Comment by yason | Hacker News Reader

Comment by yason | Hacker News Reader

I've considered a password management system many times but I can't think of something that's not over-engineered.

So, for the last 20 years or so, I just have a single GPG encrypted file that contains the list of my passwords for various sites and services, ssh keys, and whatnot. I usually read and write that file in Emacs, or gpg -o - out to shell with an alias for quick read-only access.

The file is easy to backup and easy to distribute even carelessly: I even had it on my public www server at some point when I needed access to the passwords over the network.

I can't think of a simpler scheme than that.

Of course, the GPG keys themselves can lock and unlock my life completely. I have them in a separate backup file that is also encrypted using GPG but with a symmetric cipher. Thus, I don't depend on any extra files to decrypt my GPG keys.

As the passphrase for that symmetrically encrypted file is basically the master password to my life and because I've never needed it yet I store the password in a suitable physical location. But I can still distribute the backup file itself: even obtaining the passphrase to the symmetric cipher doesn't really expose my secrets yet. It will only give access to my GPG keys which in turn need my regularly-used private-key-passphrase to be useful at all.

I used to do the exact same thing as you, actually -- all the way down to keeping your keys with a symmetric pass & storing that in a secure physical location (for me, a safe deposit box). I switched to pass about a year ago because:

-it's the same scheme, the only difference is that your passwords are broken into individual encrypted text files instead of just one (potential SPOF advantage).

-it's more secure because you can set it up so your passwords never reach stdout (or any human readable display at all for that matter) with pass -c.

-it's just as easy to backup:

  gpg-zip --symmetric ~/.password-store

-pass itself is extremely portable.

-pass is way more convenient:

  pass -c my/password

is far quicker and several orders of magnitude less annoying than

  gpg -dao passwordfile.gpg

  <unlock private key>

  <copy password>

  <kill terminal>

  <use password>

  <clear clipboard>

Speaking from experience, I would say you're better off using pass than a single gpg'd text file.

Thanks for the comprehensive comparison. Pass does have advantages, I think I'll evaluate it myself too. The main selling point is the clipboard support.

> -pass is way more convenient: > > pass -c my/password > > is far quicker and several orders of magnitude less annoying than > > gpg -dao passwordfile.gpg > <unlock private key> > <copy password> > <kill terminal> > <use password> > <clear clipboard>

I agree with your sentiment, but if you keep your passwordfile well-formed, say:

    site.com username password
    #assume no spaces in password or username -- or use tabs

You could throw something like:

    gpg -dao passwordfile.gpg|awk "/${1}/ { print \$3 }" | xclip &&
     sleep 15 ; echo XXXXXXXXXXXXXXXXXXXXXXXXXX | xclip

In a script. With an agent managing your gpg passphrase (or not, depending on your pranoia) such a scheme would get most of the way there.

Not sure why you would want to kill the terminal, but you could just <command-run> or whatever said script...

In fact, for clearing your clipboard, just selecting some text should be enough -- but I supppose it might be considered a feature to have it in the script, in case one forgets.

My solution is similar--I have a tiny script of bash and gawk called "greppass" that I use to pull passwords from a colon-delimited text file. I don't encrypt mine (ssh, don't tell anybody) because the whole volume is encrypted, which I consider to be good enough.

I think even yours is over engineered.

I just write them down at home with a mental rule for replacing char position.

I do something similar, albeit more in fashion with the gp: I have a small-ish truecrypt container that has a "passwd" directory in which each service gets its own txt-file. The same container also holds a handful of other essentials, like a backup of my gpg keys and revocation certificates, ssh keys, emacs config, zshrc/bashrc and so on.

In each of the txt-files, I use a shorthand for the passwords. So if the actual password was "theansweris42", I'd have something like t...s42. This is enough of a reminder for myself (especially when using a more modular password system), without giving the full password away. In another, external gpg-encrypted file, I have a simple txt-file that contains both the password for that truecrypt container and the "translation" for the long form, i.e. t...s = theansweris and so on. This allows me to also use this file as a kind of dead-man switch. Should I ever die unexpectedly and somebody close would need or should have access to my accounts, they will be able to open the GPG file (because they are in it as recipients), which essentially gives them access to everything important.

I use a similar method, but with ccrypt: http://jonblack.org/posts/using-ccrypt-as-a-password-manager...

Reply on news.ycombinator.com