Jason Donenfeld

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to use.

Until I came across this: http://www.zx2c4.com/projects/password-store/

It is simply the easiest, most intuitive password manager out there. One of those things that, once you come across them, you wonder why it took so long for something this logical to come into existence. I am not associated with the project, but these are just a few things I love about "pass"

1. Command-line based: which means I can script it, I can run it remotely, etc.

2. Uses Git to store the passwords: full revision history, changelog, and remote push/sync features that git is SO good at. Other password managers have to reinvent that whole wheel and none seems to do a good job. This also eliminates the need for "hosted" solutions - which I just simply refuse to use.

3. GPG for password encryption: once again, such a natural, awesome way to do things. GPG is already the safest way practical way to secure data-at-rest. I can rest easy that no silly homegrown encryption system was invented. Also, as long as I have the keys, in the worst case I can do the decryption myself, if I do not have access to "pass".

The only thing I believe it might lack is the fact that the names of the entries are in the clear. Which means I cannot setup a github(private) repository as remote for my pass store: the passwords themselves would still be gpg…

hannob aptly explained why I left my job, because Quantum RNG is a gimmick and doesn't solve any real problems. But to expand on that, it was heavily marketed with the idea that somehow we're living in a "entropy starved" world. We do a pretty good job of gathering entropy today from various sources such as mixing unique identifiers of hardware, CPU jitter, interrupt timing, RDRAND (which is a similar design to metastability of ring oscillators), etc. So the remark if you haven't managed to generate one secure 256-bit key then you have much bigger problems resonated heavily with me, and I realised there just isn't a need for gigabit speed TRNGs and the Quantum marketing is just scare tactics which my employer employed.

Also no crypto library or application is going to modify its entropy source to get its randomness from a TRNG device directly when it already has access to a high quality RNG via OS APIs/crypto libraries (for a good list of these check out https://randombytes.cr.yp.to/).

The concern I would have with relying too much on a source key to derive other keys from would be if one of the keys is leaked, the others would also be exposed

A modern RNG would implement fast key erasure which is what Jason Donenfeld did with random device in Linux. See https://blog.cr.yp.to/20170723-random.html and https://www.zx2c4.com/projects/linux-rng-5.17-5.18/inside-linux-kernel-rng-presentation-sept-13-2022.pdf .

i can't really use this project now that my main os is osx(i frequently boot from my ssd with archlinux on the mba), but

i absolutely love this project. it's amazing,

the only thing i'm a little sad about is that i never wrote the pass plugin i wanted for password store [1]. but hey you can still write one

the main author moved, but there are fairly active forks[2].

the amazing thing about this is that you can write plugins in any scripting language you want. you can pretty much hook it's basically a mighty scriptable version of webkit.

here are a bunch of scripts you can use to extend it with [3]

on a sidenote, a completely different, but also interesting approach are conkeror [4] and luakit [5]. though luakit seems abandoned too. luakit is kind of a lua webkit browser framework with sane vi like defaults. conkeror is an emacs for xulrunner, however keep in mind that since firefox is taking over the role of xulrunner you might not really need xulrunner at all.

[1] http://www.zx2c4.com/projects/password-store/

[2] https://github.com/mathstuf/uzbl/tree/next

[3] http://www.uzbl.org/wiki/scripts

[4] http://conkeror.org/#Installation_and_Startup

[5] http://mason-larobina.github.io/luakit/

I had 13 login attempts from South America, Asia and Middle East. My login details have been leaked in several leaks, latest being the Adobe leak. And even though I've had strong password, my fault's been that I've used the same password in lots of places.

Luckily the Adobe leak was the final straw and I finally started to use a good password manager and super strong, distinct passwords in all the services I'm using. It wasn't that bad at all, just selecting a good password manager[1], strong encryption and an easy way to sync your passwords between devices (git), I've had no trouble at all with strong passwords.

Although it would be nice to have an Android app for the password manager. I think it's a nice excersize for writing my first Android app at some point...

[1] http://zx2c4.com/projects/password-store/

I hadn't heard of Lastpass Enterprise or Meldium before.

At previous companies I've used Passpack (http://www.passpack.com/en/home/) but didn't really like it. The sharing model is a real pain and doesn't scale. Team members create passwords in their individual accounts, then transfer ownership to a company account. Now the person who administers the company account gets an email, logs in, accepts the transfer, and shares the password to the appropriate team members.

Now that I'm in a simpler environment where veryone has access to all the passwords, I just use pass (http://zx2c4.com/projects/password-store/) and a central git repository.

No decent password manager will expose your passwords to a third party. If syncing is supported, only passwords encrypted with your master password are sent over the network. AFAIK, that's how all the popular ones work.

FWIW, I use "pass", which is a short bash script that's a thin wrapper around gpg. If you can't trust that, I'm not sure how you can use a computer.

http://zx2c4.com/projects/password-store/

Btw, your password square generator isn't using a secure source of random numbers, which makes me highly doubtful.