for a browser extension. Unfortunately only available on linux.

raldu• 11 years ago

This nice solution is minimal, well scripted and very UNIXy. However, one tradeoff is that filenames for the stored password are plain. Running the tree command on the directory where encrypted files are stored would give us something like,

    $ tree .password-store
    irc
    ├── efnet
    └── freenode

blfr• 11 years ago

Yes, it even has a built-in pass ls (which uses tree). It might be a feature, depends on how you look at it.

Frankly, just encrypt the entire drive. Otherwise, there will always be a leak somewhere. If not in the file structure, then in the swap.

uxcn• 11 years ago

You can avoid a lot of these types of issues using a digest for the username and password plus a master key as a salt. It generates a unique and relatively complex sequence for each site and doesn't require any persistent state other than the salt.

The downside is a lack of control over complexity and the issue of passwords being strictly dependent on the salt. So, if one set of credentials is compromised, you would need update them all.

I've seen software that does this, but there are subtle details to consider to actually get it correct.

tbe2• 11 years ago

For this reason I'm thinking of switching from gpg to encfs. It has an option for auto-unmounting after a period of unactivity. It would also play well with programs that need to read password from a file.

Has anyone else here had the same thought? This guy seems to at least;

https://github.com/equivrel/password-store-encfs/blob/master...

Edit: spelling

tincholio• 11 years ago

I just use a GPG-encrypted org-mode file... It's neatly organized as a table, and always easily accesible from my recent files buffer.

agumonkey• 11 years ago

So far 3 person mentioned this, tempting.

digitalsushi• 11 years ago

We created our password file with ccrypt, and modern vim can open it right up with no fuss.

aidenn02• 11 years ago

Reading in and storing the passphrase in a shell script seems like a bad idea, particularly since GPG already has a tool for reading passphrases that will cache your credentials.

[edit] I see that the passphrase is passed as a command-line argument. Aren't those viewable to other users on linux?

vog• 11 years ago

I'm using Emacs for something similar.

This works because Emacs can open .gpg files. It will decrypt them on opening (asking for your password) and encrypt on saving. This is very powerful in combination with Orgmode (.org), or any other module that provides auto-folding.

So I open my .org.gpg file and everything is folded. Then I search for what I need, and only that part (containing some secrets) is unfolded.

Of course, this is no substitute for a proper password manager, but proved to be useful a lot more often than I initially thought.

mct• 11 years ago

I've been doing the same with vim for years, using this vim script: https://github.com/mct/dotfiles-public/blob/master/.vim/plug...

frankzinger• 11 years ago

I'm not sure this is a good solution for this use case (password management).

The obvious way of getting the password out of the Emacs buffer is copy and paste, which leaves the password on the clipboard where it is very easy to find. Manually removing it (by copying something else) can't be relied upon. (If you use Klipper you have an even bigger problem.)

I know all bets are off with any kind of password manager if the host is compromised, but password managers and browser plugins presumably at least try to scrub passwords from memory, which will save you if you forget to lock your screen or your window manager has a screen lock bypass bug (very common).

The Emacs solution will protect you if you don't use full-disk encryption and your disk falls into the wrong hands, but that applies (or should apply) to all password managers.

What am I missing?

Edit: The same applies to the solution in the article.

akeck• 11 years ago

This and passwordstore.org are neat. I used to do one-password-per-gnupg-file with plain GnuPG commands, and liked it quite a bit. Lately though, I've been using passwords in plaintext in a AES256 disk image with a shared long passphrase. The main advantage so far is that other family members can use the disk image work flow easily. The main disadvantage is that the disk image format is OS-platform specific. I know that KeePass probably works best for family, so we may switch to that in the future.

ajross• 11 years ago

Why bother with the fixed functionality?

    (defun cc () "Secrets File" (interactive) (find-file "/home/ajross/.cc.gpg"))

Launch with "M-x cc" (which is simple enough) or bind to a keystroke. Emacs will prompt you for the decryption cleanly, your distro will surely cache them with gpg-agent, and you can then just edit it and cut and paste as you like.

I'm pretty sure it's "cc" because it was originally a list of credit card numbers, but quite frankly I've been doing this so long I've forgotten.

vdfs• 11 years ago

An other solution to manage password in one file using GPG encryption: https://github.com/boussouira/bash-pass

ufo2• 11 years ago

Does anyone know if there is a way to make something equivalent to this but using GPG's symmetric crypto instead of public crypto? This way you don't need to carry a key file around with you, just the encrypted secrets.

noondip• 11 years ago

This is a great point. The advantage I see to using pubkey is integration with, for example, a cryptocard (https://trmm.net/Yubikey). Still, I wonder if the default should be to use gpg --symmetric instead.

ufo2• 11 years ago

The reason I asked that is because last time I messed around in this problem space I had some trouble making gpg-agent remember the password for symmetrically-encrypted stuff.

jimktrains2• 11 years ago

https://github.com/jimktrains/polygonus was a little tool I wrote a while back.

drethemadrapper• 11 years ago

I was going to try use one of these solutions, when I read on the EFF that they all provide a single point of failure.

If anyone gets hold of your master key/pwd, they would have access to all your usernames & pwds.

https://ssd.eff.org/en/module/how-use-keepassx

Best to keep them separate - in your brain!

asmicom• 11 years ago

The best advice I had heard in ages!!!

I was also about to join the bandwagon of using a password manager.

Foxboron• 11 years ago

Thats true, but you do forget someone. If you use four-five different password spread among different sites, they will be easier to break then any generated password from keepass, pass or passwordstore.

If anyone gets hold of your master key/pwd, they would have access to all your usernames & pwds. You would still need access to the physical storage medium. This is either a threat or not depending on your threat model, and for most people this is simply not a threat. And tbh, if someone got a hold of your unencrypted computer you got another problem.

ghoul2• 11 years ago

A bit late to the party, but for anyone who loves pass/password-store etc, but does not like the entry names themselves being stored in the clear, I have a port of pass that fixes exactly that problem:

https://github.com/abgoyal/password-store2

Yes, it even has bash completion. Its fallen a bit behind the upstream as I have not had the time to port in the new features (nor felt the need :-/). Comments/patches welcome.

Show HN: Manage passwords with GPG

Related Stories