Show HN: Passbox – Another password manager using Bash and GPG

Show HN: Passbox – Another password manager using Bash and GPG(github.com)

41 points by RobBollons 10 years ago | 33 comments

sasvari 10 years ago |

pass - the standard unix password manager

  Password management should be simple and follow Unix philosophy. With pass,
  each password lives inside of a gpg encrypted file whose filename is the
  title of the website or resource that requires the password. These encrypted
  files may be organized into meaningful folder hierarchies, copied from
  computer to computer, and, in general, manipulated using standard command
  line file management utilities.

http://www.passwordstore.org/

drdaeman 10 years ago | |

Downside of pass is that the filenames are in the open. Thus, metadata (which sites you have account on) is not secured. Linked one seems to store everything in a single encrypted file.

Upside is that it has ton of implementations readily available - browser integration, mobile apps, etc. Linked one (passbox) is just a bash script at the moment, if one wants to use it across multiple devices and platforms, the experience may be quite rough.

Another upside is that with a single file model you have to invent your own conflict resolution scheme. For pass, git just does the trick. And this one doesn't seem to have anything in this regard.

deathanatos 10 years ago | | |

> Downside of pass is that the filenames are in the open.

The "entry" names (which I think would correspond to filenames in `pass`) appear to be passed on the command line here; they'll likely get swept up in your shell's history file, unless you're careful. (And thus, are essentially in the open, just like pass.) That said, I think most shells make their histfiles 600, so they're not directly readable. (And I think `pass`'s directory is 700, similarly.) And you have to trust the machine you're running on, of course; otherwise, I can just dump the memory as soon as your keyring is decrypted.

I think it was when `pass` was on HN that I mentioned this; I have a terminal keyring manager myself[1], but one of the design decisions I made in it (aside from a single-file archive) was to not pass entry names on the command line, specifically so they won't get swept up in histfiles. It's easy, though, it make it optional, and let the user decide what they want to do. Of course, your

[1] which is way not ready to be looked at… also seems like we as a crowd enjoy this topic (keyrings) as a side project.

jessaustin 10 years ago | | |

...filenames are in the open.

Is this something that can't be fixed by directory perms?

ape4 10 years ago | | |

I agree. Perhaps a zip file with a password?

fensipens 10 years ago | |

the standard unix password manager

Annoying amount of hubris.

This pile of unattractive bash-snippets is neither unix nor standard. Just call it what it is: A very dependent script that will probably work on most GNU/Linux distributions.

RobBollons 10 years ago | |

Good shout, I've added it to the 'Similar Projects' section of the readme.

I had a play with 'pass' before but i wasn't keen on the way it splits the entries up into separate files which was one of the drivers for putting passbox together.

reedlaw 10 years ago | | |

Is there a way to share passwords with passbox? pass lets you encrypt different files with different keys so it could potentially be used within an organization with varying levels of permission. Another advantage is that each password is just an encrypted file that could be read with just GPG if pass isn't installed.

klapinat0r 10 years ago | |

I've been using pass since mitro.co announced their shutdown.

The only (somewhat big) downside to this, and related unix pw managers is the sheer lack of browser compatibility - mobile would also be nice, as that's one of the places where it's a PITA to use and enter long passphrases.

pass claims to have both, but doesn't:

https://github.com/jvenant/passff#readme does not work.

The iOS app has disappeared from github: https://github.com/rephorm/pass-ios#readme

It's solvable problems, I just find it a somewhat important part of a password manager.

teh 10 years ago | | |

I'm running a small agency with two friends and we're keeping mitro alive (and better: are fixing issues) here: https://passopolis.com/

Firefox and Chrome extensions are working, and I'm currently spending a few hours a week on migrating to the new Firefox-extension protocol.

RobBollons 10 years ago | | |

I suppose it just depends what you look for in a password manager. I tried lots of solutions from Last Pass, KeepassX to pass but i prefer the scriptability and portability of a command line based password manager and i'm not overly bothered about mobile and browser.

cornstalks 10 years ago |

How do you work with these terminal-based password managers? Request the password (à la `passbox get facebook`) and then copy 'n' paste it into the website?

Are there any security concerns of the password being in the clipboard/memory (beyond the obvious of accidentally pasting it)?

RobBollons 10 years ago | |

That's definitely a way of using it, another is to just manually type it in as you see it and clear the terminal buffer afterwards. If you do use your clipboard it does require a certain amount of due diligence in making sure you empty it afterwards if you're concerned about that as a security risk. It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay.

It would be possible to construct an attack using Flash to access a users clipboard form a web browser.

I know a lot of people like to have browser plugins for password managers but i always feel uncomfortable using them because i don't understand enough about the technology to trust that it wont be vulnerable.

sasvari 10 years ago | | |

It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay.

pass [0] (see comment above [1]) claims to do that:

  show [ --clip, -c ] pass-name
       Decrypt and print a password named pass-name. If --clip or -c is specified,
       do not print the password but instead copy the first line to the clipboard
       using xclip(1) and then restore the clip‐board after 45 (or
       PASSWORD_STORE_CLIP_TIME) seconds.

[0] http://www.passwordstore.org/

[1] https://news.ycombinator.com/item?id=10190719

adam_albrecht 10 years ago |

This looks very nice, but I would need browser extensions and mobile apps to go along with it.

1Password is honestly the one app that has kept me from switching to Linux from OSX. Would love to see a decent open source alternative.

UK-AL 10 years ago |

Has anyone build a hash style password manager.

hash(website name + global password + increment) = password to use?

or something like it

Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities.

show [ --clip, -c ] pass-name Decrypt and print a password named pass-name. If --clip or -c is specified, do not print the password but instead copy the first line to the clipboard using xclip(1) and then restore the clip‐board after 45 (or PASSWORD_STORE_CLIP_TIME) seconds.