Hacker News Reader

Comment by benjaminjosephw | Hacker News Reader

`pass` is a nice command line tool that stores gpg2 encrypted password files. It's simple, super handy and doesn't require you to trust any third party with what you're storing. website: https://www.passwordstore.org/ man page: https://git.zx2c4.com/password-store/about/

View on HN

+1 for `pass`. I wrote a handy Bash script [1] that lets me easily search my passwords without having an exact match (e.g., `fpass fin cap one` quickly finds my password info for "Financial/CapitalOne.gpg"). It makes pulling up passwords so much easier as I only need to remember fragments of how I stored it instead of trying to remember exact folders and names using auto-complete to find the password.

I also use iTerm2's system-wide hotkey [2] to quickly show/hide a dedicated terminal window that I use for retrieving passwords.

I've been using this setup for years now and I absolutely love it. The only downside is no access from my phone, but I always have my laptop with me and I memorize passwords that I frequently use.

1. https://github.com/raamdev/bin/blob/master/fpass

2. https://apple.stackexchange.com/a/48805

> The only downside is no access from my phone.

On Android, I use Password Store to sync my `pass` directory and use it from the phone. It a very high quality app, I had no issues after years of usage.

https://github.com/zeapo/Android-Password-Store

Keepass user here wanting to switch over to pass, this is exactly the missing piece of the puzzle I needed - thank you!

I'm looking into using pass / keepass, any particular reason you are switching over to pass?

I think I'm currently in a minimalist phase; the KeePassX UI is too feature rich and cluttered and makes me want to configure everything but I don't want to manage that.

If that's not a problem for you, KeePassX is definitely a solid password manager!

> The only downside is no access from my phone

For iOS: https://github.com/mssun/passforios works really well and it's open source.

Oh my ZSH (http://ohmyz.sh/), if you use zsh of course, has autocomplete, so folders and GPG files are only a few tabs away.

Don't need omz for autocomplete, it's already there in zsh. I TBH don't really like omz. It feels bloated, and I don't really need anything else on top of the already-awesome zsh.

Instead of hiding the window, why don't you look into using terminal colors to hide the password? That way the passwords aren't visible until you highlight them.

Better to use the '-c' option to put the password in the clipboard and not display it in the terminal.

If you're not going to use 1Password, which is still the only commercial password manager I'll recommend, "pass" is probably your best alternative.

As a LastPass user, any particular reasons why I should avoid them? Is it down to all the security issues they've faced lately?

Neither are deal breakers for me, but I get issues with their plugins sometimes.

The deal breaker for me before vs 1PW was that I would store quite a bit of info in 1PW for some logins. Filling out a whole sign up form might include birthday security question/answer, name, and more. For various reasons, I don't always use real info so having this info automatically saved or easily added as new fields is great. I know Lastpass has a few extra field options and a notes section within each login, but the fields aren't enough and I don't want to have to manually add all the info into the notes like some people I know do. I'd rather pay a few dollars more a month and get the convenience and time saved.

I'm sure it makes up for the extra ~$25 a year. And the family plan at $60 a year for up to 5 family members isn't a bad deal in my opinion either if that can work for you. I know it sucks compared to buying the apps one time, but I don't feel it is as bad the outcry was/still is.

I guess I'm looking at this strictly in terms of what is best for my day to day life. It's not worth it worrying about a few extra dollars a month when I only have a handful of subscriptions as it is.

1Password is the only commercial password manager I recommend, but I'll go further than that when it comes to LastPass and say: I really think you should avoid LastPass, and, if you're using it, migrate to something else.

I'm not going to go into details, sorry.

Why do the trouble of replying but fail to explain your reasons? That's wasting your own time mostly.

I would recommend 1password over lastpass as well. First reason being the security issues of lastpass chrome extension. Though claimed it is fixed now they have claimed before on other issues only to be proven wrong after. I simply don't trust them anymore with my data.

But even more I would choose 1password over its usability. I used lastpass before but switched during the past few security issues reported. I have never looked back. 1Password is much better integrated in your mobile devices. The app feels more robust and is easier to operate. In addition the whole process of setting up your devices felt easier and more secure using 1password.

Second. My wife understands it which is a big plus. She doesn't complain anymore about the cumbersome lastpass. We keep a shared vault as well. That alone is worth every penny and maybe the only reason I keep with a commercial password manager. I don't think she will use the alternatives.

I would strongly advice you to at least try it. It claims to be able to import your lastpass though personally I didn't try as my lastpass was a bit of a mess.

I understand why it makes people uncomfortable to know that they're not getting all the information I could possibly convey in a comment.

I don't see how that would make it better for me to not comment at all.

Because an advice without argument is ignored (in many cases). If it were me I would have rephrased my comment to include a summary. That would be sufficient to understand why you said things and in addition would be perceived less cocky. Now it came over as I'm saying this and you are not worth my time explaining the arguments.

Apparently you have knowledge on the subject so a sentence or five would have helped everybody reading this thread. In fact, it is what I would expect from an HN comment. I usually read the comments before the article as on HN there is often more information than the actual article. Most often different sides of the coin are in enlightened in the comments bringing insight in the otherwise one-sided monologue in the article.

I understand why you don't want to go digging up information to link, especially if using a phone. In this case, I think sharing a little truth about LastPass may benefit our community.

https://www.google.com/amp/s/arstechnica.com/security/2017/0...

https://arstechnica.com/security/2017/03/potent-lastpass-exp...

for a real link to the same article

If it's too much for a content, how about a link to a source that articulates your point? I'm sure many people would appreciate more complete information.

I suspect the reluctance to offer more than a brief recommendation isn't a lack of confidence in the argument, but rather a sensible level of restraint for someone who is in the security industry.

LastPass is the only commercial password manager I recommend. I really think you should avoid 1Password.

I'm not going to go into details, sorry.

https://www.google.com/amp/s/arstechnica.com/security/2017/0...

You do much work in this field?

It doesn't matter whether he does or not. He's using your own argument against you. Stepping in here and saying, "don't worry guys I'm the expert, so don't ask any questions", is just pompous and doesn't actually convince anybody. Use logic to support your claims, not your resume.

No, sorry.

It's funny. When I was the GP comment I thought "well that's not a very useful comment". Now that I've paid attention to who the author is... I'm getting concerned about LastPass :)

Are you able to say why you aren't willing to go in to details? I respect your CV and am going to switch to 1Password from LastPass based on your comment, but I'm curious whether I need to be concerned about my information being compromised.

Well, shit, two conflicting comments. Which advice do I take? Quite the quandary.

Is your recommendation of 1Password contingent on any particular set up (like only using a "local vault" and not their cloud solution)?

Switched from pass to gopass recently : (https://github.com/justwatchcom/gopass). It's open source and has a tad bit more features over pass. Some of the reasons for my choice to switch:

- compatible with pass

- support for multiple stores

- store binary data (e.g. QR codes for seeding 2FA) : upcoming

- report / track issues on github.com/justwatchcom/gopass/issues

- more details here : https://www.justwatch.com/gopass/docs/

fun fact: 2FA QR codes contain the secret as just part of a url. you don't need to save the binary image, just figure out what the (usually base32-encoded) secret value is, and store that. google authentcator lets you type in the base32-encoded secret (useful if your phone's camera is broken). see e.g. https://garbagecollected.org/2014/09/14/how-google-authentic...

The original pass seems to handle binary data fine:

    $ pass insert -m mybinarysecret <secret.png
    $ pass show mybinarysecret >secret.png

Admittedly, it's not very user-friendly, but some simple wrapper scripts could fix that.

Does pass still stote metadata unencrypted (as file names) or did they fix that now?

My main reason to not use pass is that I can't allow multiple private keys to unlock the password store. I don't want to transfer my private key between all my machines.

You absolutely can do this.

In your .gpg-id file, simply list the keys you want to encrypt for on separate lines. Every file below that .gpg-id file in the directory hierarchy will be encrypted for any of those keys to unlock.

Also you can re-init any time you want, listing multiple keys. This will go through all your passwords and re-encrypt them for each of the keys listed. That's how I got my phone set up with access (with its own locally-generated private key).

If you want more granular key strategy, look at gopass [1], which is a pass-compatible binary that gives a little more granular control over key usage (IIRC), and is written in Go.

[1] https://github.com/justwatchcom/gopass

Why not transfer the private key? I encrypted it using a one-time pass and send it using email. I then decryped and installed to the other machine.

Since I don't have the one time pass anymore the encrypted file is not usable anymore and I have the same key to both machines.

Please explain any holes with that flow.

Pass also has Android and (AFAIK) iOS clients, and many other frontends.

Reply on news.ycombinator.com