3

Linux pass is a program that lets you store passwords in regular text files, which you it then encrypts with your GPG key.

I'm confused at how this is considered secure. The GPG key has a passphrase but looks like it normally gets cached in the agent, so you very rarely need to enter it. Usually, pass some/password just works.

But then, couldn't any other program running on your computer also run pass bank and steal your passwords?

Is this just for people who don't encrypt their entire hard drive or have multiple people sharing a computer (with different Linux users)? What are the major things pass tries to protect your passwords from, and things that it doesn't try to protect from?

2
  • "normally gets cached in the agent" -- that's a choice. You're free to make a different one. It's very common, f/e, to have one's private key on a yubikey or smartcard in a reader with a button that needs to be touched to authorize an operation. Commented Oct 28, 2023 at 1:42
  • Even if the password is cached by the agent, a non-root user other than your user will not have an easy time getting that state out of the agent. Also, you may not be using the agent, or may use a different configuration that doesn’t allow caching or requires some secondary mechanism to make the key available. Commented Oct 28, 2023 at 2:29

1 Answer 1

5

It's always worth considering what you're protecting against.

The major threat today is that site A has a leak, so the credentials used for site A becomes public - and that the user has used same credentials for site B, which is of higher value.

Password management tools protect against this by letting you set unique passwords for A and B, without having to remember them. Almost anything will protect against this; even yellow notes on your keyboard.

It's probably correct that it won't protect against an attacker with access to your computer - but that's not a very typical threat. That's the exception, and protecting against someone who has full access to your computer is extremely difficult anyway; it's trivial to dump memory of a process or attach a debugger to read secrets.

So it protects against attackers that doesn't have access to your computer.

8
  • "worth considering what you're protecting against" - yes, that's the question, I am asking what pass is supposed to protect against. Commented Oct 28, 2023 at 22:26
  • Nothing, it's a piece of software that can be deployed in various ways depending on what the user wants to protect against. Caching of passphrase is one tuneable.
    – vidarlo
    Commented Oct 28, 2023 at 22:36
  • "protects against attackers that doesn't have access" - well, if I just put my passwords in a plain text file without encrypting, isn't that the same? My computer doesn't have sshd running and there's no way to access it from the internet, so there's no danger from attackers without access. Commented Oct 28, 2023 at 23:46
  • Pass is a tool. You have to fit it into your security model. The authors may have certain ideas, and I have certain ideas, but ultimately it's up to the user.
    – vidarlo
    Commented Oct 29, 2023 at 7:52
  • It's obviously not the same. Storing your passwords in an unencrypted file does nothing to protect you against physical attacks, e.g. theft of your storage drive/laptop/desktop/mobile. Commented Oct 29, 2023 at 11:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .