<html><head></head><body>Unsubscribe my email address from this list please.<br><br><div class="gmail_quote">Le 9 février 2020 23:52:22 GMT+01:00, password-store-request@lists.zx2c4.com a écrit :<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Send Password-Store mailing list submissions to<br> password-store@lists.zx2c4.com<br><br>To subscribe or unsubscribe via the World Wide Web, visit<br> https://lists.zx2c4.com/mailman/listinfo/password-store<br>or, via email, send a message with subject or body 'help' to<br> password-store-request@lists.zx2c4.com<br><br>You can reach the person managing the list at<br> password-store-owner@lists.zx2c4.com<br><br>When replying, please edit your Subject line so it is more specific<br>than "Re: Contents of Password-Store digest..."<br><br><br>Today's Topics:<br><br> 1. Re: Supplying GPG key password into Pass command (Emil Lundberg)<br> 2. Re: Supplying GPG key password into Pass command<br> (password-store@storiepvtride.it)<br> 3. Re: Supplying GPG key password into Pass command<br> (Louis ProtonMail)<br> 4. Re: Supplying GPG key password into Pass command<br> (password-store@storiepvtride.it)<br> 5. Windows implementation of passwordstore in pure batch<br> (Miquel Lionel)<br> 6. Re: Windows implementation of passwordstore in pure batch<br> (Kenny Evitt)<hr>Message: 1<br>Date: Sun, 9 Feb 2020 12:24:17 +0100<br>From: Emil Lundberg <lundberg.emil@gmail.com><br>To: Louis ProtonMail <louiscb@protonmail.com><br>Cc: Password-Store <password-store@lists.zx2c4.com><br>Subject: Re: Supplying GPG key password into Pass command<br>Message-ID:<br> <CAJgCmPx3PvU-sFCEE_FevFczq5jWo=Amgvgu8RFZp=2xwx8BjQ@mail.gmail.com><br>Content-Type: text/plain; charset="utf-8"<br><br>On Sat, 8 Feb 2020, 12:52 Louis ProtonMail, <louiscb@protonmail.com> wrote:<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">My ultimate objective is to set up a web server that contains a front-end<br>application for my Pass store so that I can access my passwords on the fly.<br></blockquote><br><br>My solution to this problem is to use Syncthing [1] to replicate my<br>password store to all my machines, including my phone. Then I can always<br>access the local copy on whichever machine I'm using, and I can use the<br>(unofficial) Android app when I need my passwords on a machine where I<br>don't have the store replicated. Any reason something like that wouldn't<br>work for you?<br><br>[1]: <a href="https://github.com/syncthing/syncthing">https://github.com/syncthing/syncthing</a><br><br>/Emil<br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="http://lists.zx2c4.com/pipermail/password-store/attachments/20200209/8fc43513/attachment-0001.html">http://lists.zx2c4.com/pipermail/password-store/attachments/20200209/8fc43513/attachment-0001.html</a>><hr>Message: 2<br>Date: Sun, 9 Feb 2020 18:04:47 +0100<br>From: password-store@storiepvtride.it<br>To: password-store@lists.zx2c4.com<br>Subject: Re: Supplying GPG key password into Pass command<br>Message-ID: <ba64de2e-40ee-dc49-ba6a-55bfaccb5675@storiepvtride.it><br>Content-Type: text/plain; charset=utf-8<br><br>Am 09.02.20 um 12:24 schrieb Emil Lundberg:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">My solution to this problem is to use Syncthing [1] to replicate my<br>password store to all my machines, including my phone<br></blockquote><br>Does that require to store sensitive data (e.g. your GPG private key) on<br>your mobile device in order to decrypt passwords? If yes, I would argue<br>whether I would trust or not my mobile device for that task.<br><br>If I understood correctly, OP is trying to accomplish a homemade version<br>of 1Password. I don't have clear the details, but having private GPG key<br>and encrypted passwords on the same location or sending the passphrase<br>through the network wouldn't make me feel comfortable.<hr>Message: 3<br>Date: Sun, 09 Feb 2020 17:52:52 +0000<br>From: Louis ProtonMail <louiscb@protonmail.com><br>To: password-store@lists.zx2c4.com<br>Subject: Re: Supplying GPG key password into Pass command<br>Message-ID: <12F64E35-A9EC-40CC-B80C-FDF7D420EF15@protonmail.com><br>Content-Type: text/plain; charset="utf-8"<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> I don't have clear the details, but having private GPG key<br>and encrypted passwords on the same location or sending the passphrase<br>through the network wouldn't make me feel comfortable.<br></blockquote><br>I might not be understanding things well, but how is one supposed to access the plaintext saved passwords without having the keys used to encrypt them and the password to those keys? Where do you keep your GPG keys so that you can decrypt the pass entries?<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">If I understood correctly, OP is trying to accomplish a homemade version<br>of 1Password.<br></blockquote><br>Essentially this is correct, mainly as an educational exercise on understanding encryption and security principles better.<br><br>Louis<br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="http://lists.zx2c4.com/pipermail/password-store/attachments/20200209/dd79992d/attachment-0001.html">http://lists.zx2c4.com/pipermail/password-store/attachments/20200209/dd79992d/attachment-0001.html</a>><hr>Message: 4<br>Date: Sun, 9 Feb 2020 19:14:30 +0100<br>From: password-store@storiepvtride.it<br>To: password-store@lists.zx2c4.com<br>Subject: Re: Supplying GPG key password into Pass command<br>Message-ID: <312283f4-f598-1e7b-7b79-79a86512b6d6@storiepvtride.it><br>Content-Type: text/plain; charset=utf-8<br><br>Am 09.02.20 um 18:52 schrieb Louis ProtonMail:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">I might not be understanding things well, but how is one supposed to<br>access the plaintext saved passwords without having the keys used to<br>encrypt them and the password to those keys? Where do you keep your GPG<br>keys so that you can decrypt the pass entries?<br></blockquote><br>I think this is exactly the issue here: you can't, unless you give up<br>some security. If a malicious actor gets into the remote server, he has<br>access to both private key and GPG encrypted files. He would be only one<br>passphrase away from your passwords.<br><br>I keep my GPG private key into a smartcard. Without this smartcard<br>attached to my device, I can't decrypt my passwords.<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">Essentially this is correct, mainly as an educational exercise on<br>understanding encryption and security principles better.<br></blockquote><br>Ok, understood, thanks for confirming :-)<br>If I were to implement a remote service like that, I would download the<br>single encrypted password file I need and only *locally* decrypt it.<br>Which equals more or less to using pass offline or with syncthing.<br><br>I believe the intended use-case for pass is to store encrypted passwords<br>offline. Any other solution to use it "over the wire" would extend the<br>attack surface (imo).<hr>Message: 5<br>Date: Sun, 9 Feb 2020 22:17:07 +0100<br>From: Miquel Lionel <lionelmiquel@sfr.fr><br>To: password-store@lists.zx2c4.com<br>Subject: Windows implementation of passwordstore in pure batch<br>Message-ID: <20200209221707.86b12131481ef772af58a6d1@sfr.fr><br>Content-Type: text/plain; charset=US-ASCII<br><br>Hello to all the password-store mailing list,<br><br> Seeing no satisfying command line alternatives for Windows on the passwordstore.org page, I decided to quickly put together a batch script that mirrors my uses of pass on unix systems.<br>It behaves like pass on most of cases, my preferred thing being the clip switch.<br>So, it supports :<br> * making dirs in the password store<br> * tree like display of directory and content of theses<br> * inserting,deleting passwords and password directory, with or without prompts<br> * clipping a specific line of the password file<br> * PASSWORD_STORE_DIR and PASSWORD_STORE_KEY environnement variable, as they're the most important ones.<br> * .gpgid file to indicate which key to use in case of PASSWORD_STORE_KEY not set<br> * viewing passwords<br><br>And I think that's all for the moment.<br><br>There's still things to fix : can't have spaced password names, absolutely no security against shouldersurfing, and many other things that I didn't put my finger on yet.<br>But it does the job for me.<br><br><a href="https://notabug.org/lilim/pass.bat">https://notabug.org/lilim/pass.bat</a><br><br>Kind regards,</pre></blockquote></div><br>-- <br>Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté.</body></html>