Over the weekend there was a post on Hacker News about Pass, the standard unix password manager now being on Homebrew. I hadn’t heard of pass before, so I did a bit of reading about it. From the announcement post:
Password management should be simple and follow Unix philosophy. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities.
Basically it is an open source, command line version of 1Password. When I saw it I was pretty excited, as I was thinking of doing something exactly like this the other week. So I tried it out. I checked the source on GitHub and there was a single bash script of a couple of hundred lines, so I was a bit suprised when I installed it:
Not exactly lightweight… But ok I thought and continued.
To set it up you need to run pass init and pass the ID of a GPG key. I didn’t have GPG setup (brew had only just installed it), but I assumed it would do all the magic for me.
</span><span class=‘line’>gpg: directory /Users/luca/.gnupg' created
</span><span class='line'>gpg: new configuration file/Users/luca/.gnupg/gpg.conf’ created
</span><span class=‘line’>gpg: WARNING: options in /Users/luca/.gnupg/gpg.conf' are not yet active during this run
</span><span class='line'>gpg: keyring/Users/luca/.gnupg/secring.gpg’ created
</span><span class=‘line’>gpg: keyring `/Users/luca/.gnupg/pubring.gpg’ created
</span><span class=‘line’>gpg: Luca Password Key: skipped: No public key
</span><span class=‘line’>gpg: [stdin]: encryption failed: No public key
</span><span class=‘line’>Copied Facebook to clipboard. Will clear in 45 seconds.</span>
Hmm ok, maybe not. Not a very friendly error. I had a rough idea of what GPG does but I had never used it before. So how does gpg work?
</span><span class=‘line’>gpg: Go ahead and type your message …</span>
Hmm. I’m guessing that’s not right. To Google!
I found a blog post, OpenPGP for complete beginners which explained it. It is rather indepth, but if you are interested it is worth a read. Here is what you need to set it up for pass.
As stated by the article, the defaults are fine, so just press enter. It then asks you for the key length.
12
<td class='code'>
<pre><code class=''><span class='line'>RSA keys may be between 1024 and 4096 bits long.
</span><span class=‘line’>What keysize do you want? (2048)</span>
Rather than the default I opted for 4096. There is a warning in the article that it takes longer to generate and encrypt, but as I am only going to be encrypting passwords the trade off is worth it. It then asks how long the key should be valid for:
1234567
<td class='code'>
<pre><code class=''><span class='line'>Please specify how long the key should be valid.
</span><span class=‘line’> 0 = key does not expire
</span><span class=‘line’> <n> = key expires in n days
</span><span class=‘line’> <n>w = key expires in n weeks
</span><span class=‘line’> <n>m = key expires in n months
</span><span class=‘line’> <n>y = key expires in n years
</span><span class=‘line’>Key is valid for? (0)</span>
For just encrypting passwords locally the default is fine, so just hit enter again. It’ll warn you that it will never expire, so type y to confirm and hit enter.
It’ll then ask you for your name and email. This isn’t really needed for local encryption, but heh, do what it says. At the end you’ll see a prompt to continue:
Type o and hit enter to confirm. You’ll then get a prompt for a pass phrase. This will be your master password for all other passwords, so ensure it is strong.
After this it needs a lot of entropy to generate a secure key. Go back to whatever you were doing before this, and check back in a few minutes. When it is done you’ll see something like this:
1234567
<td class='code'>
<pre><code class=''><span class='line'>gpg: checking the trustdb
</span><span class=‘line’>Copied Facebook to clipboard. Will clear in 45 seconds.</span>
Paste it somewhere, then to double check it is working, ask for the password back. It’ll prompt you for the master passphrase you gave to gpg2 when generating your key.
</span><span class=‘line’>
</span><span class=‘line’>You need a passphrase to unlock the secret key for
</span><span class=‘line’>user: “Real Name (http://example.com/) <name@example.com>“
</span><span class=‘line’>4096-bit RSA key, ID 55667788, created 2009-07-17 (main key ID 11223344)
</span><span class=‘line’>
</span><span class=‘line’>Cahri;x2li-f3Zeo</span>