There was TeamPass, which was buggy as hell and shouldn't be touched with a long pole... ...but why is there nothing else?
Where can i donate twice my yearly LastPass fee to get something self-hostable opensource and fund their Audits?
And no, Keepass in Dropbox/NextCloud/WhateverStorage doesn't work for a company that has Non-IT People needing access to passwords.
Another unmaintained one is mitro
I'd love to open source my self-hosted team password manager, but I just don't know how to afford it.
Lastpass does some things well but it's not had the greatest record on UX or on security.
1) The prompt to "create new site?" is so dumb it commonly saves URL junk as the homepage like http://mysite.com/create-new-account?huge-long-querystring. You have always manually edit the vault to keep it clean.
2) The form detector to auto-fill username/password often can't find the right fields forcing you to manually copy/paste credentials.
3) On iOS there is no way to autofill address/cc (identities) from the extension
4) They've been compromised, and even afterwards one guy found like 3 zeroday exploits in a weekend and thought it was so bad he couldn't believe people were using it.
The list goes on and on with primary usage scenario problems they could do better at but simply do not for whatever reason.
Being that mount is needed for just one feature that I can totally live without, what are the other obastacles to proper x-platform solution ? AFAIK all other deps are available on native Windows (not cygwin or ubuntu4win).
I will definitivelly try to see if it works.
(Mobile OS clients are on the roadmap.)
Indeed I am working on WireGuard. But I haven't forgotten pass. We're currently working on a new release.
> the project proved to be a wild bunch of hotwired bash scripts that mostly looked like they were written as a one-off job
I very much disagree with this silliness.
People like you are the reason people like me are in this business.
Fuck, I love the Internet.
We use Go for almost everything at JustWatch and that's why we decided to rewrite it in Go as this would allow us to add even more features with better abstraction in the future. Bash just didn't feel like the right fit for that.
You point out (in discussing the design of pass):
> There is one slight drawback to all the simplicity, and that is an information disclosure inherent to the design: pass stores all folder and file names in clear text, so even if you fully trust GPG, you should probably not put this repo into a public place like Github, because this may expose your account names and other metadata.
What's not completely obvious from a cursory read is whether gopass improves upon that. Also, the multiple stores feature looks like it might be quite nice, but a lengthier example would be very helpful!
Edit: improve clarity
> Multiple gpg-ids may be specified, in order to encrypt each password with multiple ids.
That should technically reduce security, when encrypting the same secret with multiple IDs, as it gives a potential attacker more data to work with.
I suggest adding some randomness when encrypting with each key and having pass hide it from the end user when decrypting.
Afaik supplying multiple ids to gpg simply re-encryps the same symmetric key for multiple recipients - the plaintext is turned into a single cipher text.
But I don't want to spend my time writing bash and sending patches by mail.
Can you elaborate on the differences between how gopass and QTPass accomplish these things and why one might want to choose gopass instead?
Be 100% pass compatible
Storing binary files in gopass (almost done)
Storing structured files and templates (credit cards, DBs, websites...)
UX improvements and more wizards
Tackle the information disclosure issue
Build a great workflow for requesting and granting access
Better and more fine grained ACL
Be nicely usable by semi- and non-technical usersThis is my concern with pass. It's an awesome tool, but it really needs to figure out a way to hide the filenames. I think this is doable (after all, encfs has the same need, and does it well), but I don't know if the pass team have the will to do it.
> First, the project is curated in a traditional mailing-list based approach that was pretty unapproachable compared to a modern Github based workflow.
Sigh, not this again. I think that I prefer email vice a proprietary, centralised single point of failure like GitHub, and I know that I'd rather not work with someone who considers email unapproachable.
If your email account is unmanageable, fix it. Email's a really, really valuable tool; don't let go of it.
That's a fair debate in general, and I think you're right that there are some advantages to mailing-list driven approaches when they're done really well.
But after being subscribed to the pass list the last few months (and having seen similar situations on other projects in the past), I've been a bit underwhelmed with the actual execution there. There seems to be a lack of transparency around how to submit, what to submit, if/when/how it's considered or evaluated for incorporation, and when that might actually make it to a release. As a result there seems to be (even in this fairly short time) lots of repeated conversations about similar fixes/features/ideas and duplicate and overlapping patches around them.
I get that it seems to be a one-person show, and maybe not his/her top priority, and don't mean this as a criticism of the project (which I use and love.) But I think it's valuable to note that mail based models do really need active and engaged maintainers on the list all the time to make them work out well. If they aren't able or willing to do so, and want to be a bit more hands-off, I think github or something like it perhaps is a better model.
It's just more exposure to put it on GitHub right now because most people bookmark/star there repositories there and don't want to bookmark different cgit/Gitlab/gogs/gitea links. I don't think anyone is abandoning emails just because they don't want to email patches around and manually apply them.
I'm very curious to see how this will stack up against those solutions because, to be honest, there is very little room for improvement from 1Password, in my eyes. They have a very, very solid and secure product and the UI is fantastic.
Literally the only reason I currently use OSX. A password manager...
Here's the 6 year old 35 page thread if you want to throw your vote into a black hole; https://discussions.agilebits.com/discussion/2846/new-produc...
Instead they've become a SAAS Lastpass competitor which literally nobody asked for, in fact people were trying to leave LastPass due it it's forced-online nature (which naturally frightens people, having your passwords stored online somewhere).
I've used 1Password for a number of years and loved it and recommended it to friends and family, but their offering now just confuses me. I don't even know what their product is anymore, and I really need to be able to understand the attack surface of my password manager. So I've been looking into... other options.
No Linux support, crappy website, high price.
Would be cool if it could leverage a GitHub public repo for password updates. Something like using the list of collaborators on a repo, iterate over their GH public keys, and push new encrypted files for each collaborator on the repo.
I suppose though, this would leak a lot of metadata on how the tool is being used, and would tie it too closely to GitHub vs just git.
It's literally a port of an existing tool, so a tool DID exist.
Or did I miss something?
Vault's sweet spot is automated generation and revocation of credentials which are given to authenticated clients (like creating a one-off keypair for an SSH session & giving the private part to the user and allowing the server to read the public part).
We're currently testing the waters of migrating our pass-like shared password store to vault (so we can grant authorization to automated scripts to read certain shared rotated creds).
For 'teams' (and serv{er, ices}) I've started implementing some stuff via. vault-project [0]. The project looks really promising, sadly never got up-voted on HN so far.
The basic concept of vault is a centralized storage of secrets, managed via. Access-Control-Lists (ACLs) and accessible via. REST. Because the secrets are only accessible from a single point, you'll also have an overview of who did access which secret (called audit log). It's also possible to implement replacing all necessary secrets whenever someone has left/changed the group that got access to the secrets. Vault also makes integration in certain provisioning tools possible (though, that's something you need to spend more development in). Vault provides many database-backends [1], but also various other things (like ssh [2]).
Other things for managing secrets are:
- keywhiz: https://square.github.io/keywhiz/single_page.html
- keyringer: https://keyringer.pw
[0]: https://www.vaultproject.io/
[1]: https://www.vaultproject.io/docs/secrets/index.html
[2]: https://www.vaultproject.io/docs/secrets/ssh/index.html
However Vault is mostly meant for machines to read the secrets and gopass is designed for humans.
I have one desperate request; colour output as an option. Every time there is an update to pass (or I need to reinstall) I need to edit the file and change the options from " tree -C " to " tree -n "
This is a pain in the ass. I am visually impaired. The 'default' dark-blue that tree uses for directories is unreadable to me.
My two choices for dealing with this are to use DIRCOLORS or edit the pass executable. I'd prefer to not muck about with my environment settings. (as I do not normally see any colour output)
Anyway; awesome project!
I just created an issue for that. Shouldn't be that hard to support it. Feel free to subscribe to the issue on github or comment any thing that's missing. Thanks!
https://github.com/ejcx/passgo
The difference is mine does not use PGP and is instead password based, but the command line interface is almost identical. I now use passgo to encrypt and manage my ssh keys, etc.
> The difference is mine does not use PGP and is instead password based...
And we still wanted to use PGP because crypto is hard. :)
Gopass seems great, especially the multistore support (which you can do w/ pass by setting an env variable), thank you for your work!
I was using Bruce Schneier's Password Safe (and various compatible apps: pwSafe on Mac and iOS and Password Gorilla on an older Mac and Linux boxes) and the big pain for me was merging changes.
I'd found that trying to use a single 'safe' via Dropbox was a recipe for disaster because some of the programs wouldn't cleanly close the safe file, or at least one of them would occasionally complain about the state of the file. So I created a copy of the safe for each of my computers and devices. Then every 6 months or so I'd merge all of the safe files into a single file and recreate all of the device-specific files as copies of that single file.
But merging in Password Safe sucked. There was no way to review the differences between entries in different safes, other than manually inspecting entries. I don't believe either of the two versions (Mac and iOS) of pwSafe (both version 1) supported merging at all. Password Gorilla was actually the best among the bunch as it had a nice 'diff' window with which you could explicitly pick which version of several fields for an entry you wanted to retain. But sometimes I couldn't get its 'diff' window to fit on my screen so I'd have to plug my laptop into a larger monitor.
Using Pass with Git is so much easier.
I've also been using git-remote-gcrypt[1] to push my local Pass repos to a shared 'remote' file stored in Dropbox. It works great.
[1] https://spwhitton.name/tech/code/git-remote-gcrypt/
The only painful aspects of Pass now is the weird behavior of `gpg` on Windows in Cygwin and the clunkiness of my current multi-repo setup. Hopefully running Pass under "Bash on Ubuntu on Windows" will mitigate the former. Given that Pass is written in Bash and that the various repo config settings are read from environment variables, it doesn't seem likely that the latter will get much better than my current setup, which involves sourcing a script to switch the relevant environment variables.
Regard the windows support we would be happy to get as much feedback on that as possible. Nobody of us uses windows with gopass. If you have any idea how to improve the experience please let us know. Thanks!
Edit: found it on the github readme https://github.com/justwatchcom/gopass#autocompletion
My concern with using something like this or pass is that I have to manage the distribution/backup of the store/vault/db myself - whereas I can throw my laptop off a cliff, buy a new one, login to Keybase, and my passwords are still there.