urld

Nice read. I'm looking forward to try out a bunch of those things. But my favourite part is the SOCKS proxy. It reminds me of simpler times, when we used this to freely use the schools wifi, which had an overly restrictive web proxy.

You dont necessarily need "integration" to achieve this. You can always put a file under version control.

I've stole some links from https://github.com/gioele/pw to show that there are downsides to the separate files approach:

http://nms.csail.mit.edu/projects/ssh/

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2666

Thank you for all of your feedback.

I've already implemented some features based on your ideas:

- configurable timeouts: https://github.com/urld/passmgr/commit/069c209

- basic filter functionality: https://github.com/urld/passmgr/commit/3c4b1ed4

But i think the UI needs improvement, and core features like master passphrase updates are still missing. Also the clipboard handling could be improved (depending on the platform).

Im not sure yet, if and how browser integration or iOS/Android clients could or should work with passmgr, but if i have time i will think about it.

It depends on how you use it. As long as the identifiers are not visible to anyone else (like you described), its okay.

But if you sync your secrets across devices, using services that are not under your control, or your device gets stolen, more information than necessary got leaked.

I think there are many users or who dont want to setup gpg on multiple machines. I can also imagine scenarios where it is simply not possible to setup gpg on every machine. Maybe you could workaround such scenarios with portable versions of gpg or something like yubikey.

However i like the idea of having a single binary with a minmal set of dependencies, which can be moved around easily wherever i want to use it.

Personally i dont see the point in integrating synchronization features for now. There are already tools which are good at synchronizing files. And since everything is stored in a single file, it should be trivial to setup sync. E.g. you could do so with an alias like: alias passmgrgit='git pull; passmgr -file xxx; git commit -a -m "updated";git push'

You are right, the 6 second limit is on the low end. Ther is also a timeout for general inactivity which is currently set to 60 seconds. I want to make them both configurable and provide better defaults.

The storage of arbitrary secrets is definitly on my todo list.

As for the git integration i do not see the point of having it. For someone who is able to set up a remote git repo, it should be trivial to use git for synchronization, even without "git integration", since everything is stored in a single file.

I have not yet looked into browser integration or clients for mobile platforms, but maybe there is a way to integrate with existing apps/extensions.

Lets wait together then. In the meantime i suggest this link: https://team-sik.org/trent_portfolio/password-manager-apps/ Almost everything seems to be terrible.

Featurewise, no (not yet). However i think my aproach, using a single encrypted file for all secrets is somewhat more secure as it does not leak information like what sites are managed by the password manager.

I guess you could also argue that by using AES, passmgr has the advantage of being post-quantum secure, if that is important to you.

Good point. Im going to implement this, although its probably not possible to make it an atomic operation.

The main difference is, that passmgr uses authenticated symmetric encryption (aes-gcm) to store the contents in a single file, while pass as you already mentioned stores each secret in a separate file, using asymmetric encryption provided by gpg.

Storing secrets in separate files could leak metadata, especially when using a public git repository for synchronization between devices.

Other than that, you dont have to deal with gpg key management in passmgr.