• @[email protected]OP
    link
    fedilink
    10
    edit-2
    7 months ago

    With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities.

    This sounds cool, but relies completely on OpenPGP. That is secure enough, right?

    But this also means

    • no metadata security
    • no usernames
    • no comment

    It is cool, but only having a single entry means you can not replace the website with a more anonymous placeholder.

    For sure this tool sounds pretty great! Especially encrypting everything seperately is very nice.

    But sometimes getting a name might already be too much.

    Also to avoid big brother connecting all data, I normally have an entry like

    Entry: MSOffice
    username: [email protected]
    password: •••••••••••••••••••••
    URL: xxxxx
    Comment:
       Username: xxxxxxxxx
       name: albert einstein
       birthday: 2.6.1956
       Security question 1 2 3
       TOTP backup keys: xxxx
       Random comment
    

    This is all not possible, which means I would need the same username everywhere, or remember it (I dont, I have 300 Keepass entries).

    In KeepassXC I have a single file. Hackers would need to bruteforce only one. But at least they wouldnt know exactly what they want to decrypt.

    • lemmyreader
      link
      fedilink
      English
      27 months ago

      Sure, I see what you mean. Note that I responded to the “this sucks” remark about pass by the other commenter. There is no one preventing you to use for example one password entry with Pass on a remote work server logging in with ssh sharing it with a colleague while having the other 100 password work entries kept in KeePassXC and then using Bitwarden for your 200 personal passwords.

    • @[email protected]OP
      link
      fedilink
      27 months ago

      I wonder if you could just encrypt a storage which is then used by pass unencrypted. So you have double encryption using something like gocryptfs.