Hi,

For some reasons I want to migrate from keepasxc to pass https://www.passwordstore.org/ to store my passwords.

Reading about pass before migrating I see that uses asymmetric-key encryption to crypt little files with the passwords. I am not an expert and want to know:

It is pass commonly used? multiline or one line for each piece of data?

What are for you the defaults gpg-keygen to have strong security today?

Multikey vs onekey? Different keys security levels?

It will be recommended to do a second encryption of ~/.password-store to have like a master-key?

Some tips to wipe clipboard?

agent-gpg config?

I use my usb to decrypt my home at starts. Maybe I can make a little script to wrap pass to store passwords on the USB too.

Tips about pass-otp?

In short What are your defaults.

Thanks in advance.

umm. I am not a security expert, but the details pass provides are a bit light. There are community extensions, but no mention of any review or them. Supply chain exploits are a thing so examining your sources is critical.
If you want a GPL password vault that has been critically examined by security professionals then Bitwarden is what you should be looking at.

1 members found this post helpful.

Yeahbut ... what is the threat profile ?.
pass is a shell script - pretty easy to determine your own confidence level. By definition it's rudimentary, but that's by design. No need for the extensions if you're concerned.
I looked at it a while back, and might do again. Our security requirements are modest, and gpg that never leaves our realm is just fine.

Many thanks for the replies uteck and syg00.

I am lookind Bitwarden, looks nice for an alternative if I can't get a pass set up with which I feel comfortable. Thanks.
I only need OTP, so If gpg and oathtool do the work, less code less exposition.
For now I will try to set up pass following https://bitwarden.com/help/what-encryption-is-used/ and https://cheatsheetseries.owasp.org/c...l#introduction and https://cheatsheetseries.owasp.org/c...eat_Sheet.html

I will try to post my final set up here, to get some tips and maybe help someone.

I mostly use "passwordsafe," and various facilities provided by MacOS. The only really-important thing is that your passwords are somehow stored in a convenient but encrypted file. So that any rogue software that might be snooping around your home directory won't find anything that it can use.

I store all kinds of "private notes" in this way.

Also: do not(!) allow "your browser" to store passwords, nor any other personal and especially financial information, no matter how "convenient" that might be. These facilities are much to "accessible" to rogue software. Keep such things "at arm's length" from your browser systems. I do not use any tool that offers to fill in passwords "for" me.

Actually keepassxc has a plugin to the browser, so you can safely store/manage your important data with it (not in the browser) and also use in browser (I mean autofill for example).

Suit yourself, but I never use "autofill." And I do not keep any passwords anywhere within potential reach of my web browser.

Not finished but. There is. Auto explained script.

EDITED: I updated the script with more notes.

Hope that was more clear.

Attached Files

pass_wrapper.txt (8.6 KB, 14 views)

Just in case you want to do this for scripting, keepassxc has a terminal/command line client, too.

Thanks, it is really nice to know that keepassxc have a command line option, unfortunately the required dependencies for build keepassxd include ascidoctor that requires ruby, are 2 packages that actually I don't have on my LFS build. For now I don't want to add extra packages/work to it, maybe in a future.

Maybe I haven't found it but seems there isn't a separated option to build only keepassxc-cli rigth?

Anyway pass do the work and is based on shell script that is a +1 for me, but thanks again.

It is not an option, but a subdir, so you need to run make keepassxc-cli instead of full build. Probably works. (not tested, I don't know the exact solution, need to check).

Tnx pan, when I get time maybe I will try it.