[HN Gopher] Pa - a simple password manager based on age
___________________________________________________________________
Pa - a simple password manager based on age
Author : j3s
Score : 114 points
Date : 2022-12-28 10:49 UTC (12 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| toastal wrote:
| It's been a long times since I saw a nice, clean, legible
| plaintext README
| input_sh wrote:
| age in question, in case you were as confused as I was by what
| that means: https://github.com/FiloSottile/age
| Tempest1981 wrote:
| New to me. What is the meaning/history/pronunciation of the
| name?
| worldsavior wrote:
| Another good encryption?
| mcdonje wrote:
| According to the github linked in the top level comment, it's
| pronounced like the Italian "Aghe", which translates to
| "needles". "Aghe" sounds like "Ah-gay". Not sure why they
| picked that name.
| NikolaNovak wrote:
| Ahhhh.... so it does not automagically adjust UI complexity and
| recommendations based on the age (and/or computer skills) of
| the user?
|
| How disappointing and misleading! :->
| [deleted]
| naribe wrote:
| Agreed! I came for the meme! ;)
| iamsaitam wrote:
| I thought the same. Title is misleading imho.
| onionisafruit wrote:
| I'm already familiar with this "age", but I still thought the
| same when I saw the title.
| mtlmtlmtlmtl wrote:
| >pronounced "paw"
|
| What? Call it "paw" then. No one is gonna see "pa" and think it's
| pronounced "paw", and no one is gonna hear you say "paw" and
| think the invocation is "pa"
|
| Why the intentional confusion?
| seanw444 wrote:
| Or, who really cares how people pronounce it? It's very
| unlikely for there to be many scenarios where someone was
| trying to find this, but couldn't, just because they heard
| someone say it wrong. Most people will find it through textual
| means. I don't get the obsession with projects specifying the
| pronunciation in the README. If anything it just means you
| failed at naming your project.
| [deleted]
| OkayPhysicist wrote:
| What regional dialect of English are you using that the word
| "pa" is pronounced any differently? To my West Coast / NorCal
| ears, urying to use a stressed, second-a-in-"banana"
| pronunciation, is really weird, as is schwaing it to the point
| of "uh". The unstressed-short a (the other two 'a's in
| 'banana') sounds the best, and is perfectly reasonable to
| describe phonetically as "aw".
| standardly wrote:
| .. In the same way "fa la la" is not sung "faw law law"
| OkayPhysicist wrote:
| I would write that as either "faw lah lah" or "fuh lah lah"
| or maybe "fuh luh luh". The "paw" sound is undeniably how
| I'd refer to my father, not "puh", or "pah", though I could
| imagine like a New England accent using the latter.
| mb7733 wrote:
| > No one is gonna see "pa" and think it's pronounced "paw", and
| no one is gonna hear you say "paw" and think the invocation is
| "pa"
|
| Well consider me a counter example.
| aconbere wrote:
| I would pronounce pa as "paw", like papa. Would you say it like
| the a in "apple"?
| mtlmtlmtlmtl wrote:
| None of the above. No one pronounces "aw" like the a in
| Apple. And most people do dinstinguish between "a" and "aw"
| by pronouncing the latter more like the a in "awe".
| aconbere wrote:
| Right I'm just confused how you would pronounce it. Because
| I would almost certainly default to saying pa like "awe".
| deathanatos wrote:
| "pa" would be pronounced between these two, depending on
| speaker:
|
| /pa:/ -- if I had to use "normal person's IPA", "pah"
| would be my attempt. This, to me, is the more common
| pronunciation. Should rhyme with "bra" ... assuming you
| pronounce that like I do.
|
| /po:/ -- like "paw" or "awe". This is a region-specific
| dialect, to me. This appears to be the one you're
| familiar with.
|
| See https://en.wikipedia.org/wiki/Help:IPA/English for a
| chart.
| yreg wrote:
| ESL speaker here, "pa" like in "parking"
| I_complete_me wrote:
| There is a favourite old joke of mine that depends
| heavily on this pronunciation: A dog
| limps into a bar. The barman looks at him and say "What
| can I do you for?" and the dog replies "I'm a
| looking for the man that shot my pa".
| FPGAhacker wrote:
| Merriam-Webster at least gives one of two possible
| pronunciations for "pa" as identical to "paw."
|
| https://www.merriam-webster.com/dictionary/pa
|
| Relevant for the US.
| pimlottc wrote:
| To me (American Midwest), "papa" (father) and "pawpaw" (a
| type of fruit) are not pronounced the same way. "Papa" is
| more like "pahpah".
| nulbyte wrote:
| If papa is a stand-in for father, I'd pronounce it with a
| long a, as in father. If papa is a stand-in for grandfather,
| I'd pronounce the first a as in apple, and the second as in
| paw. But of also spell it papaw. Seeing 'pa' in its own, I'd
| never think it was pronounced like paw, unless I was reading
| something written in Hungarian.
| appletrotter wrote:
| I pronounce 'pa' like 'paw.' Short for papa I guess. Always
| have, always will.
| jrm4 wrote:
| You're not in the American South, are you?
|
| These are not far from one another here.
| drexlspivey wrote:
| Wait till you hear how age is pronounced
| mtlmtlmtlmtl wrote:
| Awgee?
| yakattak wrote:
| This is interesting. I've been using Bitwarden for a long time
| now but I didn't realize how convenient a command line password
| manager would be. Still though, not being integrated with iOS is
| a non-starter for me but I really like this idea.
|
| It would be cool to see the other apps like Bitwarden adopt a CLI
| to use passwords with other command line tools. Kind of like the
| Apple Keychain API but easier to work with in a *nix environment.
| davidrusu wrote:
| you're in luck, bitwarden has got a cli see:
| https://bitwarden.com/help/cli/
| FiloSottile wrote:
| Hah, I saw this just after sending a newsletter issue on my
| password management solution, which is based on passage [1] (a
| fork of password-store [2] that uses age [3]) and YubiKeys.
|
| My age+YubiKeys Password Management Solution --
| https://words.filippo.io/dispatches/passage/
|
| The main feature is some protection against post-compromise
| exfiltration: even if an attacker fully compromises my laptop,
| they can't extract the whole vault.
|
| [1]: https://github.com/FiloSottile/passage
|
| [2]: https://www.passwordstore.org
|
| [3]: https://age-encryption.org
| imiric wrote:
| Very cool! Thanks for all your work!
|
| I was waiting for a solution to store age keys on a security
| key, and it's great that it's now possible with YubiKeys.
|
| I currently use smart cards to store my GPG keys, which works
| even on Android, as there are some that support NFC, so I can
| use them with the OpenKeychain and Password Store apps. I need
| to have passwords available on mobile, as often when I'm
| traveling I don't want to lug around a laptop. The QR code
| solution you suggest doesn't seem optimal.
|
| Would it be possible to achieve the same workflow with age and
| NFC YubiKeys? I suppose it would need a native mobile app for
| that to work.
| FiloSottile wrote:
| If using the OpenPGP applet over NFC is possible, then it's
| almost certainly possible to use the PIV one with age keys
| too!
|
| The Andorid password-store app is working on an
| implementation of age in Kotlin (https://github.com/android-
| password-store/kage) and I think they already support passage
| stores. Maybe you could open a feature request for age-
| plugin-yubikey compatibility? If you do, feel free to tag me,
| and I can help make sure the formats are well specified.
| zikduruqe wrote:
| I updated to 1.1.1 yesterday and hope to try with a Yubikey
| here soon.
| woodruffw wrote:
| From a cursory scan, this looks like it doesn't support key
| wrapping -- the private key ("identity" in age's parlance) is
| stored unencrypted on disk.
|
| This is arguably a non-issue for most use cases (disk access is
| "game over" under most threat models), but it's nice to have e.g.
| for sharing configurations between multiple machines over a
| public channel (like a dotfiles repository). It would also bring
| this roughly up to "spec" with what other password managers do
| (i.e., in terms of requiring a "master" password that unlocks the
| vault).
| j3s wrote:
| very true, and thank you for pointing this out. this is an
| intentional design decision - you can see me rationale here:
| https://j3s.sh/thought/storing-passwords-with-age.html
|
| it boils down to exactly what you noted - disk access is game
| over in most cases anyways, and i like the convenience of
| plaintext on the disk.
|
| i will be exploring the yubikey model that filippo recently
| outlined though https://words.filippo.io/dispatches/passage/ -
| so stay tuned! :D
| woodruffw wrote:
| Thanks for sharing your rationale! I tend to agree -- the
| practical alternative for Linux anyways is some kind of key
| agent, and it's unclear to me (having written a few password
| managers at this point, including an age-based one[1]) that
| the attacker model for an agent is any different. The only
| advantage is the "public" channel one I mentioned, and that
| can of course be done out of band.
|
| And since I forgot to say it earlier: excellent work!
|
| [1]: https://github.com/woodruffw/kbs2
| j3s wrote:
| wow, extremely cool, ty! i'm excited to play with kbs2 when
| i find a little free time.
| Ciantic wrote:
| There is also Passage by Age's creator Filippo Valsorda:
| https://github.com/FiloSottile/passage
| [deleted]
| rollcat wrote:
| The hard part of building a (good) password manager is not
| actually the encryption backend (gpg, age, etc...), or the
| frontend (CLI, dmenu, GUI...), or the sync (git, CRDTs,
| whatever), or even integrating the biometric unlock -- but
| correctly integrating it with every app and website that expects
| to take your passwords.
|
| AWS console has three fields (account, user, password), most
| websites will take your password and/or MFA code on a separate
| page, some apps will use Electron, some will use native widgets,
| some will use NON-native widgets (like GTK/Qt on Mac/Windows),
| some apps (like games) will be running in full screen...
|
| It's a world of madness and I have huge respect for the password
| managers that actually try to solve _these_ problems (even if
| most do it only half-decently).
| onionisafruit wrote:
| It would be nice if there was something like ad blocker filter
| lists for password managers so that every new password manager
| doesn't have to keep this up on its own. Maybe there is and I
| haven't run across it.
| j3s wrote:
| for what it's worth, the pa -> browser input "integration"
| feels a lot better than you'd think, but takes a little bit of
| effort to setup.
|
| check out the contrib/ dir for some supported programs - get
| one of those in your $PATH, and set up a hotkey to launch it.
|
| now, whenever you press the hotkey, a list of your passwords
| will show up, which you may type to filter. when you press
| return, the password you selected will be automatically typed
| into whatever you have highlighted, whether it's a password
| field in a browser, or vim. the neat thing is that the password
| never touches your clipboard since it's typed directly by
| either wtype or xdotool.
|
| the workflow really only takes a second or two once you have it
| setup, and feels very nice, imo!
| mahathu wrote:
| It would be nice if a password manager could take care of
| detecting a page reload/change and auto fill the rest of the
| form, but I guess the risk of skipping through pages without
| any user interaction is too large for users (including myself)
| to trust it. I think the problem rather lies in how difficult
| modern UI makes it to sign in sometimes
|
| ppppp,,,,,,,,,,,
| [deleted]
| RamenJunkie_ wrote:
| I really don't understand this trend that has popped up int he
| last few years of putting the Password on a separate page from
| the username. The Password manager usually catches it but
| sometimes does not. It just needlessly adds an extra step/page
| to the log in process.
| counttheforks wrote:
| It allows you to determine the authentication method based on
| username. Some users may need SSO, some may need email login,
| and yet others may simply use a password.
| ipqk wrote:
| As others have said, it depends on the authentication method.
|
| Some users may not even have a password. They'll be sent an
| email or sms with an authenticated link. So to put a password
| box in front of them may be confusing.
|
| But it's definitely annoying to those of us with general
| passwords.
| deathanatos wrote:
| This is sometimes for SSO. If your user logs in with some
| form of SSO, after the username entry, you get redirected to
| your IdP, instead of prompted for a password.
| projektfu wrote:
| I think it's also fashion. Monkey see Google, monkey do
| Google.
| [deleted]
| vbezhenar wrote:
| I've yet to see password manager I'd trust to mess my browser
| with. I don't want autocomplete. I want convenient and
| controlled access to my passwords and that's about it. Every
| password manager wants to run its non-opaque JavaScript on my
| login pages which I can't allow.
|
| What I need is:
|
| show button on top bar if current website has stored passwords.
| At this point no logins/passwords are requested from the
| password manager, only website URLs (or even hashes).
|
| After I click this button, request and show list of logins
| saved for this website. Let me choose login if there are
| multiple. Otherwise alter browser context menu.
|
| Now when I right-click on text input, add items like "Insert
| login: vbezhenar" and "Insert password for vbezhenar".
|
| And only when I choose "insert password" - actually request
| password from the password manager.
|
| That's the only sane UI. Until I find it or write it myself,
| I'll continue to copy-paste passwords around.
|
| It's a sad state of things where password managers are still
| not as usable as text file.
| worldsavior wrote:
| That's why there is autofill in Android.
| Jim_Heckler wrote:
| this sounds very much like the keepassxc browser integration
| orangepurple wrote:
| Keepass and derivatives like KeepassXC (preferred) have
| configurable autocomplete which emulates a keyboard and
| seamlessly moves between UI fields using any key presses you
| want. By default it switches windows with Alt Tab and Tabs
| between fields.
| kadoban wrote:
| This seems _pretty_ close to how Bitwarden works. In fact,
| unless I'm missing some requirement, it's close enough that
| you can do that yourself if you just manually click the "copy
| username" and "copy password" buttons instead of the usual
| "just fill crap from this login" button. Those buttons aren't
| any harder to reach either, they're just smaller.
| remram wrote:
| But are we sure they don't inject any JavaScript before you
| hit the "fill" button?
| 1f60c wrote:
| Maybe I'm missing something, but why would you trust any app
| to securely store your passwords (or store them at all) but
| specifically mistrust their browser extension?
| vbezhenar wrote:
| 1. Browser extension interacts with every website by
| design. And it means that every website has a direct path
| to access my passwords if extension is buggy. I don't know
| how to solve this issue without special browser API, but
| requiring user to click for every step before sending
| actual data might reduce that attack surface compared to
| convenient automatic mode.
|
| 2. Web apps are wild and doing wild things. Even humans
| might find it hard to fill the form correctly. Extension
| can only observe DOM. Who knows which inputs it will fill
| with my passwords? I don't trust myself to write that kind
| of auto fill code which would work reliably. And if I don't
| trust myself, I definitely don't trust others to do so.
|
| I don't claim that extensions are malicious. That would not
| make sense indeed. Just that extensions are things I don't
| trust to be implemented correctly, especially with
| convenient auto-pilot mode.
| 1f60c wrote:
| Both are great points. Thanks!
| cristoperb wrote:
| > The hard part of building a (good) password manager is ...
| correctly integrating it with every app and website that
| expects to take your passwords
|
| What's wrong with plain old copy-and-paste? (I know there are
| probably some security concerns under X11, but Keepass, for
| example, will automatically clear the clipboard after a few
| seconds at least.) I use Keepass and 1password.com, but I don't
| use any of their autofill features; I just copy a password when
| I need it and paste it to where I need it.
|
| I think a user-friendly, secure, and reliable sync is the much
| more difficult part of implementing a good password manager.
| jonwinstanley wrote:
| Copy and paste is fine, plus most usernames are your email,
| which should auto complete
| rollcat wrote:
| > What's wrong with plain old copy-and-paste?
|
| Context awareness.
|
| I currently have 429 items in my PM (it happens to be
| 1Password, specifically because it's extremely good at
| figuring this crap out). I almost never have to search for
| anything; even if I do, I can easily update the entry, so
| that it understands the context, in which a given credential
| can be valid; e.g. I can use my Blizzard login both on
| "https://battle.net", and in "app://sc2" (StarCraft 2). If I
| have a main+alt account, it will allow me to choose from the
| two, not 400+.
|
| It's the same as with using contactless payments with a
| smartwatch, it saves you 10 seconds here, a minute there -
| and over the course of your day, day after day - it starts
| adding up.
|
| > I think a user-friendly, secure, and reliable sync is the
| much more difficult part of implementing a good password
| manager.
|
| CRDTs solve this problem quite generally. I've never tried
| actually implementing sync from scratch in a desktop/mobile
| app, but the theory behind CRDTs is quite easy to grasp and
| makes a lot of sense. I'd say it's quite a bit harder to sync
| plain, old files, because the only metadata you have
| available is things like names, access/modification times,
| etc and they tend to be huge binary blobs, like photos or
| music, so the problem of automatic conflict resolution gets
| quite interesting.
|
| BTW look up Apple's CloudKit. I've done a "let's pretend
| we're on a 1990s Internet" challenge[1] a while ago, and it's
| amazing how reliably everything syncs, even if the devices
| are online for maybe 1% of the day.
|
| [1]: https://www.rollc.at/tags/challenge/
| [deleted]
| forty wrote:
| The issue with copy pasting password is phishing, which for
| most real life users is a much bigger risk than most other
| risks
| [deleted]
| TillE wrote:
| This is precisely why I stopped using KeePass, the browser
| extensions just weren't good enough.
|
| Bitwarden is significantly better, though it also occasionally
| does the thing where the prompt to save a new password
| disappears, because of redirects or something.
| latchkey wrote:
| I've retrained myself to always just create the account first
| in BW instead of rely on that prompt mechanism. Once the
| account is created in BW, you can just auto-fill it into the
| u/p fields.
| pqb wrote:
| That's true, the simple & fast UI (TUI/GUI) helps a lot.
| However, I would not extrapolate it to a huge problem. I am
| person, who have written own pass/passage implementation [0],
| just because I disliked how many steps I need to make to select
| the password for the form input, modify it or sync secrets.
|
| Initially, I had used the `gopass`. It is probably the most
| convenient way to start using the password-store. It is cross-
| platform, 100% compatible with pass & pass-otp. To copy the
| password, you basically type the part of the file you are
| looking for. If you type "gopass show github", it will display
| a TUI, where you can select the file you are looking for (let's
| say you have two files "personal/github.com.gpg" and
| "work/github.com.gpg"). Unfortunately, the search function was
| far from perfect, and it had a problem with typos like "gtihbu"
| at the time, when I was using it.
|
| To get rid of this issue, I decided to adapt pass/gopass to use
| `fzf` [2]. In the same time, my .password-store/ dir was
| rapidly growing that made me think about implementing pass from
| scratch. I improved the implementation to have better caching,
| synchronization between machines/mobile, but more importantly -
| a simple `secret [arg]` command that will execute `fzf` to list
| all known creds and simplify selection of the password. Of
| course, it accepted an argument that was limiting the results,
| which is great when you need to get back to the previous
| credential to retype something.
|
| The introduction of `fzf` made it really convenient, and I
| decided to add more commands with fuzzy search, such as:
|
| - `otp` - limits results files containing TOTP/HOTP token,
| calculates and copies it to the clipboard.
|
| - `secret-edit`, `secret-remove`, `secret-show`... aliases to
| sub-commands that open `fzf` command in multi-selection mode,
| so by utilizing space key I could select what files are meant
| to be modified, removed, displayed etc. Quite handy for mass-
| edit.
|
| - `secret-qr` - similar to the gopass' feature, but it made a
| simplified way to create and display QR codes dedicated to
| share contacts, WiFI SSID+password combination (etc.) to
| someone who was asking for creds from me.
|
| Awesome, but alt-tabbing to the terminal got me annoyed after a
| few years of using it that way. I started pursuing for more
| sophisticated interface. I decided to give `rofi` [3] a try. I
| managed to fork that repo and also adapt to my convention of
| using password-store, but I left i3 for a macOS.
|
| Currently, I have started working on a browser extension that
| takes care of suggesting password-store creds (based on the
| path, input parameters, location on the website etc.) similarly
| to what uBlock Origin does. That configuration is passed to my
| pass implementation, so on the github.com, my browser have only
| "work" and "personal" auto-suggestion, when I am focusing the
| text input.
|
| I plan to create a similar app to Shortcat [4], but it will
| preserve the information what credential has been asked for the
| focused app. I think, with VoiceOver assistance, it is more
| than possible to mitigate the need for alt-tabbing to the
| terminal for electron/native apps.
|
| [0]: It is a private repository, maybe when it will be polished
| enough I will open-source it.
|
| [1]: https://github.com/gopasspw/gopass
|
| [2]: https://github.com/junegunn/fzf
|
| [3]: https://github.com/alecdwm/pass-rofi-gui
|
| [4]: https://shortcat.app/
|
| Edit: About the AWS login form. I strongly recommend giving
| `aws-vault` (https://github.com/99designs/aws-vault) a try. It
| helps you skip the login form with a simple command e.g.: "aws-
| vault login acme-corp --duration 2h". I find it better than
| `aws-mfa` on my dev machine.
| TedDoesntTalk wrote:
| > integrating it with every app and website
|
| Yes, and I would add password device sync for multiple
| operating systems and browser extensions. Without sync,
| hundreds of unique, unmemorable passwords are not much value.
| ricardobeat wrote:
| I've been using a homegrown solution that is very similar to
| this, for about three years now.
|
| The way I access it is via Blink app on iPad/iPhone, the
| terminal on mac, WSL on Windows. Copy and paste the password,
| clear the clipboard (done automatically when using the
| terminal). It takes a few extra seconds but works anywhere, and
| I can add password-specific notes for cases like your AWS
| example.
|
| Putting the password in the clipboard is the least safe part,
| but I definitely prefer this over giving some random app full
| access to my browser / system.
| rollcat wrote:
| > It takes a few extra seconds
|
| That's specifically the part I was extremely unhappy with, as
| a former pass+dmenu user, who has migrated to 1Password. It's
| a cold, autumn evening, we're down from the mountain hike and
| running to catch the last train home to return from the trip,
| and I need to buy the ticket either before or as soon as I'm
| on board; my stiff fingers are trying to make things happen
| on a phone with a small screen, poor reception, and a slowly
| dying battery. I need that password *now*.
| upofadown wrote:
| I don't think age does any real password extension. So if you are
| used to something that does (GnuPG's 0.1 second extension for
| example) you might want to add an extra word or two to your
| passphrase.
|
| Pet usability peeve triggered here. If we create a system that
| completely depends on the strength of a password/passphrase we
| have to give the user concrete advice on how to create a
| password/passphrase that will be strong on that particular
| system.
| woodruffw wrote:
| I'm not following. This encryption model here is a master
| private key, so there's no master password involved. Are you
| referring to the generated passwords? If so, the default seems
| reasonably long (and is outside of age's scope anyways, since
| it's just the encrypted content).
| upofadown wrote:
| Sorry. I missed that. The ultimate security of the saved
| passwords here depends on the security of the operating
| system and file system.
|
| So I really should of complained that this fact was not made
| very clear to the user... :)
| [deleted]
| j3s wrote:
| > So I really should of complained that this fact was not
| made very clear to the user
|
| how could i have made this more clear? what would you like
| to see?
| upofadown wrote:
| Dunno, something like what I said before?
|
| >The ultimate security of the saved passwords here
| depends on the security of the operating system and file
| system.
| FiloSottile wrote:
| This password manager seems to use private keys, so there is no
| passphrase used for encryption here.
|
| However, generally speaking, age uses scrypt for password key
| derivation, with a default work factor of 2^18 (1 second on
| modern machines). Unlike GnuPG's S2K, scrypt is both CPU and
| memory hard.
| upofadown wrote:
| Then how short can I make my passphrase? It should be shorter
| than with GnuPG but no one knows how long to make the
| passphrase for GnuPG either...
|
| This gets back to my original peeve. This sort of thing has
| to be worked out for the user. I looked through the available
| documentation. Was I as a user expected to look through the
| source code and figure it out for myself?
| woodruffw wrote:
| My understanding is that, even with a CPU and memory-hard
| KDF, the standard recommendation is to use a strong and
| difficult to guess password. It's meant to be a layer of
| protection against cracking, not an opportunity to use a
| shorter password than you normally would.
| upofadown wrote:
| OK, but what is that? I am a user. What do I do?
| tptacek wrote:
| Questions like these are indistinguishable from trolling.
| You've responded to the direct, common-knowledge answer
| to your question by repeating the question. Please stop
| doing this.
| some_furry wrote:
| > I don't think age does any real password extension.
|
| Did you even bother to check?
|
| https://github.com/FiloSottile/age/blob/main/scrypt.go
|
| This isn't exactly hidden.
| upofadown wrote:
| That is source code. I as a user should not have to look at
| the source code so that I can use a program.
| some_furry wrote:
| If you feel yourself technically proficient enough to
| comment on cryptography (mostly PGP apologia), then you
| should be capable of looking at source code to figure out
| whether or not something "does any real password
| extension".
|
| If anyone else (i.e. "a user") made this mistake, I'd be
| more sympathetic. But not for you.
|
| You don't get to have your cake and eat it too. Are you a
| cryptography expert, or aren't you?
|
| If yes, then failing to bother to check the source code is
| a faux pas.
|
| If no, then I expect you to stop trying to argue as a
| cryptography expert the next time someone points out that
| PGP is bad cryptography.
|
| I don't care which you choose. I only ask that you stick to
| it.
| deathanatos wrote:
| ... okay, then look at the spec, which is beautifully
| simple: https://github.com/C2SP/C2SP/blob/main/age.md#the-
| scrypt-rec...
| upofadown wrote:
| "N = work factor"
|
| So nothing there to indicate exactly how much work
| extension, if any, is done.
| tptacek wrote:
| Please stop trolling.
| ladon86 wrote:
| What would people recommend for backup (perhaps even sync) of the
| vault?
| zikduruqe wrote:
| A bare git repo. I keep mine on a Raspberry Pi at home synced
| via Tailscale or Wireguard depending on device or the network
| I'm on.
|
| git init --bare
|
| Then I can sync it to multiple devices via pull or push.
| j3s wrote:
| I use a git repo to keep my passwords synced - then I have a
| shell alias that makes a commit and pushes it. pretty simple!
|
| I have thought about adding git support directly to pa, but I
| think it's out of scope.
| [deleted]
| jrm4 wrote:
| Because I'm lazy and you're here.
|
| Here's what I do now:
|
| Encrypted volume synced with syncthing, everything basically
| stored as plain text and (like you, i think) a few shell
| scripts to throw passwords into the clipboard.
|
| Would your thing work with a simple synced volume?
| j3s wrote:
| yep! pa has absolutely no problem with that.
| jszymborski wrote:
| my KeePass vault is backed up with the rest of my files using
| Borg. I sync between my computers using SyncThing.
___________________________________________________________________
(page generated 2022-12-28 23:02 UTC)