[HN Gopher] Pa - a simple password manager based on age
       ___________________________________________________________________
        
       Pa - a simple password manager based on age
        
       Author : j3s
       Score  : 114 points
       Date   : 2022-12-28 10:49 UTC (12 hours ago)
        
 (HTM) web link (github.com)
 (TXT) w3m dump (github.com)
        
       | toastal wrote:
       | It's been a long times since I saw a nice, clean, legible
       | plaintext README
        
       | input_sh wrote:
       | age in question, in case you were as confused as I was by what
       | that means: https://github.com/FiloSottile/age
        
         | Tempest1981 wrote:
         | New to me. What is the meaning/history/pronunciation of the
         | name?
        
           | worldsavior wrote:
           | Another good encryption?
        
           | mcdonje wrote:
           | According to the github linked in the top level comment, it's
           | pronounced like the Italian "Aghe", which translates to
           | "needles". "Aghe" sounds like "Ah-gay". Not sure why they
           | picked that name.
        
         | NikolaNovak wrote:
         | Ahhhh.... so it does not automagically adjust UI complexity and
         | recommendations based on the age (and/or computer skills) of
         | the user?
         | 
         | How disappointing and misleading! :->
        
           | [deleted]
        
           | naribe wrote:
           | Agreed! I came for the meme! ;)
        
           | iamsaitam wrote:
           | I thought the same. Title is misleading imho.
        
           | onionisafruit wrote:
           | I'm already familiar with this "age", but I still thought the
           | same when I saw the title.
        
       | mtlmtlmtlmtl wrote:
       | >pronounced "paw"
       | 
       | What? Call it "paw" then. No one is gonna see "pa" and think it's
       | pronounced "paw", and no one is gonna hear you say "paw" and
       | think the invocation is "pa"
       | 
       | Why the intentional confusion?
        
         | seanw444 wrote:
         | Or, who really cares how people pronounce it? It's very
         | unlikely for there to be many scenarios where someone was
         | trying to find this, but couldn't, just because they heard
         | someone say it wrong. Most people will find it through textual
         | means. I don't get the obsession with projects specifying the
         | pronunciation in the README. If anything it just means you
         | failed at naming your project.
        
         | [deleted]
        
         | OkayPhysicist wrote:
         | What regional dialect of English are you using that the word
         | "pa" is pronounced any differently? To my West Coast / NorCal
         | ears, urying to use a stressed, second-a-in-"banana"
         | pronunciation, is really weird, as is schwaing it to the point
         | of "uh". The unstressed-short a (the other two 'a's in
         | 'banana') sounds the best, and is perfectly reasonable to
         | describe phonetically as "aw".
        
           | standardly wrote:
           | .. In the same way "fa la la" is not sung "faw law law"
        
             | OkayPhysicist wrote:
             | I would write that as either "faw lah lah" or "fuh lah lah"
             | or maybe "fuh luh luh". The "paw" sound is undeniably how
             | I'd refer to my father, not "puh", or "pah", though I could
             | imagine like a New England accent using the latter.
        
         | mb7733 wrote:
         | > No one is gonna see "pa" and think it's pronounced "paw", and
         | no one is gonna hear you say "paw" and think the invocation is
         | "pa"
         | 
         | Well consider me a counter example.
        
         | aconbere wrote:
         | I would pronounce pa as "paw", like papa. Would you say it like
         | the a in "apple"?
        
           | mtlmtlmtlmtl wrote:
           | None of the above. No one pronounces "aw" like the a in
           | Apple. And most people do dinstinguish between "a" and "aw"
           | by pronouncing the latter more like the a in "awe".
        
             | aconbere wrote:
             | Right I'm just confused how you would pronounce it. Because
             | I would almost certainly default to saying pa like "awe".
        
               | deathanatos wrote:
               | "pa" would be pronounced between these two, depending on
               | speaker:
               | 
               | /pa:/ -- if I had to use "normal person's IPA", "pah"
               | would be my attempt. This, to me, is the more common
               | pronunciation. Should rhyme with "bra" ... assuming you
               | pronounce that like I do.
               | 
               | /po:/ -- like "paw" or "awe". This is a region-specific
               | dialect, to me. This appears to be the one you're
               | familiar with.
               | 
               | See https://en.wikipedia.org/wiki/Help:IPA/English for a
               | chart.
        
               | yreg wrote:
               | ESL speaker here, "pa" like in "parking"
        
               | I_complete_me wrote:
               | There is a favourite old joke of mine that depends
               | heavily on this pronunciation:                   A dog
               | limps into a bar. The barman looks at him and say "What
               | can I do you for?" and           the dog replies "I'm a
               | looking for the man that shot my pa".
        
             | FPGAhacker wrote:
             | Merriam-Webster at least gives one of two possible
             | pronunciations for "pa" as identical to "paw."
             | 
             | https://www.merriam-webster.com/dictionary/pa
             | 
             | Relevant for the US.
        
           | pimlottc wrote:
           | To me (American Midwest), "papa" (father) and "pawpaw" (a
           | type of fruit) are not pronounced the same way. "Papa" is
           | more like "pahpah".
        
           | nulbyte wrote:
           | If papa is a stand-in for father, I'd pronounce it with a
           | long a, as in father. If papa is a stand-in for grandfather,
           | I'd pronounce the first a as in apple, and the second as in
           | paw. But of also spell it papaw. Seeing 'pa' in its own, I'd
           | never think it was pronounced like paw, unless I was reading
           | something written in Hungarian.
        
             | appletrotter wrote:
             | I pronounce 'pa' like 'paw.' Short for papa I guess. Always
             | have, always will.
        
         | jrm4 wrote:
         | You're not in the American South, are you?
         | 
         | These are not far from one another here.
        
         | drexlspivey wrote:
         | Wait till you hear how age is pronounced
        
           | mtlmtlmtlmtl wrote:
           | Awgee?
        
       | yakattak wrote:
       | This is interesting. I've been using Bitwarden for a long time
       | now but I didn't realize how convenient a command line password
       | manager would be. Still though, not being integrated with iOS is
       | a non-starter for me but I really like this idea.
       | 
       | It would be cool to see the other apps like Bitwarden adopt a CLI
       | to use passwords with other command line tools. Kind of like the
       | Apple Keychain API but easier to work with in a *nix environment.
        
         | davidrusu wrote:
         | you're in luck, bitwarden has got a cli see:
         | https://bitwarden.com/help/cli/
        
       | FiloSottile wrote:
       | Hah, I saw this just after sending a newsletter issue on my
       | password management solution, which is based on passage [1] (a
       | fork of password-store [2] that uses age [3]) and YubiKeys.
       | 
       | My age+YubiKeys Password Management Solution --
       | https://words.filippo.io/dispatches/passage/
       | 
       | The main feature is some protection against post-compromise
       | exfiltration: even if an attacker fully compromises my laptop,
       | they can't extract the whole vault.
       | 
       | [1]: https://github.com/FiloSottile/passage
       | 
       | [2]: https://www.passwordstore.org
       | 
       | [3]: https://age-encryption.org
        
         | imiric wrote:
         | Very cool! Thanks for all your work!
         | 
         | I was waiting for a solution to store age keys on a security
         | key, and it's great that it's now possible with YubiKeys.
         | 
         | I currently use smart cards to store my GPG keys, which works
         | even on Android, as there are some that support NFC, so I can
         | use them with the OpenKeychain and Password Store apps. I need
         | to have passwords available on mobile, as often when I'm
         | traveling I don't want to lug around a laptop. The QR code
         | solution you suggest doesn't seem optimal.
         | 
         | Would it be possible to achieve the same workflow with age and
         | NFC YubiKeys? I suppose it would need a native mobile app for
         | that to work.
        
           | FiloSottile wrote:
           | If using the OpenPGP applet over NFC is possible, then it's
           | almost certainly possible to use the PIV one with age keys
           | too!
           | 
           | The Andorid password-store app is working on an
           | implementation of age in Kotlin (https://github.com/android-
           | password-store/kage) and I think they already support passage
           | stores. Maybe you could open a feature request for age-
           | plugin-yubikey compatibility? If you do, feel free to tag me,
           | and I can help make sure the formats are well specified.
        
         | zikduruqe wrote:
         | I updated to 1.1.1 yesterday and hope to try with a Yubikey
         | here soon.
        
       | woodruffw wrote:
       | From a cursory scan, this looks like it doesn't support key
       | wrapping -- the private key ("identity" in age's parlance) is
       | stored unencrypted on disk.
       | 
       | This is arguably a non-issue for most use cases (disk access is
       | "game over" under most threat models), but it's nice to have e.g.
       | for sharing configurations between multiple machines over a
       | public channel (like a dotfiles repository). It would also bring
       | this roughly up to "spec" with what other password managers do
       | (i.e., in terms of requiring a "master" password that unlocks the
       | vault).
        
         | j3s wrote:
         | very true, and thank you for pointing this out. this is an
         | intentional design decision - you can see me rationale here:
         | https://j3s.sh/thought/storing-passwords-with-age.html
         | 
         | it boils down to exactly what you noted - disk access is game
         | over in most cases anyways, and i like the convenience of
         | plaintext on the disk.
         | 
         | i will be exploring the yubikey model that filippo recently
         | outlined though https://words.filippo.io/dispatches/passage/ -
         | so stay tuned! :D
        
           | woodruffw wrote:
           | Thanks for sharing your rationale! I tend to agree -- the
           | practical alternative for Linux anyways is some kind of key
           | agent, and it's unclear to me (having written a few password
           | managers at this point, including an age-based one[1]) that
           | the attacker model for an agent is any different. The only
           | advantage is the "public" channel one I mentioned, and that
           | can of course be done out of band.
           | 
           | And since I forgot to say it earlier: excellent work!
           | 
           | [1]: https://github.com/woodruffw/kbs2
        
             | j3s wrote:
             | wow, extremely cool, ty! i'm excited to play with kbs2 when
             | i find a little free time.
        
       | Ciantic wrote:
       | There is also Passage by Age's creator Filippo Valsorda:
       | https://github.com/FiloSottile/passage
        
       | [deleted]
        
       | rollcat wrote:
       | The hard part of building a (good) password manager is not
       | actually the encryption backend (gpg, age, etc...), or the
       | frontend (CLI, dmenu, GUI...), or the sync (git, CRDTs,
       | whatever), or even integrating the biometric unlock -- but
       | correctly integrating it with every app and website that expects
       | to take your passwords.
       | 
       | AWS console has three fields (account, user, password), most
       | websites will take your password and/or MFA code on a separate
       | page, some apps will use Electron, some will use native widgets,
       | some will use NON-native widgets (like GTK/Qt on Mac/Windows),
       | some apps (like games) will be running in full screen...
       | 
       | It's a world of madness and I have huge respect for the password
       | managers that actually try to solve _these_ problems (even if
       | most do it only half-decently).
        
         | onionisafruit wrote:
         | It would be nice if there was something like ad blocker filter
         | lists for password managers so that every new password manager
         | doesn't have to keep this up on its own. Maybe there is and I
         | haven't run across it.
        
         | j3s wrote:
         | for what it's worth, the pa -> browser input "integration"
         | feels a lot better than you'd think, but takes a little bit of
         | effort to setup.
         | 
         | check out the contrib/ dir for some supported programs - get
         | one of those in your $PATH, and set up a hotkey to launch it.
         | 
         | now, whenever you press the hotkey, a list of your passwords
         | will show up, which you may type to filter. when you press
         | return, the password you selected will be automatically typed
         | into whatever you have highlighted, whether it's a password
         | field in a browser, or vim. the neat thing is that the password
         | never touches your clipboard since it's typed directly by
         | either wtype or xdotool.
         | 
         | the workflow really only takes a second or two once you have it
         | setup, and feels very nice, imo!
        
         | mahathu wrote:
         | It would be nice if a password manager could take care of
         | detecting a page reload/change and auto fill the rest of the
         | form, but I guess the risk of skipping through pages without
         | any user interaction is too large for users (including myself)
         | to trust it. I think the problem rather lies in how difficult
         | modern UI makes it to sign in sometimes
         | 
         | ppppp,,,,,,,,,,,
        
         | [deleted]
        
         | RamenJunkie_ wrote:
         | I really don't understand this trend that has popped up int he
         | last few years of putting the Password on a separate page from
         | the username. The Password manager usually catches it but
         | sometimes does not. It just needlessly adds an extra step/page
         | to the log in process.
        
           | counttheforks wrote:
           | It allows you to determine the authentication method based on
           | username. Some users may need SSO, some may need email login,
           | and yet others may simply use a password.
        
           | ipqk wrote:
           | As others have said, it depends on the authentication method.
           | 
           | Some users may not even have a password. They'll be sent an
           | email or sms with an authenticated link. So to put a password
           | box in front of them may be confusing.
           | 
           | But it's definitely annoying to those of us with general
           | passwords.
        
           | deathanatos wrote:
           | This is sometimes for SSO. If your user logs in with some
           | form of SSO, after the username entry, you get redirected to
           | your IdP, instead of prompted for a password.
        
             | projektfu wrote:
             | I think it's also fashion. Monkey see Google, monkey do
             | Google.
        
           | [deleted]
        
         | vbezhenar wrote:
         | I've yet to see password manager I'd trust to mess my browser
         | with. I don't want autocomplete. I want convenient and
         | controlled access to my passwords and that's about it. Every
         | password manager wants to run its non-opaque JavaScript on my
         | login pages which I can't allow.
         | 
         | What I need is:
         | 
         | show button on top bar if current website has stored passwords.
         | At this point no logins/passwords are requested from the
         | password manager, only website URLs (or even hashes).
         | 
         | After I click this button, request and show list of logins
         | saved for this website. Let me choose login if there are
         | multiple. Otherwise alter browser context menu.
         | 
         | Now when I right-click on text input, add items like "Insert
         | login: vbezhenar" and "Insert password for vbezhenar".
         | 
         | And only when I choose "insert password" - actually request
         | password from the password manager.
         | 
         | That's the only sane UI. Until I find it or write it myself,
         | I'll continue to copy-paste passwords around.
         | 
         | It's a sad state of things where password managers are still
         | not as usable as text file.
        
           | worldsavior wrote:
           | That's why there is autofill in Android.
        
           | Jim_Heckler wrote:
           | this sounds very much like the keepassxc browser integration
        
           | orangepurple wrote:
           | Keepass and derivatives like KeepassXC (preferred) have
           | configurable autocomplete which emulates a keyboard and
           | seamlessly moves between UI fields using any key presses you
           | want. By default it switches windows with Alt Tab and Tabs
           | between fields.
        
           | kadoban wrote:
           | This seems _pretty_ close to how Bitwarden works. In fact,
           | unless I'm missing some requirement, it's close enough that
           | you can do that yourself if you just manually click the "copy
           | username" and "copy password" buttons instead of the usual
           | "just fill crap from this login" button. Those buttons aren't
           | any harder to reach either, they're just smaller.
        
             | remram wrote:
             | But are we sure they don't inject any JavaScript before you
             | hit the "fill" button?
        
           | 1f60c wrote:
           | Maybe I'm missing something, but why would you trust any app
           | to securely store your passwords (or store them at all) but
           | specifically mistrust their browser extension?
        
             | vbezhenar wrote:
             | 1. Browser extension interacts with every website by
             | design. And it means that every website has a direct path
             | to access my passwords if extension is buggy. I don't know
             | how to solve this issue without special browser API, but
             | requiring user to click for every step before sending
             | actual data might reduce that attack surface compared to
             | convenient automatic mode.
             | 
             | 2. Web apps are wild and doing wild things. Even humans
             | might find it hard to fill the form correctly. Extension
             | can only observe DOM. Who knows which inputs it will fill
             | with my passwords? I don't trust myself to write that kind
             | of auto fill code which would work reliably. And if I don't
             | trust myself, I definitely don't trust others to do so.
             | 
             | I don't claim that extensions are malicious. That would not
             | make sense indeed. Just that extensions are things I don't
             | trust to be implemented correctly, especially with
             | convenient auto-pilot mode.
        
               | 1f60c wrote:
               | Both are great points. Thanks!
        
         | cristoperb wrote:
         | > The hard part of building a (good) password manager is ...
         | correctly integrating it with every app and website that
         | expects to take your passwords
         | 
         | What's wrong with plain old copy-and-paste? (I know there are
         | probably some security concerns under X11, but Keepass, for
         | example, will automatically clear the clipboard after a few
         | seconds at least.) I use Keepass and 1password.com, but I don't
         | use any of their autofill features; I just copy a password when
         | I need it and paste it to where I need it.
         | 
         | I think a user-friendly, secure, and reliable sync is the much
         | more difficult part of implementing a good password manager.
        
           | jonwinstanley wrote:
           | Copy and paste is fine, plus most usernames are your email,
           | which should auto complete
        
           | rollcat wrote:
           | > What's wrong with plain old copy-and-paste?
           | 
           | Context awareness.
           | 
           | I currently have 429 items in my PM (it happens to be
           | 1Password, specifically because it's extremely good at
           | figuring this crap out). I almost never have to search for
           | anything; even if I do, I can easily update the entry, so
           | that it understands the context, in which a given credential
           | can be valid; e.g. I can use my Blizzard login both on
           | "https://battle.net", and in "app://sc2" (StarCraft 2). If I
           | have a main+alt account, it will allow me to choose from the
           | two, not 400+.
           | 
           | It's the same as with using contactless payments with a
           | smartwatch, it saves you 10 seconds here, a minute there -
           | and over the course of your day, day after day - it starts
           | adding up.
           | 
           | > I think a user-friendly, secure, and reliable sync is the
           | much more difficult part of implementing a good password
           | manager.
           | 
           | CRDTs solve this problem quite generally. I've never tried
           | actually implementing sync from scratch in a desktop/mobile
           | app, but the theory behind CRDTs is quite easy to grasp and
           | makes a lot of sense. I'd say it's quite a bit harder to sync
           | plain, old files, because the only metadata you have
           | available is things like names, access/modification times,
           | etc and they tend to be huge binary blobs, like photos or
           | music, so the problem of automatic conflict resolution gets
           | quite interesting.
           | 
           | BTW look up Apple's CloudKit. I've done a "let's pretend
           | we're on a 1990s Internet" challenge[1] a while ago, and it's
           | amazing how reliably everything syncs, even if the devices
           | are online for maybe 1% of the day.
           | 
           | [1]: https://www.rollc.at/tags/challenge/
        
           | [deleted]
        
           | forty wrote:
           | The issue with copy pasting password is phishing, which for
           | most real life users is a much bigger risk than most other
           | risks
        
           | [deleted]
        
         | TillE wrote:
         | This is precisely why I stopped using KeePass, the browser
         | extensions just weren't good enough.
         | 
         | Bitwarden is significantly better, though it also occasionally
         | does the thing where the prompt to save a new password
         | disappears, because of redirects or something.
        
           | latchkey wrote:
           | I've retrained myself to always just create the account first
           | in BW instead of rely on that prompt mechanism. Once the
           | account is created in BW, you can just auto-fill it into the
           | u/p fields.
        
         | pqb wrote:
         | That's true, the simple & fast UI (TUI/GUI) helps a lot.
         | However, I would not extrapolate it to a huge problem. I am
         | person, who have written own pass/passage implementation [0],
         | just because I disliked how many steps I need to make to select
         | the password for the form input, modify it or sync secrets.
         | 
         | Initially, I had used the `gopass`. It is probably the most
         | convenient way to start using the password-store. It is cross-
         | platform, 100% compatible with pass & pass-otp. To copy the
         | password, you basically type the part of the file you are
         | looking for. If you type "gopass show github", it will display
         | a TUI, where you can select the file you are looking for (let's
         | say you have two files "personal/github.com.gpg" and
         | "work/github.com.gpg"). Unfortunately, the search function was
         | far from perfect, and it had a problem with typos like "gtihbu"
         | at the time, when I was using it.
         | 
         | To get rid of this issue, I decided to adapt pass/gopass to use
         | `fzf` [2]. In the same time, my .password-store/ dir was
         | rapidly growing that made me think about implementing pass from
         | scratch. I improved the implementation to have better caching,
         | synchronization between machines/mobile, but more importantly -
         | a simple `secret [arg]` command that will execute `fzf` to list
         | all known creds and simplify selection of the password. Of
         | course, it accepted an argument that was limiting the results,
         | which is great when you need to get back to the previous
         | credential to retype something.
         | 
         | The introduction of `fzf` made it really convenient, and I
         | decided to add more commands with fuzzy search, such as:
         | 
         | - `otp` - limits results files containing TOTP/HOTP token,
         | calculates and copies it to the clipboard.
         | 
         | - `secret-edit`, `secret-remove`, `secret-show`... aliases to
         | sub-commands that open `fzf` command in multi-selection mode,
         | so by utilizing space key I could select what files are meant
         | to be modified, removed, displayed etc. Quite handy for mass-
         | edit.
         | 
         | - `secret-qr` - similar to the gopass' feature, but it made a
         | simplified way to create and display QR codes dedicated to
         | share contacts, WiFI SSID+password combination (etc.) to
         | someone who was asking for creds from me.
         | 
         | Awesome, but alt-tabbing to the terminal got me annoyed after a
         | few years of using it that way. I started pursuing for more
         | sophisticated interface. I decided to give `rofi` [3] a try. I
         | managed to fork that repo and also adapt to my convention of
         | using password-store, but I left i3 for a macOS.
         | 
         | Currently, I have started working on a browser extension that
         | takes care of suggesting password-store creds (based on the
         | path, input parameters, location on the website etc.) similarly
         | to what uBlock Origin does. That configuration is passed to my
         | pass implementation, so on the github.com, my browser have only
         | "work" and "personal" auto-suggestion, when I am focusing the
         | text input.
         | 
         | I plan to create a similar app to Shortcat [4], but it will
         | preserve the information what credential has been asked for the
         | focused app. I think, with VoiceOver assistance, it is more
         | than possible to mitigate the need for alt-tabbing to the
         | terminal for electron/native apps.
         | 
         | [0]: It is a private repository, maybe when it will be polished
         | enough I will open-source it.
         | 
         | [1]: https://github.com/gopasspw/gopass
         | 
         | [2]: https://github.com/junegunn/fzf
         | 
         | [3]: https://github.com/alecdwm/pass-rofi-gui
         | 
         | [4]: https://shortcat.app/
         | 
         | Edit: About the AWS login form. I strongly recommend giving
         | `aws-vault` (https://github.com/99designs/aws-vault) a try. It
         | helps you skip the login form with a simple command e.g.: "aws-
         | vault login acme-corp --duration 2h". I find it better than
         | `aws-mfa` on my dev machine.
        
         | TedDoesntTalk wrote:
         | > integrating it with every app and website
         | 
         | Yes, and I would add password device sync for multiple
         | operating systems and browser extensions. Without sync,
         | hundreds of unique, unmemorable passwords are not much value.
        
         | ricardobeat wrote:
         | I've been using a homegrown solution that is very similar to
         | this, for about three years now.
         | 
         | The way I access it is via Blink app on iPad/iPhone, the
         | terminal on mac, WSL on Windows. Copy and paste the password,
         | clear the clipboard (done automatically when using the
         | terminal). It takes a few extra seconds but works anywhere, and
         | I can add password-specific notes for cases like your AWS
         | example.
         | 
         | Putting the password in the clipboard is the least safe part,
         | but I definitely prefer this over giving some random app full
         | access to my browser / system.
        
           | rollcat wrote:
           | > It takes a few extra seconds
           | 
           | That's specifically the part I was extremely unhappy with, as
           | a former pass+dmenu user, who has migrated to 1Password. It's
           | a cold, autumn evening, we're down from the mountain hike and
           | running to catch the last train home to return from the trip,
           | and I need to buy the ticket either before or as soon as I'm
           | on board; my stiff fingers are trying to make things happen
           | on a phone with a small screen, poor reception, and a slowly
           | dying battery. I need that password *now*.
        
       | upofadown wrote:
       | I don't think age does any real password extension. So if you are
       | used to something that does (GnuPG's 0.1 second extension for
       | example) you might want to add an extra word or two to your
       | passphrase.
       | 
       | Pet usability peeve triggered here. If we create a system that
       | completely depends on the strength of a password/passphrase we
       | have to give the user concrete advice on how to create a
       | password/passphrase that will be strong on that particular
       | system.
        
         | woodruffw wrote:
         | I'm not following. This encryption model here is a master
         | private key, so there's no master password involved. Are you
         | referring to the generated passwords? If so, the default seems
         | reasonably long (and is outside of age's scope anyways, since
         | it's just the encrypted content).
        
           | upofadown wrote:
           | Sorry. I missed that. The ultimate security of the saved
           | passwords here depends on the security of the operating
           | system and file system.
           | 
           | So I really should of complained that this fact was not made
           | very clear to the user... :)
        
             | [deleted]
        
             | j3s wrote:
             | > So I really should of complained that this fact was not
             | made very clear to the user
             | 
             | how could i have made this more clear? what would you like
             | to see?
        
               | upofadown wrote:
               | Dunno, something like what I said before?
               | 
               | >The ultimate security of the saved passwords here
               | depends on the security of the operating system and file
               | system.
        
         | FiloSottile wrote:
         | This password manager seems to use private keys, so there is no
         | passphrase used for encryption here.
         | 
         | However, generally speaking, age uses scrypt for password key
         | derivation, with a default work factor of 2^18 (1 second on
         | modern machines). Unlike GnuPG's S2K, scrypt is both CPU and
         | memory hard.
        
           | upofadown wrote:
           | Then how short can I make my passphrase? It should be shorter
           | than with GnuPG but no one knows how long to make the
           | passphrase for GnuPG either...
           | 
           | This gets back to my original peeve. This sort of thing has
           | to be worked out for the user. I looked through the available
           | documentation. Was I as a user expected to look through the
           | source code and figure it out for myself?
        
             | woodruffw wrote:
             | My understanding is that, even with a CPU and memory-hard
             | KDF, the standard recommendation is to use a strong and
             | difficult to guess password. It's meant to be a layer of
             | protection against cracking, not an opportunity to use a
             | shorter password than you normally would.
        
               | upofadown wrote:
               | OK, but what is that? I am a user. What do I do?
        
               | tptacek wrote:
               | Questions like these are indistinguishable from trolling.
               | You've responded to the direct, common-knowledge answer
               | to your question by repeating the question. Please stop
               | doing this.
        
         | some_furry wrote:
         | > I don't think age does any real password extension.
         | 
         | Did you even bother to check?
         | 
         | https://github.com/FiloSottile/age/blob/main/scrypt.go
         | 
         | This isn't exactly hidden.
        
           | upofadown wrote:
           | That is source code. I as a user should not have to look at
           | the source code so that I can use a program.
        
             | some_furry wrote:
             | If you feel yourself technically proficient enough to
             | comment on cryptography (mostly PGP apologia), then you
             | should be capable of looking at source code to figure out
             | whether or not something "does any real password
             | extension".
             | 
             | If anyone else (i.e. "a user") made this mistake, I'd be
             | more sympathetic. But not for you.
             | 
             | You don't get to have your cake and eat it too. Are you a
             | cryptography expert, or aren't you?
             | 
             | If yes, then failing to bother to check the source code is
             | a faux pas.
             | 
             | If no, then I expect you to stop trying to argue as a
             | cryptography expert the next time someone points out that
             | PGP is bad cryptography.
             | 
             | I don't care which you choose. I only ask that you stick to
             | it.
        
             | deathanatos wrote:
             | ... okay, then look at the spec, which is beautifully
             | simple: https://github.com/C2SP/C2SP/blob/main/age.md#the-
             | scrypt-rec...
        
               | upofadown wrote:
               | "N = work factor"
               | 
               | So nothing there to indicate exactly how much work
               | extension, if any, is done.
        
         | tptacek wrote:
         | Please stop trolling.
        
       | ladon86 wrote:
       | What would people recommend for backup (perhaps even sync) of the
       | vault?
        
         | zikduruqe wrote:
         | A bare git repo. I keep mine on a Raspberry Pi at home synced
         | via Tailscale or Wireguard depending on device or the network
         | I'm on.
         | 
         | git init --bare
         | 
         | Then I can sync it to multiple devices via pull or push.
        
         | j3s wrote:
         | I use a git repo to keep my passwords synced - then I have a
         | shell alias that makes a commit and pushes it. pretty simple!
         | 
         | I have thought about adding git support directly to pa, but I
         | think it's out of scope.
        
           | [deleted]
        
           | jrm4 wrote:
           | Because I'm lazy and you're here.
           | 
           | Here's what I do now:
           | 
           | Encrypted volume synced with syncthing, everything basically
           | stored as plain text and (like you, i think) a few shell
           | scripts to throw passwords into the clipboard.
           | 
           | Would your thing work with a simple synced volume?
        
             | j3s wrote:
             | yep! pa has absolutely no problem with that.
        
         | jszymborski wrote:
         | my KeePass vault is backed up with the rest of my files using
         | Borg. I sync between my computers using SyncThing.
        
       ___________________________________________________________________
       (page generated 2022-12-28 23:02 UTC)