Hacker News Reader

Comment by alex_duf | Hacker News Reader

I don't like the fact someone with access to my hard-drive can figure out all the services I'm using just by looking at the filenames.

It's convenient yes, but I prefer one encrypted file that contains it all.

View on HN

This "issue" has been fixed with the pass extension 'pass-tomb' that keep the whole tree of password encrypted inside a tomb

See https://github.com/roddhjav/pass-tomb

However keep in mind it's not always a big "issue", for instance only looking at your browser history will retrieve the same knowledge.

I mount my pass dir with encfs. Mount when I need access to passwords, and no need to remember to close it before I shut down (or if the machine randomly crashes).

I can store the encfs encrypted tree on cloud storage (spideroak in my case) and have it synched across machines. Works pretty well.

Oh well... I wonder why they didnt make something like this the default.

s/they/he/

Pass is pretty much a glorified bash script using GPG and Git.

Adding filename encryption on top would be a nightmare, not to mention that terminal suggestions would be pretty much broken.

> not to mention that terminal suggestions would be pretty much broken

You can always write an (encrypted) index file that contains a simple list of all domains.

Storing all that information in plaintext just to make terminal suggestions easier to implement sounds shortsighted to me.

This shouldn't really be an issue if you're using full disk encryption.

That seems like saying why use an encrypting password manager at all if you're using full disk encryption, isn't it okay to just keep your passwords in plaintext on your encrypted disk?

Not if you use cloud backup or get a virus.

This isn't how real security works.

There is a concept for 'defense in depth', saying that every component should be secure on its own and not rely on other components.

Encryption only protects files at rest. The vast majority of attacks are against live systems connected to a network, where full disk encryption won't help you one bit. It is a nice extra layer of protection for when a device is lost/stolen, but I don't consider it a primary form of protection for any important data.

Check out pw, my alternative to pass, designed because of the reason you mentioned: I don't want my password manager to leak the list of services I use.

https://github.com/gioele/pw

In pw each password database is a single file, the internal indexes are random IDs. Each line in a database is a serialized GPG file with a password and associated metadata.

The file format is git-compatible and everything can be managed with standard command line tools.

yeah, from a security point of view it's similar to have one file or multiple ones encrypted with the same key

It's not. When you decrypt one file you have all of your passwords in-memory (terminal, clipboard, browser extension, qtpass). When you do that for one login/password pair you only expose that pair, not all of the others.

When you decrypt, you have the key in memory in either case. Assuming you don't put all the password into an untrustworthy output (terminal, clipboard, etc), what's the difference ?

Reply on news.ycombinator.com