i’ve used `pass` for 4-ish years now. i stopped last month. the interactions between pass and gpg-agent are too opaque for someone who’s not a regular PGP user. what happens when i let my PGP key expire? what’s the right way to share passwords between multiple machines — can i just clone the ~/.gnupg folder, do i need to `export` and then `import` the keys? should i create subkeys for each machine?
i want my password manager to be decently transparent, because if i misunderstand its failure modes that’s a big deal.
anyway, i’m using SOPS now [1]. it comes with a different set of tradeoffs (doesn’t integrate with keyrings quite as well as GPG does), but it’s way more transparent and pluggable. i generate distinct pubkey/privkey pairs per logical user and i can grant any subset of keys access to specific secrets. so e.g. my desktop and laptop can decrypt my banking secrets, but my phone cannot. i have a nightly backup cronjob which has to run unattended: i encode my Backblaze API key to the `duplicity` user’s privkey, and can safely check the encoded key into public repos and such. it’s simple and easy to grok. more so than pass, IMHO.
i want my password manager to be decently transparent, because if i misunderstand its failure modes that’s a big deal.
anyway, i’m using SOPS now [1]. it comes with a different set of tradeoffs (doesn’t integrate with keyrings quite as well as GPG does), but it’s way more transparent and pluggable. i generate distinct pubkey/privkey pairs per logical user and i can grant any subset of keys access to specific secrets. so e.g. my desktop and laptop can decrypt my banking secrets, but my phone cannot. i have a nightly backup cronjob which has to run unattended: i encode my Backblaze API key to the `duplicity` user’s privkey, and can safely check the encoded key into public repos and such. it’s simple and easy to grok. more so than pass, IMHO.
1: https://github.com/mozilla/sops