- The fact that it's essentially unstructured data makes it hard to work with generically. If you have a username + password and need to use those in a script, you'll need to implement your own parser in your shell language in every script you need it in.

- `pass generate` to generate new passwords, maybe thanks to the above, replaces everything in the pass value by default. So if you had e.g. a password + secret question answers, if you use `generate` to get a new password it'll wipe out your secret question answers.

- It's very difficult to review history. I stopped using it a while ago, but since everything's encrypted `git diff` won't give you anything useful and IIRC the command line tools were very hard to use for reviewing/restoring passwords when you mess up updates, etc.

- The name makes it nearly impossible to search for

I've been working on something similar... although with slightly larger scope (intended to be used within containers/sandboxes) https://github.com/andrewbaxter/passworth

I used pass for a while but couldn’t see what threat model it actually solves:

If you let GPG agent cache your key, any script (e.g. an npm post-install) can just run `pass ls` or `pass my/secrets` and dump all your credentials. At that point it’s basically just full-disk encryption with extra steps—might as well keep everything in ~/passwords.txt.

If you don’t cache the key, you’re forced to type your long GPG password every single time you need a secret.

I tried a YubiKey for on-demand unlocking, but the integration is clunky and plugging it in constantly is a pain if you need passwords multiple times per hour.

I eventually switched to Bitwarden.

Or if someone newly needs access, there's no standard way of re-encrypting the files you're guessing they need. You need to hack something together yourself

It uses git, but the commit messages are autogenerated and useless. It might as well have used Dropbox for all the use you get out of it when wanting to find the version before someone corrupted data with their somehow-broken gopass client

There is no way to ever erase anything you've accidentally pushed, short of rewriting the git history and breaking it for everyone (or for personal use: other client devices)

It looks nice and simple, and I like that I can interface with it with manual tools (e.g. write my own commit messages to have some idea of wtf is going on, e.g. when mass-reencrypting to not have 300 commits), but the simplicity is also the pitfall. Feels a bit similar to using hash(site_name+main_password) as a per-site password: beautiful in simplicity but various practical issues

Does anyone have good experiences with a password manager for a corporate environment? Ideally not having yet-another service to maintain, but also not have a server compromise equal business compromise (so end-to-end encryption between the users; verifying fingerprints or some such). From what I found so far, Bitwarden seems to meet that bill but I don't know if there are also others

https://github.com/tadfisher/pass-otp

The pass android app is really nice too

https://play.google.com/store/apps/details?id=dev.msfjarvis....

It also works in termux

Two main reasons:

1. This laptop up was set up with flatpak versions of all GUI applications, including Firefox, and the browser plugin just doesn't work. I persisted with the work-around of `pass -c <path>` from the run command prompt for a while to paste into the browser, but its not ideal.

2. I realised that the Android app was archived. There's at least one fork, but who knows how that will be maintained going forward. https://github.com/android-password-store/Android-Password-S...

For now I'm content with hosting vaultwarden and using various Bitwarden clients.

There is also a drop-in replacement with has some extra features and a bit better UX in some parts, personally I only really use it for the better support for handling multiple GPG keys, as I got some physical backup keys and it can be also nice teams for a shared vault.

https://www.gopass.pw/

https://github.com/gopasspw/gopass

* Your secret key can be stored in Yubikey, handled by a dedicated OpenPGP agent. This allows deriving a strong key from a weak one. Your password is basically a short PIN with max 3 tries. Every password retrieval can require a physical touch. This is convenient and secure!

Pass makes sense if you use it with a hardware key, with touch enabled. With this setup, it’s hard to beat its security.

* It uses public key cryptography, and comes with its advantages. You don’t need your master password to add/encrypt passwords. You only need that for decryption. Less exposure of master key, and more convenience.

For that reason, it’s well suited to share passwords with other people or devices. You can encrypt to multiple public keys. This adds multi user and device support.

You can easily add a backup offline public key (which you may print) if you lose your Yubikey.

* You can decrypt a single password without decrypting and exposing other passwords. The passwords are isolated, if you use Yubikey.

* Searching passwords is quick and transparent. You easily see what is in your store.

* You can use it programmatically, eg, your backup script can grab a password from the store.

* It’s a short bash script that you can verify, and delegates encryption to a dedicated well-audited cryptographic tool.

* PGP is a standard, and GPG and git are widely available. There is no database to break or migrate. You can read your passwords anywhere and in the future.

* The script is written by the creator of the acclaimed Wireguard!

There are also cons.

* Some people don’t like that it leaks metadata (filenames, and password tree), though there are versions of pass that fix it.

* Lately gpg is causing some troubles with Debian Trixie. GPG agent frequently locks the Yubikey and requires restarting pcscd (probably due to conflicts with pcscd). There is a similar tool Passage using Age, maybe that solves it.

* There are mobile apps, but they are not as frequently updated as something like Bitwarden apps (which has client for every OS, and frequently fixes bugs and adds functionality).

* I haven’t used and not sure how good browser support is.

Here is a post on a similar password management with GPG replaced with Age

https://words.filippo.io/passage/

Granted on the desktop I find using a (qt especially) GUI more invasive than a terminal but at least on the Android side the app is quite good.

The one major downside to it is that it is absolutely unusable for sharing passwords because obviously that would require sharing my passphrase, and there is no way to “store” a password that someone else set. I’ve thought about writing a mode that would encrypt a string (eg a shared password) with the metadata-generated password and store it in a separate piece of metadata for that purpose, but the number of times I’ve needed that has been extremely small.

Each password file is AES-encrypted with my master password.

I copy the whole vault around between machines with rsync.

When I run 'password bank' a shell script searches ~/private/Passwords for files that contain ‘bank’ and offers a menu, then gpg-decrypts the file I selected.

I also use this for scans of my passport, recording my bank account numbers, and anything else I want to keep around.

I thought I was the only one, and now I've found out there are thousands of us!

But a life saver is using it with <https://github.com/skeeto/passphrase2pgp>.

This means we don't need to move gpg/ssh keys we can just recreate them by remembering their passphrase (and other stuff like the date if we want).

  # gpg key for the encryption of the password-store
  passphrase2pgp --subkey --protect=2 --uid "helloworld" | gpg --import

  #for access to the git remote repo add to it this public key :
  passphrase2pgp -u emergency -f ssh -p > ~/.ssh/emergency.pub
  #only use it to install a non-emergency key as a new authorized key :
  passphrase2pgp -u emergency -f ssh | ssh-add -

Funnily enough I never used `pass generate` once, even tough I have more than 3700 passwords. I always used the `pwgen` command, I don't know if there really is a big difference between the 2 (except pass generate being already in pass).

As for how to structure, here are some example of how I do it :

  <service>/email
  <service>/otp
  work/<service>/password
  homelab/<service>/username

Then it's very easy to get the password or the otp, just bind `passmenu`, `passmenu-otp` in your window manager or directly use the command line for multiline stuff.

Pass is just a shell wrapper around gnupg, when you run pass some/secret/path, what actually happens is pass constructs and executes a gpg command (e.g., gpg --decrypt ~/.password-store/some/secret/path.gpg) and the output of gpg (the plaintext secret) is piped to pass's stdout.

Most people know this though. What I learned I didn't know before though was this:

Memory Zeroing: after it's used (e.g., copied to a pipe or stdout), GPG's internal memory management aims to zero out those memory regions used as soon as they are no longer needed

Memory Locking: GnuPG also uses mlock() (or equivalent OS-specific calls) to lock sensitive memory pages into RAM. This prevents the plaintext keys and decrypted data from being swapped out to disk, protecting against swap-file forensics or cold boot attacks.

I had been banging my head against bash trying to do those things manually, and ended up with the conclusion it was best to use pass/gpg with the following addendums (from my notes in my skeleton secure bash template):

1. Minimize secret lifetime: Use subshells, functions with local variables, and unset, disable bash history

2. Pipe secrets directly: Pass secrets via stdin or process substitution directly to the consuming program without intermediate variables if possible.

3. Rely on the tools: Use pass, gpg, or KMS CLIs that are themselves implemented in lower-level languages and can (and should) implement these memory protection techniques internally.

ps: keepassxc is the other favorite to use

https://codeberg.org/jwgarber/napa/src/branch/main/database....

What i love in particular is the combination with OpenPGP keys on a yubikey. Because of this you have two factor and more importantly, you unlock each password individually. This way an attacker can't steal your entire database of passwords even if they have full control over your computer. They can only see the passwords you unlocked. Because each password requires a physical touch on the yubikey.

With some other community favourites like keepass and bitwarden, once your database is unlocked, all the data is open..

Related: https://github.com/gopasspw/gopass

I haven't used pass in a long time, but I used gopass for a while in a small team and it was pretty great.

The keychain is accessible with a cli, but is not very nice to work with. Which is a bit sad, because being able to use touchid when running a script or signing commits would be nice.

Depending on which genre, managing key-rings has element of physical security to encrypt signatures in terminal and bash shell.

For full disk encryption, genfstab and /boot/grub/grub.cfg should contain sigs for partitions.