Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There are two things that bug me about pass:

* Website names are stored in plaintext filenames and directory hierarchies. No confidentiality and no integrity guarantees for those.

* It uses GPG's public-key encryption instead of symmetric-key encription. This integrates well with gpg-agent but it means that you need to carry a gpg private-key file around with you instead of just remembering a passphrase.



May I politely point out https://github.com/catch22/pw, which solves the first issue by using a single password database instead of a subdirectory (for the reason that you mention).


> carry a gpg private-key file around

You could get a yubikey (or other gpg smartcard) ;)


May I offer my very recent blogpost on pass + yubikey neo https://drupalwatchdog.com/blog/2015/6/yubikey-neo-and-bette...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: