From jean.rblt at gmail.com Mon Sep 2 14:51:36 2024 From: jean.rblt at gmail.com (J Rt) Date: Mon, 02 Sep 2024 14:51:36 -0000 Subject: Adding authenticity guarantees to pass by signing (and checking signatures), not just encrypting (and decrypting), the passwords? Message-ID: Hi, Thank you again for an amazing tool. I have opened an issue on gopass ( https://github.com/gopasspw/gopass/issues/2932 ) to discuss the possibility of adding signature and signature checking to the mechanics of the passwords encryption / decryption. I believe this would mitigate quite a few of the (quite fair) criticisms made in e.g. https://ro t256.dev/post/pass/ . Basically, the idea would be that by using sign + encrypt instead of just encrypt, pass and the likes (gopass) could be safer against attacks where the synchronization tool used to back up and synchronize the store would be hijacked (e.g., github being compromised for many pass users). In theory this would probably be relatively little extra work since gpg supports --sign --encrypt already? I would believe that, once this is implemented, trusting the synchronization platform becomes much less critical? Do you think something like this could work / be added to pass? :) Best, JR From hugo at heagren.com Fri Sep 20 16:46:37 2024 From: hugo at heagren.com (hugo at heagren.com) Date: Fri, 20 Sep 2024 16:46:37 -0000 Subject: [PATCH] Completion on paths in emacs `password-store-rename' Message-ID: <159f37c3ccbcdff2b5a63ea3e7771797@heagren.com> Hi all, I've found it is convenient to complete on existing paths when renaming entries in the password store. This (attached) patch makes that possible. Best, Hugo -------------- next part -------------- A non-text attachment was scrubbed... Name: 0001-Complete-on-existing-paths-in-password-store-rename.patch Type: text/x-diff Size: 988 bytes Desc: not available URL: