Hacker News Reader

Comment by KSPAtlas | Hacker News Reader

I personally use GNU Pass as its a simple local password manager, no strings attached. It can also generate passwords.

Props for pass. (Is it GNU pass though? I can't see a mention of it being a GNU utility anywhere on https://www.passwordstore.org/ - I only see it's a "Unix" password manager.)

I have a rented VPS whose main two uses are being my IRC host (irssi running in a tmux) and hosting my Git repository containing the pass password store. As long as only I can SSH into the VPS, my encrypted password collection won't leak; as long as there is no keylogger or clipboard logger on the machines I use pass on, my passwords are secure. (I assume that SSH and GPG are unbreakable, which seems good enough of an assumption for the time being. Perhaps I'll switch to passage instead of pass some time in the future.)

Do you find that the lack of a browser extension makes it easier to get phished by failing to accurately read the URL? That's one of the stronger arguments I've heard for a browser autofill feature

No idea, honestly. I think I am lucky and I do not get targeted by many phishing mails. (Let's see how much things will change now that this comment is public.)

That might be the case for normies who click phishing links or SEO-optimized phishing sites that appear on Google search results (instead of, you know, just typing the URL of the site they want).

I tend to navigate by URL or browser history, so I just don't enter phishing URLs.

An extension could save my ass in the scenario where a legit site (e.g. a shop) has been compromised and the redirect to payment services has been replaced with a malicious site, but I don't believe that's very common?

Reply on news.ycombinator.com