Hacker News Reader

Comment by Kwpolska | Hacker News Reader

pass is simple on *nix. Pass is just painful on Windows and Android, probably on iOS too. I used to use pass for my passwords, but one day I switched to KeePassXC, which is a nice multiplatform GUI, has all the GUI niceties (and auto-type), there are mobile apps to work with it, and I keep my database synced with OneDrive.

View on HN

Pass works great for me on iOS for years now and it's open source too [0].

[0]: https://github.com/mssun/passforios

It's okay, not great. I use a second GPG key for the phone so as to reduce the number of passwords accessible there. While it works out of the box, getting it to work nicely needed a bit of plumbing[0].

Moreover, there isn't any support for Yubikey or smartcards.

[0]: https://captnemo.in/blog/2020/01/04/security-setup/#mobile-p...

Your mention of OneDrive made me remember that pass creates a cleartext copy of your password file, while you are editing it.

pass will try to create the file in /dev/shm but if this fails it will use $TMPDIR.

If you're on a platform without /dev/shm you'll want to use some other equivalent such as a small ramdisk, or at the very least be sure your $TMPDIR is not synced into the cloud.

I've been wary to trust the sync behavior of tools like dropbox or onedrive, as they permit concurrent edits of files. For things like encrypted password databases, there isn't an automated merge strategy that can be applied. I think they support versioning, so if two edits happened concurrently then the losing edit would be recoverable via versioning. Maybe that's not really a concern for a password database, as you'd likely be online when making a change? Anyone see issues with KeePass and sync tools?

Yes, in my experience, using dropbox, you end up with two versions of the keypass file (one listed as a conflict). I've been using this setup for ~10 yrs, and it has only happened 2 or 3 times, but as I'm the primary user, I would expect this to happen more often with a family sharing the same file. If things are working correctly, the keepass lock file created when opening a db is synced via dropbox, so any second attempt at opening the file on another system results in a warning to open it as readonly.

Because Keepass uses GUIDs internally for most operations, merging the conflict files is usually trivial (use the Sync options in the Keepass UI of your choice from your main file, then you can safely delete the file marked as conflicting). (The GUIDs thing has also meant that I've had some success merging unrelated files too over the years, though that is probably less advisable.)

One feature I like about pass is that it stores each password as a file. This makes syncing a lot more pleasant, rather than having to resync the entire DB each time a new password is added. Additionally, it is git-compatible and when you sync you can see what has been added/removed using standard *nix tools.

pass works great on Android. There's an app for it: https://github.com/android-password-store/Android-Password-S...

just dumped pass for the fact that it is extremely unpleasant on windows. it's actually pretty good on ios.

Reply on news.ycombinator.com