I'm familiar with password managers like KeePass, and that there are a variety of interfaces for them. However, I've decided that I rather like the charm of pass. It's command-line oriented, and generally just really good. I can use git to make sure that I sync my PW store across my different machines.
However, if you follow any kind of scheme that makes it evident what these are for, e.g.
Then even if an attacker doesn't compromise your GPG key, just getting access to your computer will give them a list of every single account that you have. Obviously you could stick your account names in the file, so you just have:
And then you have maybe a bunch of different username/passwords in there. But at that point you're kind of getting to the point where you may as well just use a KeePass file.
Are there any ways to use
pass without leaking site and username/email addresses? Or if an attacker can access this information, should you just assume that they've already pwned you enough to know it?