Hacker News Reader

One major problem with this scheme is that if someone steals (or subpoenas) your computer they can discover all your passwords just by looking at your shell history. A password manager that's secured by a strong password doesn't have that vulnerability.

Edit: As jroes pointed out below, this is not a problem.

View on HN

They would only discover the domains, not the passwords you entered. You type the domain at the command line, but you type the password into stdin.

The program outputs your site-specific password to stdout. Is it possible for an attacker to get your stdout history?

Might be. Some terminal emulators save logs. "Unlimited scrolling" often goes to disk, possibly in a file, possibly in swap (Terminal.app makes it stay in memory, which once consumed 3GB of RAM for my long-lived "rails server" tab). iTerm2 allows you to navigate back in time, while Terminal.app saves some data on quit to display on restore (if OSX autosave is enabled).

When you allow less common tools to be used, one could use the bash or zsh read-builtin to read the master password without echoing (e.g. dash's read can not do that) and use xclip or similar to directly put the password into the X clipboard. With xclip's -l option you could even automagically "forget" the clipboard after it was pasted once.

Reply on news.ycombinator.com