6 ms·

Show HN: Passbox – Another password manager using Bash and GPG

41 points by RobBollons 11y ago

UK-AL 11y ago
Has anyone build a hash style password manager. hash(website name + global password + increment) = password to use? or something like it
- dchest 11y ago
  Seems like everyone build this scheme. Seriously, there are many browser plugins and websites implementing it, and almost all of them ignore research (I'm guilty too). Also, most of them use fast hash functions instead of proper password hashes. Here's a quick analysis of pros and cons of password generators compared to password managers: http://crypto.stackexchange.com/a/5691/291 http://crypto.stackexchange.com/a/5691/291 I used a password generator (my own) for a few years, and I'm happy to use a password manager now, which is safer and makes me avoid keeping certain information in my mind (e.g. if I already have an account on this website and what's my username for it).
- moqster 11y ago
  https://github.com/pinae/ctSESAM-python-memorizing https://github.com/pinae/ctSESAM-python-memorizing
- drdaeman 11y ago
  That's a very popular scheme. The major downside is that site saying "your password must [not] contain blah-blah-blah"/"be N to M characters long"/"may contain only digits" when the generated one just happens to not conform to such restriction. In my personal experience, one out of dozen sites tries to be smartass about the passwords, so the scheme is a PITA in the long run. Without the increment you also can't rotate password, while with the increment you need to store the increment value (and if you do keep the notes and the master secret, why not just remember the password already?) The password managers are more flexible than password generators, because they don't have such limitations.
  - onionjake 11y ago
    I wrote my own hashing method [1] that given a correct spec for password restrictions would always generate a valid password. It does it by taking the hash in base64, then translating those a new set of base64 characters chosen to increase the likelihood of getting a valid password. If one generated is not valid, it then iterates until a valid one is found (by cycling the bits). I have used this personally since I wrote it. Given the downsides, I agree that password managers are probably better for most people. [1]: https://github.com/onionjake/doh https://github.com/onionjake/doh
- brillenfux 11y ago
  I had people tell me that this would have problems with entropy. I didn't fully understand that, though.
- SnacksOnAPlane 11y ago
  http://www.supergenpass.com/ http://www.supergenpass.com/
- AdmiralAsshat 11y ago
  I assume that the "increment" is so that you can hash the password again in case the password needs to be changed. But how do you tie the increment to that particular password? Otherwise your increment would have to be global, and if one of your passwords gets compromised you would have to hash all 200 others again simply in order to keep the increment consistent.
- rmurri 11y ago
  http://masterpasswordapp.com/ http://masterpasswordapp.com/ has a pretty good implementation.
- bradleyjg 11y ago
  This has similar security properties to a salted password based key derivation scheme. Given the output, and assuming a function with effective preimage resistance, the best way to find the global password is brute force it by trying lots of master passwords. The security is a function of the forward difficulty of the KDF (in space and time) and the quality of the master password. Use the password 'password' and MD5 and you don't have much security except through obscurity. Use an 8 word diceware password and scypt and you are doing great security wise (assuming of course no implementation problems, a big assumption!)
- gaadd33 11y ago
  https://oneshallpass.com/ https://oneshallpass.com/ does that plus has a bunch of other options. It's by the founder of OkCupid and Keybase.io
sasvari 11y ago
related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities. http://www.passwordstore.org/ http://www.passwordstore.org/
- drdaeman 11y ago
  Downside of pass is that the filenames are in the open. Thus, metadata (which sites you have account on) is not secured. Linked one seems to store everything in a single encrypted file. Upside is that it has ton of implementations readily available - browser integration, mobile apps, etc. Linked one (passbox) is just a bash script at the moment, if one wants to use it across multiple devices and platforms, the experience may be quite rough. Another upside is that with a single file model you have to invent your own conflict resolution scheme. For pass, git just does the trick. And this one doesn't seem to have anything in this regard.
  - jessaustin 11y ago
    ...filenames are in the open. Is this something that can't be fixed by directory perms?
    - drdaeman 11y ago
      If you trust the box. That said, if you have a secure trusted machine with FDE that you don't let strangers touch, and where every piece of software is well-isolated (for example, web browser is sandboxed and can't access the ~/.password-store/), then yeah, filesystem permissions will do the trick. But, for example, if you sync using git repo hosted on some third-party VPS then directory permissions won't protect you from that host owner or whoever gains superuser access to the filesystem. (Hey, don't downvote the parent, he didn't said anything wrong, just asked a question! In my opinion that contributes to the discussion.)
cornstalks 11y ago
How do you work with these terminal-based password managers? Request the password (à la `passbox get facebook`) and then copy 'n' paste it into the website? Are there any security concerns of the password being in the clipboard/memory (beyond the obvious of accidentally pasting it)?
- RobBollons 11y ago
  That's definitely a way of using it, another is to just manually type it in as you see it and clear the terminal buffer afterwards. If you do use your clipboard it does require a certain amount of due diligence in making sure you empty it afterwards if you're concerned about that as a security risk. It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay. It would be possible to construct an attack using Flash to access a users clipboard form a web browser. I know a lot of people like to have browser plugins for password managers but i always feel uncomfortable using them because i don't understand enough about the technology to trust that it wont be vulnerable.
  - sasvari 11y ago
    It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay. pass [0] (see comment above [1]) claims to do that: show [ --clip, -c ] pass-name Decrypt and print a password named pass-name. If --clip or -c is specified, do not print the password but instead copy the first line to the clipboard using xclip(1) and then restore the clip‐board after 45 (or PASSWORD_STORE_CLIP_TIME) seconds. [0] http://www.passwordstore.org/ http://www.passwordstore.org/ [1] https://news.ycombinator.com/item?id=10190719 https://news.ycombinator.com/item?id=10190719
    - RobBollons 11y ago
      Clipboard integration probably isn't something i would look to add to passbox myself, but if someone can find a way to get it to work nicely cross platform and submit a PR then i would likely merge it.
adam_albrecht 11y ago
This looks very nice, but I would need browser extensions and mobile apps to go along with it. 1Password is honestly the one app that has kept me from switching to Linux from OSX. Would love to see a decent open source alternative.

41 points by RobBollons 11y ago

UK-AL 11y ago

Has anyone build a hash style password manager. hash(website name + global password + increment) = password to use? or something like it

dchest 11y ago
Seems like everyone build this scheme. Seriously, there are many browser plugins and websites implementing it, and almost all of them ignore research (I'm guilty too). Also, most of them use fast hash functions instead of proper password hashes. Here's a quick analysis of pros and cons of password generators compared to password managers: http://crypto.stackexchange.com/a/5691/291 http://crypto.stackexchange.com/a/5691/291 I used a password generator (my own) for a few years, and I'm happy to use a password manager now, which is safer and makes me avoid keeping certain information in my mind (e.g. if I already have an account on this website and what's my username for it).
moqster 11y ago
https://github.com/pinae/ctSESAM-python-memorizing https://github.com/pinae/ctSESAM-python-memorizing
drdaeman 11y ago
That's a very popular scheme. The major downside is that site saying "your password must [not] contain blah-blah-blah"/"be N to M characters long"/"may contain only digits" when the generated one just happens to not conform to such restriction. In my personal experience, one out of dozen sites tries to be smartass about the passwords, so the scheme is a PITA in the long run. Without the increment you also can't rotate password, while with the increment you need to store the increment value (and if you do keep the notes and the master secret, why not just remember the password already?) The password managers are more flexible than password generators, because they don't have such limitations.
- onionjake 11y ago
  I wrote my own hashing method [1] that given a correct spec for password restrictions would always generate a valid password. It does it by taking the hash in base64, then translating those a new set of base64 characters chosen to increase the likelihood of getting a valid password. If one generated is not valid, it then iterates until a valid one is found (by cycling the bits). I have used this personally since I wrote it. Given the downsides, I agree that password managers are probably better for most people. [1]: https://github.com/onionjake/doh https://github.com/onionjake/doh
brillenfux 11y ago
I had people tell me that this would have problems with entropy. I didn't fully understand that, though.
SnacksOnAPlane 11y ago
http://www.supergenpass.com/ http://www.supergenpass.com/
AdmiralAsshat 11y ago
I assume that the "increment" is so that you can hash the password again in case the password needs to be changed. But how do you tie the increment to that particular password? Otherwise your increment would have to be global, and if one of your passwords gets compromised you would have to hash all 200 others again simply in order to keep the increment consistent.
rmurri 11y ago
http://masterpasswordapp.com/ http://masterpasswordapp.com/ has a pretty good implementation.
bradleyjg 11y ago
This has similar security properties to a salted password based key derivation scheme. Given the output, and assuming a function with effective preimage resistance, the best way to find the global password is brute force it by trying lots of master passwords. The security is a function of the forward difficulty of the KDF (in space and time) and the quality of the master password. Use the password 'password' and MD5 and you don't have much security except through obscurity. Use an 8 word diceware password and scypt and you are doing great security wise (assuming of course no implementation problems, a big assumption!)
gaadd33 11y ago
https://oneshallpass.com/ https://oneshallpass.com/ does that plus has a bunch of other options. It's by the founder of OkCupid and Keybase.io

sasvari 11y ago

related: pass - the standard unix password manager Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities. http://www.passwordstore.org/ http://www.passwordstore.org/

drdaeman 11y ago
Downside of pass is that the filenames are in the open. Thus, metadata (which sites you have account on) is not secured. Linked one seems to store everything in a single encrypted file. Upside is that it has ton of implementations readily available - browser integration, mobile apps, etc. Linked one (passbox) is just a bash script at the moment, if one wants to use it across multiple devices and platforms, the experience may be quite rough. Another upside is that with a single file model you have to invent your own conflict resolution scheme. For pass, git just does the trick. And this one doesn't seem to have anything in this regard.
- jessaustin 11y ago
  ...filenames are in the open. Is this something that can't be fixed by directory perms?
  - drdaeman 11y ago
    If you trust the box. That said, if you have a secure trusted machine with FDE that you don't let strangers touch, and where every piece of software is well-isolated (for example, web browser is sandboxed and can't access the ~/.password-store/), then yeah, filesystem permissions will do the trick. But, for example, if you sync using git repo hosted on some third-party VPS then directory permissions won't protect you from that host owner or whoever gains superuser access to the filesystem. (Hey, don't downvote the parent, he didn't said anything wrong, just asked a question! In my opinion that contributes to the discussion.)

cornstalks 11y ago

How do you work with these terminal-based password managers? Request the password (à la `passbox get facebook`) and then copy 'n' paste it into the website? Are there any security concerns of the password being in the clipboard/memory (beyond the obvious of accidentally pasting it)?

RobBollons 11y ago
That's definitely a way of using it, another is to just manually type it in as you see it and clear the terminal buffer afterwards. If you do use your clipboard it does require a certain amount of due diligence in making sure you empty it afterwards if you're concerned about that as a security risk. It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay. It would be possible to construct an attack using Flash to access a users clipboard form a web browser. I know a lot of people like to have browser plugins for password managers but i always feel uncomfortable using them because i don't understand enough about the technology to trust that it wont be vulnerable.
- sasvari 11y ago
  It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay. pass [0] (see comment above [1]) claims to do that: show [ --clip, -c ] pass-name Decrypt and print a password named pass-name. If --clip or -c is specified, do not print the password but instead copy the first line to the clipboard using xclip(1) and then restore the clip‐board after 45 (or PASSWORD_STORE_CLIP_TIME) seconds. [0] http://www.passwordstore.org/ http://www.passwordstore.org/ [1] https://news.ycombinator.com/item?id=10190719 https://news.ycombinator.com/item?id=10190719
  - RobBollons 11y ago
    Clipboard integration probably isn't something i would look to add to passbox myself, but if someone can find a way to get it to work nicely cross platform and submit a PR then i would likely merge it.

adam_albrecht 11y ago

This looks very nice, but I would need browser extensions and mobile apps to go along with it. 1Password is honestly the one app that has kept me from switching to Linux from OSX. Would love to see a decent open source alternative.