<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 27, 2016 at 9:11 AM, Dahlberg, David <span dir="ltr"><<a href="mailto:david.dahlberg@fkie.fraunhofer.de" target="_blank">david.dahlberg@fkie.fraunhofer.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">Am Dienstag, den 26.01.2016, 20:21 +0100 schrieb Dashamir Hoxha:<br>
> Now it picks out automatically which gpg encryption to use,<br>
> based on the presence of the file .gpg-id<br>
<br>
</span>"pass init gpg-id" -> "pass init [gpg-id]" sounds dangerous to me. Like<br>
somebody who only half-remembers the commands (as most of us do) and<br>
does not pay too much attention may end up with a working password-store<br>
that is only encrypted with his smartcard PIN if he enters the<br>
following:<br>
<br>
pass init<br>
PIN<br></blockquote><div><br></div><div>Maybe you are right about this.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<span class=""><br>
> On the init command, if no gpg-id is given as argument,<br>
> then no .gpg-id file will be created, and the rest will always be<br>
> symmetric encryption/decryption.<br>
<br>
</span>The same applies here. In the current password-store semantics, a<br>
directory with a missing ".gpg-id" inherits the encryption key from it's<br>
parent. A missing .gpg-id in the root directory is taken as an indicator<br>
of a non-initialized store.<br>
<br>
So if you make a missing ".gpg-id" an indication of symmetric<br>
encryption, either you cannot cannot use symmetric for a sub-tree of an<br>
asymmetric tree, or you have to make sure that the ".gpg-id" is written<br>
into every sub-directory (which requires switching/converting to a new<br>
binary format) or you cannot have multiple keys per sub-tree any more.<br>
<br>
My advice would be to make symmetric encryption explicit:<br>
* "pass init -s" and<br>
* "cat symmetric" > "$PASSWORD_STORE_DIR/.gpg-id"<br></blockquote><div><br></div><div>No, it doesn't work the way that you think. </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class=""><font color="#888888"> </font></span></blockquote><div><br></div><div>It seems that this feature (adding support for symmetric encryption)</div><div>makes the program like frankenstein (it doesn't fit naturaly with the existing features).</div><div><br></div><div>So, I am starting a for of the program, called 'simple-password-store':</div><div> - <a href="https://github.com/dashohoxha/simple-password-store">https://github.com/dashohoxha/simple-password-store</a><br></div><div><br></div><div>One of the main changes will be to replace the asymmetric encryption</div><div>with symmetric encryption (getting rid of using private keys).</div><div><br></div><div>Another change will be to encrypt the whole directory, instead of the</div><div>individual password files (more secure and easier to manage).</div><div><br></div><div>Maybe the git functionality should be removed as well, but I am not sure.</div><div><br></div><div>I call it 'simple' because it does not support the advanced use cases</div><div>when you need to share your passwords with other people.</div><div>But you don't have to create and maintain private keys in order to</div><div>store your passwords, so hopefully its usage will be simpler.</div><div>And also I hope that the code will be a bit simpler to understand</div><div>(due to removing advanced features and asymmetric encryption).</div><div><br></div><div><div>Please subscribe (click the "Watch" button) to follow its development</div><div>and to help with any comments or ideas (and why not, patches and PR).</div></div><div><br></div><div>Thanks,</div><div>Dashamir</div><div><br></div><div> </div></div></div></div>