Hacker News Reader

Comment by sdan | Hacker News Reader

The benefit of Pass is it already has Chrome/Firefox plugins so all you need to do is press a keyboard shortcut and it automatically fills it in on the site.

Given SpicyPass doesn't have that, I think I'll still be with Pass, because it's free and simply amazing.

View on HN

Third party browser extensions (and cloud syncing) are two things that, while convenient, create potential security holes. I opted for security over convenience with spicypass.

I absolutely understand why this might turn some people off, maybe even most people. But I know that there are people (like me) who want something that isn't connected to the cloud, and isn't going to inherit all of the security flaws of their browser.

Not having a browser extension is also a security risk, because copy/pasting is error prone, and does not protect you from phishing - which is more of a risk than someone taking control your computer and bruteforcing your vault IMO (of course your threat model might be different from most users, for example if you store passwords not for the web)

(Disclosure: I work for a commercial password manager that do offer browser extensions)

I agree that there are risks either way, though like you said, the threat model is a bit different. SpicyPass isn't explicitly for web passwords. It's just a generalized key value store with added security. I use it to store my bitcoin keys for example, and that's probably not something you want to expose to the cloud and/or your browser.

With that said I don't rule anything out for the future.

There is also rofi-pass, which inserts data from pass into any X window.

Not to mention the amazing iOS app which syncs with Github and lets you add OTP codes by scanning QR codes.

Reply on news.ycombinator.com