Announcing gopass – A 'pass' compatible password manager for teams | Hacker News Reader

Announcing gopass – A 'pass' compatible password manager for teams

justwatch.com

128 pointsMetalMatze80 comments

> Second, with all due respect to the original author zx2c4 (who is currently working on the very promising WireGuard project)

Indeed I am working on WireGuard. But I haven't forgotten pass. We're currently working on a new release.

> the project proved to be a wild bunch of hotwired bash scripts that mostly looked like they were written as a one-off job

I very much disagree with this silliness.

First of all: Thank you for pass! We've been using it a lot internally and just because pass is so awesome, we decided to start gopass.

We use Go for almost everything at JustWatch and that's why we decided to rewrite it in Go as this would allow us to add even more features with better abstraction in the future. Bash just didn't feel like the right fit for that.

That's exciting, because now we get to find out how big a problem is a tool you use being in a language you don't. It might actually be a good idea if the original one is waning cause you only need to make a competitive version of any one of those tools or businesses.

I looked at the code for pass recently, and thought it was a nice example of something where bash is absolutely adequate.

You point out (in discussing the design of pass):

> There is one slight drawback to all the simplicity, and that is an information disclosure inherent to the design: pass stores all folder and file names in clear text, so even if you fully trust GPG, you should probably not put this repo into a public place like Github, because this may expose your account names and other metadata.

What's not completely obvious from a cursory read is whether gopass improves upon that. Also, the multiple stores feature looks like it might be quite nice, but a lengthier example would be very helpful!

Edit: improve clarity

I was just thinking the same thing and was wondering if I missed that? I have been working on a similar project for keeping bookmarks and haven't found (yet) an easy way to obfuscate directory and file names in a way that doesn't make the tree structure look like a mess but still makes it difficult for the majority of people to "crack".

Everyone should be free to choose how he handles his personal matters. This is one of the reasons why we wanted to keep full pass compatibility. So anyone using either pass implementation can switch at any time.

But I don't want to spend my time writing bash and sending patches by mail.

Jason, my apologies - that passage was me and at second look, written much more confrontatively than neccessary or sensible (I'll probably edit it as soon as I'm on a workstation). As they say, you can't argue about taste. Thanks for all your hard work, especially on pass.

Comment about pass... (looks like a great tool btw) you mention in the man page that

> Multiple gpg-ids may be specified, in order to encrypt each password with multiple ids.

That should technically reduce security, when encrypting the same secret with multiple IDs, as it gives a potential attacker more data to work with.

I suggest adding some randomness when encrypting with each key and having pass hide it from the end user when decrypting.

You're aware of an attack on RSA that weakens it when a short random string is encrypted with a handful of RSA keys as opposed to a single key?

Afaik supplying multiple ids to gpg simply re-encryps the same symmetric key for multiple recipients - the plaintext is turned into a single cipher text.

There is an attack against RSA if you encrypt very small values with a small exponent and insecure padding. GPG generates a large symmetric encryption key, and uses that to encrypt the message, uses 65537 (as is considered good practice) as its exponent, and uses a cryptographically appropriate PKCS#1v1.5 padding scheme

As far as I'm aware, there's no reduction in security by encrypting to multiple public keys (other than increased risk of compromising one of the keys).

Hey I dig pass and will try gopass but either way... thank you for doing what I was going to do myself, years before I tried to do it.

People like you are the reason people like me are in this business.

Fuck, I love the Internet.

I'm pretty excited about this actually. Thank-you so much for your efforts. I've been using pass for awhile now, and I really love what it does, but it's a case where it feels 90% finished.

I have one desperate request; colour output as an option. Every time there is an update to pass (or I need to reinstall) I need to edit the file and change the options from " tree -C " to " tree -n "

This is a pain in the ass. I am visually impaired. The 'default' dark-blue that tree uses for directories is unreadable to me.

My two choices for dealing with this are to use DIRCOLORS or edit the pass executable. I'd prefer to not muck about with my environment settings. (as I do not normally see any colour output)

Anyway; awesome project!

https://github.com/justwatchcom/gopass/issues/4

I just created an issue for that. Shouldn't be that hard to support it. Feel free to subscribe to the issue on github or comment any thing that's missing. Thanks!

This is my concern with pass. It's an awesome tool, but it really needs to figure out a way to hide the filenames. I think this is doable (after all, encfs has the same need, and does it well), but I don't know if the pass team have the will to do it.

> First, the project is curated in a traditional mailing-list based approach that was pretty unapproachable compared to a modern Github based workflow.

Sigh, not this again. I think that I prefer email vice a proprietary, centralised single point of failure like GitHub, and I know that I'd rather not work with someone who considers email unapproachable.

If your email account is unmanageable, fix it. Email's a really, really valuable tool; don't let go of it.

I don't see how GitHub is a single point of failure, the tool was developed on an internal Gitlab instance and then just pushed to GitHub. In case anything happens to GitHub you'd just have to push it to some new service and update the website. Nothing will be lost.

It's just more exposure to put it on GitHub right now because most people bookmark/star there repositories there and don't want to bookmark different cgit/Gitlab/gogs/gitea links. I don't think anyone is abandoning emails just because they don't want to email patches around and manually apply them.

> Sigh, not this again. I think that I prefer email vice a proprietary, centralised single point of failure like GitHub, and I know that I'd rather not work with someone who considers email unapproachable.

That's a fair debate in general, and I think you're right that there are some advantages to mailing-list driven approaches when they're done really well.

But after being subscribed to the pass list the last few months (and having seen similar situations on other projects in the past), I've been a bit underwhelmed with the actual execution there. There seems to be a lack of transparency around how to submit, what to submit, if/when/how it's considered or evaluated for incorporation, and when that might actually make it to a release. As a result there seems to be (even in this fairly short time) lots of repeated conversations about similar fixes/features/ideas and duplicate and overlapping patches around them.

I get that it seems to be a one-person show, and maybe not his/her top priority, and don't mean this as a criticism of the project (which I use and love.) But I think it's valuable to note that mail based models do really need active and engaged maintainers on the list all the time to make them work out well. If they aren't able or willing to do so, and want to be a bit more hands-off, I think github or something like it perhaps is a better model.

I use git-remote-gcrypt[1] for configuring remotes for all of my local Pass repos. I just point the 'gcrypt' remote to a file in Dropbox and voila, a fully encrypted Git repo for syncing all of my individual Pass repos.

[1]: https://spwhitton.name/tech/code/git-remote-gcrypt/

Holy cow, thank you for this!

That is pretty cool, although I'd _also_ like to have the filenames encrypted on my machine.

Shameless self plug, I actually build a project called passgo, modeled after Jason's pass project as well. I'm a huge fan of pass' simplicity, but I really dislike managing keys:

https://github.com/ejcx/passgo

The difference is mine does not use PGP and is instead password based, but the command line interface is almost identical. I now use passgo to encrypt and manage my ssh keys, etc.

Saw that in the process of writing gopass too!

> The difference is mine does not use PGP and is instead password based...

And we still wanted to use PGP because crypto is hard. :)

We're the team behind gopass and worked hard over the last weeks to bring you this - happy to hear any feedback!

I've used QTPass. It provides support to encrypt password directories to multiple keys. It allows for multiple profiles as well, so one can have a team password store as well as a private one. It can also auto push/pull. Plus it has a nice cross platform gui.

Can you elaborate on the differences between how gopass and QTPass accomplish these things and why one might want to choose gopass instead?

Actually, QTPass uses `pass` under the hood (which means you can use it with gopass as well!) and seems to have taken a different abstraction on it than we did, I didn't know about that project. That being said, with the next versions we're supporting much nicer features as well, such as binary secrets, grant/request workflows and other stuff. We cater to a command-line first audience, but there's nothing preventing you from using QTPass with gopass.

Roadmap

    Be 100% pass compatible
    Storing binary files in gopass (almost done)
    Storing structured files and templates (credit cards, DBs, websites...)
    UX improvements and more wizards
    Tackle the information disclosure issue
    Build a great workflow for requesting and granting access
    Better and more fine grained ACL
    Be nicely usable by semi- and non-technical users

>Tackle the information disclosure issue

I'm curious how you plan to approach this one. One nice thing about passff is that it can find the right password file based on if the file name matches the domain. I don't need to drill down to my bank/paypal file when I visit paypal.com for instance.

It would be nice if a public github repo would suffice, but putting a git remote on a usb stick works pretty nicely and is private as well.

I'm considering writing an implementation myself for a different audience, so it is nice to pick your brains as you've probably given this a lot of thought too :)

Looks great! Will be using this instead of pass from now on :) Any plans for adding fish shell autocompletions?

Autocompletion on zsh didn't work out of the box, but I'll give it a go for a few weeks and let you know ;)

Did you try this?

https://github.com/justwatchcom/gopass#autocompletion

Should tab completion work with gopass? Seems pretty unusable to me as a general purpose password manager without it, but it doesn't work for me out of the box with a `go get` source install.

Edit: found it on the github readme https://github.com/justwatchcom/gopass#autocompletion

I've been using `pass` for a very long time, and in combination with dmenu or rofi, it has proven to improve my workflow accessing passphrases a lot.

For 'teams' (and serv{er, ices}) I've started implementing some stuff via. vault-project [0]. The project looks really promising, sadly never got up-voted on HN so far.

The basic concept of vault is a centralized storage of secrets, managed via. Access-Control-Lists (ACLs) and accessible via. REST. Because the secrets are only accessible from a single point, you'll also have an overview of who did access which secret (called audit log). It's also possible to implement replacing all necessary secrets whenever someone has left/changed the group that got access to the secrets. Vault also makes integration in certain provisioning tools possible (though, that's something you need to spend more development in). Vault provides many database-backends [1], but also various other things (like ssh [2]).

Other things for managing secrets are:

- keywhiz: https://square.github.io/keywhiz/single_page.html

- keyringer: https://keyringer.pw

[0]: https://www.vaultproject.io/

[1]: https://www.vaultproject.io/docs/secrets/index.html

[2]: https://www.vaultproject.io/docs/secrets/ssh/index.html

Hashicorp's Vault is highly regarded in the DevOps community.

Yes. Vault is awesome and we're planning to use Vault ourselves.

However Vault is mostly meant for machines to read the secrets and gopass is designed for humans.

Really weird that there's no mention of 1Password and its flexibility through both 1Password for Teams and 1Password Shared Vaults. I work with 2 different teams that share passwords like this and one of them has a shared vault that syncs through Dropbox for everyone while the other one is managed through 1Password for Teams so that we can update passwords and access at our discretion.

I'm very curious to see how this will stack up against those solutions because, to be honest, there is very little room for improvement from 1Password, in my eyes. They have a very, very solid and secure product and the UI is fantastic.

Not viable until they support Linux which they've put zero effort into doing even though it's been requested for years. I used to use it in Wine which was decent but the Chrome extension couldn't talk to the app which makes using it a terrible UX (open app, search for pass, copy, paste, over and over).

Literally the only reason I currently use OSX. A password manager...

Here's the 6 year old 35 page thread if you want to throw your vote into a black hole; https://discussions.agilebits.com/discussion/2846/new-produc...

Instead they've become a SAAS Lastpass competitor which literally nobody asked for, in fact people were trying to leave LastPass due it it's forced-online nature (which naturally frightens people, having your passwords stored online somewhere).

> Instead they've become a SAAS Lastpass competitor which literally nobody asked for, in fact people were trying to leave LastPass due it it's forced-online nature (which naturally frightens people, having your passwords stored online somewhere).

I've used 1Password for a number of years and loved it and recommended it to friends and family, but their offering now just confuses me. I don't even know what their product is anymore, and I really need to be able to understand the attack surface of my password manager. So I've been looking into... other options.

I have zero faith in 1passwords engineering/security capabilities. They've been scooting by on "just good enough" for the last 5 years. They have introduced NOTHING new to the market in that time.

Someone will disrupt the market at some point and they'll be another has been because they've continuously been years behind of the market trends. I mean they literally just got into a SAAS offering and it had a hilariously botched launch; if you used their Win10 app (which you had to use to use their Family/Teams option) you COULD NOT LOAD A LOCAL PASSWORD DATABASE. For about 6 months I had to store all of my personal passwords onto my Team/Personal database because the win10 app did NOT have the ability to open a local password database. Now I've got 6 months worth of new passwords from my personal desktop stored on my work database and at some point I need to figure out a way to sync them together so I don't lose these passwords if I ever leave or so nobody else has access to them.

Absolutely blew my mind. Also, like you, I paid for the full app several years ago and here I am having to pay monthly, or yearly, I don't even know to get updates. I have zero idea as to how secure their online offering is.

Sorry, but this company makes me livid. If the other options weren't so terrible they'd be nothing.

Them acting like it's some engineering goddamned marvel to make their app work in Linux is just a slap in the face, especially considering how many people have made third party apps that can open their database in their free time.

I absolutely disagree. They have introduced all kinds of new features to the market and were the first password manager to support TouchID on the new Macs. If there's one thing that I can commend them on, it's their dedication to not making changes that might make their product less secure.

And your comment about having to pay monthly or yearly is either flat-out a lie or is completely disingenuous. If you own their app, you don't have to pay at all to update it. I haven't had to pay for updates to 1Password since I purchased it like 6 or 7 years ago. If you choose to sign up for their non-app SaaS offering, then of course you pay a monthly fee. To conflate the two is either dishonest or ignorant.

And no one's acting like it would be an engineering marvel. Maybe they don't simply have the demand to justify investing in a Linux app. If you don't like it, use their online service that has a Chrome extension. I don't really see what the problem is.

That depends on what you're looking for. Their app ecosystem is the same as it always was. They just offer additional SaaS options for team environments and for families. The only difference, really, is that the SaaS packages have an admin that can manage roles and access to passwords and divide a team/family into different groups.

We use 1password for teams and it sucks.

No Linux support, crappy website, high price.

I just spent a few hours to migrate our keepassx database to pass and make the team switch to pass.

Gopass seems great, especially the multistore support (which you can do w/ pass by setting an env variable), thank you for your work!

What made you want to switch?

I'm currently using Pass on most of my computers.

I was using Bruce Schneier's Password Safe (and various compatible apps: pwSafe on Mac and iOS and Password Gorilla on an older Mac and Linux boxes) and the big pain for me was merging changes.

I'd found that trying to use a single 'safe' via Dropbox was a recipe for disaster because some of the programs wouldn't cleanly close the safe file, or at least one of them would occasionally complain about the state of the file. So I created a copy of the safe for each of my computers and devices. Then every 6 months or so I'd merge all of the safe files into a single file and recreate all of the device-specific files as copies of that single file.

But merging in Password Safe sucked. There was no way to review the differences between entries in different safes, other than manually inspecting entries. I don't believe either of the two versions (Mac and iOS) of pwSafe (both version 1) supported merging at all. Password Gorilla was actually the best among the bunch as it had a nice 'diff' window with which you could explicitly pick which version of several fields for an entry you wanted to retain. But sometimes I couldn't get its 'diff' window to fit on my screen so I'd have to plug my laptop into a larger monitor.

Using Pass with Git is so much easier.

I've also been using git-remote-gcrypt[1] to push my local Pass repos to a shared 'remote' file stored in Dropbox. It works great.

[1] https://spwhitton.name/tech/code/git-remote-gcrypt/

The only painful aspects of Pass now is the weird behavior of `gpg` on Windows in Cygwin and the clunkiness of my current multi-repo setup. Hopefully running Pass under "Bash on Ubuntu on Windows" will mitigate the former. Given that Pass is written in Bash and that the various repo config settings are read from environment variables, it doesn't seem likely that the latter will get much better than my current setup, which involves sourcing a script to switch the relevant environment variables.

I know the pain of managing the synchronization of your password store. That's exactly why we enable git by default now and auto commit all you changes like pass did before. For me it works great personally, but also with a team it's awesome. It just feels like working with people that know git on something not encrypted.

Regard the windows support we would be happy to get as much feedback on that as possible. Nobody of us uses windows with gopass. If you have any idea how to improve the experience please let us know. Thanks!

This looks great, I've been toying with something similar built on top of Keybase that I just use for personal passwords, but using KBFS means it should be simple to extend it to shared passwords, since you just store it in the `private/me,you` directory instead of `private/me`.

My concern with using something like this or pass is that I have to manage the distribution/backup of the store/vault/db myself - whereas I can throw my laptop off a cliff, buy a new one, login to Keybase, and my passwords are still there.

I quickly looked to see what git library gopass is using, but it looks like git is just being called directly: https://github.com/justwatchcom/gopass/blob/a6f88e079be193f8... . Surely libgit2 would work well here.

Pretty neat, and addresses a space where no tools seem to exist.

Would be cool if it could leverage a GitHub public repo for password updates. Something like using the list of collaborators on a repo, iterate over their GH public keys, and push new encrypted files for each collaborator on the repo.

I suppose though, this would leak a lot of metadata on how the tool is being used, and would tie it too closely to GitHub vs just git.

You can use a public repo - we just wouldn't recommend it at this point in time, for the obvious reason of metadata leakage. We're currently thinking hard about how to enable this while still leaving the nice properties of git merges alone - might be some kind of shadow mode with hashed identifiers in the end.

> Pretty neat, and addresses a space where no tools seem to exist.

It's literally a port of an existing tool, so a tool DID exist.

The space is "team sharing" for passwords. My reading of the post says that's a net new feature.

Or did I miss something?

pass doesn't lack anything for "team sharing". You can add the GPG keys for multiple users ("team"), and they can all read those passwords.

From what I can tell, gopass adds nothing new here (they even brag about using the same format/interface).

There's a Chrome+Firefox browser plug-in which also uses a native binary written in Go: https://github.com/dannyvankooten/browserpass/blob/master/br...

Yep. I'm using that extension on Chrome everyday with gopass in the background. Works great! Now that we published gopass I wanted to take another look at the source of browserpass in the coming days. Maybe we can try to support both pass & gopass (with the new features).

I have a similar project that uses smartcards/HSMs/anything with a PKCS#11 interface called "hunter2":

https://chiselapp.com/user/rkeene/repository/hunter2/

Hey there, Vault auhtor here ( not the Hashicorp one, ours is earlier). Wondering if you came across our project https://github.com/franela/vault

so this intended to be unix focused, not something that could replace lastpass for example? been looking for something better than lp.

We're happy to include Windows as well (shouldn't be that hard to integrate thanks to Go), but there's simply nobody using Windows in the team at this point. Feel free to contribute - this project is meant to be the rock solid base of a very versatile password manager ecosystem.

Oh freck, that was a first thing I thought - finally native pass on Windows. When I came in the docs to the mount land I stopped hopping.

Being that mount is needed for just one feature that I can totally live without, what are the other obastacles to proper x-platform solution ? AFAIK all other deps are available on native Windows (not cygwin or ubuntu4win).

I will definitivelly try to see if it works.

dashlane?

this is the first i've heard of dashlane -- looks more or less like a lp clone, can someone give me a comparison rundown/why one would prefer it?

They are both password managers and will have similar features. Google "lastpass vs dashlane" and you will find several comparisons

I'm a fan of 1Password.

Just moved our company to 1Password Teams and it's great.

Same. Really surprised that this and my comment are the only mentions of it. 1Password for Teams is great!

1password is ok but has issues tried them for about a year.

Lastpass does some things well but it's not had the greatest record on UX or on security.

1) The prompt to "create new site?" is so dumb it commonly saves URL junk as the homepage like http://mysite.com/create-new-account?huge-long-querystring. You have always manually edit the vault to keep it clean.

2) The form detector to auto-fill username/password often can't find the right fields forcing you to manually copy/paste credentials.

3) On iOS there is no way to autofill address/cc (identities) from the extension

4) They've been compromised, and even afterwards one guy found like 3 zeroday exploits in a weekend and thought it was so bad he couldn't believe people were using it.

The list goes on and on with primary usage scenario problems they could do better at but simply do not for whatever reason.

It really boggles the mind why there is no Open Source Lastpass/1 Password Teams/etc. Clone/Rewrite.

There was TeamPass, which was buggy as hell and shouldn't be touched with a long pole... ...but why is there nothing else?

Where can i donate twice my yearly LastPass fee to get something self-hostable opensource and fund their Audits?

And no, Keepass in Dropbox/NextCloud/WhateverStorage doesn't work for a company that has Non-IT People needing access to passwords.

Because tools like this are expensive to do, especially when you want things like mobile clients.

I'd love to open source my self-hosted team password manager, but I just don't know how to afford it.

How about the GitLab EE Model? My company would gladly pay for an open source solution, even if it had to pay for it.

A per User License with the True Up Model is really sticky.

Well there is rattic, but it is unmaintained.

http://rattic.org/

Another unmaintained one is mitro

https://github.com/mitro-co/mitro

And therein lies the problem, teampass's last commit was quite a while ago and does not address the recent PHPMailer CVE as far as I can tell.

I have a rogue install of teampass that I'm trying to get stamped out and would love to find a proper alternative.

If I may shamelessly self-advertise, our (commercial) team password manager is intended to be fully cross-platform: https://pave.software/

(Mobile OS clients are on the roadmap.)

Any example of a company where few people badly need to share password and there is no "team" where you can add new users?

A comparison between this and Vault would be super useful.

Vault is pretty cool as well, but hard to set up correctly (you need your own PKI for serious use, etc.) - it's sweet spot are server sided and app secrets used in production, while gopass is meant to cater for all kinds of shared secrets in distributed teams.

I don't understand the distinction.

Vault's sweet spot is automated generation and revocation of credentials which are given to authenticated clients (like creating a one-off keypair for an SSH session & giving the private part to the user and allowing the server to read the public part).

We're currently testing the waters of migrating our pass-like shared password store to vault (so we can grant authorization to automated scripts to read certain shared rotated creds).

I would very much encourage anyone to use Vault to manage secrets consumed by machines, but for personal credentials it's maybe not the best fit.

One of my ideas was using Vault as an alternative backing store for a gopass mount actually. And then it's Vault for company secrets (and no hassle with keys due to central PKI) and gpg for private stores (fast & simple to set up on your own).

Can you elaborate? (I know why not to use Vault for my banking passwords, also why to use it for the bind password for some app's LDAP auth backend)

A "PKI" is just a root signing key. I don't have strong opinions about Vault or the Vault approach in general, but I worry when I see people dispensing advice about secret storage who adopt the position that a PKI is a difficult thing to reason about.

Reply on news.ycombinator.com