I just use pass: https://www.passwordstore.org/
Will it also suggest me my passwords in iOS?
Come on, guys, 1Password is not only about syncing passwords between N computers.
Not that I recommend this setup though.
https://news.ycombinator.com/item?id=9224
(If this is not a joke, yikes).
Syncing is also very easy for developers - just use git.
Sure, you could... but there is a monstrous gap between that and the real service that you are comparing it to.
I appreciate it if you're like "look, the convenience outweighs the safety," but it really feels like most of these discussions hand-waves away this fundamental flaw.
I say this especially as someone who doesn't do a lot of passworded services on my phone, because, you know, that stuff is really insecure no matter how good your password is.
https://news.ycombinator.com/item?id=26801155
Also, depending on your phone, it might be significantly more secure against non-superpower actors.
I'm generally fine with this if the password vault is end-to-end encrypted, the vault's password is never shared with the server, and the server doesn't have access to the plaintext passwords at all.
At that point you have to trust that the crypto used for the vault is done correctly (and that trust is easier to come by if the clients are open source). But that's the same trust you'd have to extend if you used another solution (e.g. Bitwarden) that allowed you to self-host the sync service.
If you only access password-protected resources from one system, then you don't need sync at all, and this problem goes away. If you do need sync, you're going to have this problem no matter what.
(also, I have no idea exactly what "end-to-end encrypted" actually means these days, given the loose way many apps/services seem to define it.)
At some point the paranoia isn't productive anymore.
Partly given 2FA, but more importantly the fact that I check my email pretty frequently (most of them will be like "hey, someone's trying to change your password, is it you?), I don't think that's a fair comparison.
Properly engineered a cloud-based password storage system should be at least as secure as email, if not moreso (and I believe 1password has it engineered that way).
There is a WHOLE LOT of incentive to try to hack 1Password and far less to try to hack my dinky email, or even, e.g. gmail to try to find what you're looking for as the hacker.
It would be cool if there was some open password management API that browsers/password managers could implement to solve this without extensions.
However, I primarily use it for the `gopass search` output. This is where `pass` really sucks for those who copy-paste.
There is also an extension: https://github.com/ficoos/pass-fzf
pass ()
{
if [ $# -eq 0 ] || ( [ $# -eq 1 ] && [ $1 = "-c" ] ); then
find ~/.password-store -name '\*.gpg' -printf '%P\n' | sed -e 's:.gpg$::gi' | fzf | xargs /usr/local/bin/pass $@;
else
/usr/local/bin/pass $@;
fi
}