Hacker News Reader

Comment by bloaf | Hacker News Reader

It feels nice and clean, but also like it is leaking the list of sites I use.

I think this is outside of the threat model of most password managers -- your desktop search history (whether in your shell, Spotlight, or whatever) is leaking equivalent and probably more detailed information.

It can be a problem if you want to back up the password database to the cloud.

That's part of the threat model for most other password managers, which use a single encrypted file for the database. Pass is the only popular one I know that stores part of the information in plaintext.

I don't actually use pass, but as an idle thought: if you're concerned about this sort of metadata when syncing your `pass` store to a cloud provider, why not take advantage of the GPG key you already have and encrypt everything as a single blob in one shot? You pay a little more with each synchronization, but probably not enough to worry about for reasonably sized stores.

There are pass extensions that encrypt the metadata but I don't know why they are not the default.

That is what something like Gocryptfs would be good at masking:

https://wiki.archlinux.org/index.php/Gocryptfs

Or there is an extension called pass-tomb:

https://github.com/roddhjav/pass-tomb

Leaking to where?

In the default settings the names of the websites are stored unencrypted, in the filenames.

To anyone who types pass in your terminal it looks like.

compared to other password managers which is just an encrypted database.

pass uses normal folders to store your website/username information so in that way it is less protected.

Something to consider, sure.

But the exposure is to anyone with access to your encrypted pass data. Which in the normal use case is going to be anyone with access to your user account, which means they could likely already see your shell and browser history.

Not if you want to access it on multiple devices, in which case the built-in solution is to use git. In that case your git server sees all the metadata.

To anything with read access to your chosen storage filesystem.

Reply on news.ycombinator.com