0

I'm familiar with password managers like KeePass, and that there are a variety of interfaces for them. However, I've decided that I rather like the charm of pass. It's command-line oriented, and generally just really good. I can use git to make sure that I sync my PW store across my different machines.

However, if you follow any kind of scheme that makes it evident what these are for, e.g.

internet/stackexchange/wayne@example.com

Then even if an attacker doesn't compromise your GPG key, just getting access to your computer will give them a list of every single account that you have. Obviously you could stick your account names in the file, so you just have:

internet/stackexchange.txt

And then you have maybe a bunch of different username/passwords in there. But at that point you're kind of getting to the point where you may as well just use a KeePass file.

Are there any ways to use pass without leaking site and username/email addresses? Or if an attacker can access this information, should you just assume that they've already pwned you enough to know it?

1

Or if an attacker can access this information, should you just assume that they've already pwned you enough to know it?

I think you already got the idea here. If you can't trust your own machine, it doesn't matter how the password manager is implemented, you're already screwed.

You can add a second layer of authentication in various ways. On local machine, you can use full disk encryption to protect against someone swiping your information off stolen machine. If you're syncing your pass password files, make sure you set the sync permissions is private. If you don't trust your syncing service, then you can add another layer of encryption that encrypts metadata like ecryptfs or sync a disk image.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.