Re: PGP, gpg-agent, and KDF criticisms?

I reply to myself to add a few more explanations. On Tue, 27 Oct 2020 at 11:06PM +0200, Matthieu Weber wrote: > On Tue, 27 Oct 2020 at 02:48PM -0400, TRS-80 wrote: > > Pretty quickly thereafter, both of main devs reply[2] with some > > criticisms of PGP, gpg-agent, and some oth

Re: PGP, gpg-agent, and KDF criticisms?

rule, you should know what you are doing and the consequences of your choices (which admittedly is not easy on modern computer systems), and before starting to use pass, you must be aware that it is not a consumer product (it's a command-line tool, for starters :) ), so some understanding of how

Re: curious: why use own hosting rather than github?

ontributors) who is not very reactive. If patches were reviewed and merged or rejected quickly, we would not be having this discussion. Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://weber.fi.eu.org/

Re: curious: why use own hosting rather than github?

the second case, the maintainer could equally ignore pull requests made through github/gitlab/whatever. Also please, don't reply above the text you are referring to. Matthieu -- (~._.~) Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://

Re: curious: why use own hosting rather than github?

that. After all these years, I still don't have a github account. -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://weber.fi.eu.org/( ? ) ()- -() public key id : 0x85CB340EFCD5E0B3 ()- -() (_)-(_)

Re: [PATCH] Add support for XKCD-style wordlist passwords

On Tue, 30 Oct 2018 at 08:01PM +0100, Kjetil Torgrim Homme wrote: > Den 30. okt. 2018 12:10, skreiv Matthieu Weber: > > On Tue, 30 Oct 2018 at 10:33AM +0100, Kjetil Torgrim Homme wrote: > >> yes, but sometimes you need to enter this password by hand. I use horse > >&g

Re: [PATCH] Add support for XKCD-style wordlist passwords

or 5.74e+22. still not > a huge amount, but the attacker would have to know that this is the > method I use to make pass phrases to successfully reduce his search space. You can get 75 bits of entropy with 16 lowercase letters or 14 mixed-case letters. That is surely easier to type t

Re: [PATCH] Add support for XKCD-style wordlist passwords

er considerably, then the password's entropy can be quite low, and the lower entropy of a diceware password is not a problem. Of course, high entropy does not hurt if it comes at no extra cost and you don't have to input the password manually. Matthieu -- (~._.~) Matthieu Weber -

Re: Security Vulnerability: Faulty GPG Signature Checking

correct programs in C, and very easy to write C programs with security holes in it. Since the topic here is security, I would advise against C. Go, Rust, Java even, or scripting languages such as Python, Ruby or even Perl are probaly safer than C (or C++). Matthieu -- (~._.~)

Re: Generated password has repetition

ecially with this long a password as the one above. Matthieu -- (~._.~)Matthieu Weber - matth...@weber.fi.eu.org(~._.~) ( ? ) https://weber.fi.eu.org/ ( ? ) ()- -() public key id : 0x85CB340EFCD5E0B3()- -() (_)-(_) "Humor i

Re: [pass] Possible improvements

On Tue 26.01.2016 at 05:18:05PM +0100, Lucas Hoffmann wrote: > Quoting Matthieu Weber (2016-01-26 16:59:40) > > So symmetric encryption is actally used, and the problem of managing the > > symmetric keys is already solved. What is there not to like about the > > way pass wor

Re: [pass] Idiomatic way to view previous password version ?

command. Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://weber.fi.eu.org/( ? ) ()- -() public key id : 0x85CB340EFCD5E0B3 ()- -() (_)-(_) Humor ist, wenn man trotzdem lacht (Otto J. Bierbaum

Re: [pass] Idiomatic way to view previous password version ?

+my_new_password indicates that the files used to contain my_old_password, but the current commit changed it to my_new_password Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://weber.fi.eu.org

Re: [pass] New approach

is high enough this should be impractical) If the master password is long enough, it is safe. Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://weber.fi.eu.org/( ? ) ()- -() public key id

Re: [pass] [PATCH] generate: add --in-place option

On Tue 06.05.2014 at 05:24:54PM +0200, Jason A. Donenfeld wrote: Do the people of the Password Store Mailing List's Republic of Passwords support this commit? Facundo -- is this what you wanted? Aye. Looks good to me. Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr

Re: [pass] copying usernames and urls

questions and corresponding answers Is everybody using something similar or is someone using a radically different format, that may justify implementing different frontend tools? Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http

Re: [pass] copying usernames and urls

amount of semantics (i.e., define a data format) in the files as soon as you have more than one piece of data in it (i.e., more than just the password). Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://weber.fi.eu.org

Re: [pass] Pass on Maemo

in maemo is the mkdir -v option. Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://weber.fi.eu.org/( ? ) ()- -() public key id : 0x85CB340EFCD5E0B3 ()- -() (_)-(_) Humor ist, wenn man trotzdem

[pass] pass mv

Next for 1.6 release: [...] - pass mv Here you are. I originally posted this in August last year, but it went apparently unnoticed. This new patch is against the latest origin/master. ___ Password-Store mailing list

Re: [pass] [PATCH] GPG improvements

=$GPG_OPTS --batch fi I settled for: GPG=gpg if [[ -n $(which gpg2) ]]; then GPG=gpg2 GPG_OPTS=$GPG_OPTS --batch elif [[ -n $GPG_AGENT_INFO ]]; then GPG_OPTS=$GPG_OPTS --batch fi The patch will follow soon. Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr

Re: [pass] I had to change GPG=gpg to GPG=gpg2

-agent is present. This allows me to use pass on my N900, which has no agent support (and no gpg2). Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://weber.fi.eu.org/( ? ) ()- -() public key id

Re: [pass] I had to change GPG=gpg to GPG=gpg2

On Thu 20.03.2014 at 02:31:10AM -0600, Jason A. Donenfeld wrote: On Thu, Mar 20, 2014 at 2:12 AM, Matthieu Weber mwe...@free.fr wrote: It's the --batch option, but it's needed only if you have a gpg-agent running. I sent a patch on August 12th, 2013 Care to modernize and resubmit? I guess

Re: [pass] I had to change GPG=gpg to GPG=gpg2

This patch replaces calls to gpg2 with a $GPG variable that contains either gpg or gpg2, depending on what command is available. If a gpg-agent is detected, the --batch command is used. Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr

[pass] [PATCH] GPG improvements

Use gpg2 if available, or fallback to gpg Use --batch option only if gpg-agent is available (i.e, if GPG_AGENT_INFO is set) --- src/password-store.sh | 24 ++-- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/src/password-store.sh b/src/password-store.sh

[pass] chdir to $GIT_WORK_DIR when invoking pass git

This seems to be necessary when I call pass git pull. It may be necessary only for older versions of git? Matthieu -- (~._.~)Matthieu Weber - mwe...@free.fr (~._.~) ( ? )http://weber.fi.eu.org/( ? ) ()- -() public key id

[pass] [PATCH] Fixed 'missing working tree' for 'pass git pull'

--- src/password-store.sh |1 + 1 file changed, 1 insertion(+) diff --git a/src/password-store.sh b/src/password-store.sh index e9ba4f0..a5d062f 100755 --- a/src/password-store.sh +++ b/src/password-store.sh @@ -419,6 +419,7 @@ case $command in git $@ || exit 1

[pass] Using X primary selection and fix for git pull

Hello, I started using password-store a few weeks ago, and I ran into a few minor problems. You'll find next small patches fixing two of these. The first is that I am used to pasting by middle-clicking the mouse. Since the password is placed in the clipboard X selection, this is not possible