Hacker News Reader

Comment by epistasis | Hacker News Reader

    $ dpg "The sentence" word

Doesn't this store all your secret info in your .bash_history file, an unencrypted plain text file, with a convenient marker for finding it in the history file?

This is no better than just storing the password that DGP generates directly; it's deterministic and trivial to derive the password.

For somebody concerned about a "master password" being insecure, this is a far far worse solution.

View on HN

Yes. And this is a great example of why titles like this one undermine any point the author hopes to make.

I'm a full time and, I hope, very capable developer. But I'm not a full time, capable password manager developer. Simply by virtue of the number of hours available in the day, the homebrew password manager I create in my spare time will never be as secure as the one made by someone who dedicates themselves to this area. So I'll just go ahead and use the one they made.

Worse it puts the secret into the process table where any user with ps can read it.

You could potentially add something like:

  HISTIGNORE='dpg *'

to e.g. your .bashrc -- not sure if the version of bash on OSX supports HISTIGNORE though (plus many other issues).

This is true but I'd be really hesitant to recommend it since the failure mode is so subtle unless you updated dpg to do something like loudly throw an error if that's not set.

The purpose of the C++ implementation is to test and validate the other implementations. Use the Python or Java versions.

Reply on news.ycombinator.com