<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Adding something new may be fine, although I have no say in what is
going to be accepted and the mainainer is not often seen around
here. <br>
But I can tell you with high certainty that a change like this,
which breaks pass in the way it worked before (and a lot of tools
are relying on that behaviour) will not get accepted.<br>
<br>
On the topic why you are introducing all this, I'm not convinced it
would be a good idea. Your reasons are that it is "easier, stronger
and simpler".<br>
Easier and simpler may apply, but the selling point of pass is that
it is a console password manager with a gpg backend. People looking
for pass want to use gpg - and symmetric encrption is, at best, an
edge case of gpg usage.<br>
<br>
Stronger: I do not agree with you. The only way to make it stronger
would be a passphrase that is longer than your asymetric private
key. I don't believe anyone uses a passphrase that is >4096 bits
long. The weakest part is always the passphrase.<br>
But in the asymmetric scenario, an attacker would need the
passphrase AND the key file. In the symmetric scenario, he just
needs your passphrase.<br>
<br>
Regards,<br>
Lenz<br>
<br>
<div class="moz-cite-prefix">On 26.01.2016 08:18, Dashamir Hoxha
wrote:<br>
</div>
<blockquote
cite="mid:CAMucfLwbqj4c6D1pHwpj28oQ+YHJQ_7Yn9R+GB_3fA=vBY-T0w@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Hi,</div>
<div><br>
</div>
This works, as a proof of concept:
<div><a moz-do-not-send="true"
href="https://github.com/dashohoxha/password-store/commit/e8f6ab50150a156f8736467bcce7a164d4253886">https://github.com/dashohoxha/password-store/commit/e8f6ab50150a156f8736467bcce7a164d4253886</a><br>
</div>
<div><br>
</div>
<div>If the variable $PASSWORD_STORE_GPG_ENCRYPTION</div>
<div>is set to 'asymmetric', it will work as usual.</div>
<div>Otherwise it will use the symmetric encryption.</div>
<div><br>
</div>
<div>However I am not satisfied with this. Having to set the
variable</div>
<div>PASSWORD_STORE_GPG_ENCRYPTION is a bit awkward.<br>
</div>
<div>There must be a better way. For example, we can check for
the</div>
<div>presence of the file '.gpg-id'. If it is there, assume
asymmetric</div>
<div>encryption, otherwise, assume symmetric encryption.</div>
<div><br>
</div>
<div>What do you think?</div>
<div><br>
</div>
<div>Dashamir</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Password-Store mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Password-Store@lists.zx2c4.com">Password-Store@lists.zx2c4.com</a>
<a class="moz-txt-link-freetext" href="http://lists.zx2c4.com/mailman/listinfo/password-store">http://lists.zx2c4.com/mailman/listinfo/password-store</a>
</pre>
</blockquote>
<br>
</body>
</html>