5

I red about the password management program pass in a question on this forum and decided to try it.

I installed from the download page (tarball 1.6.3). I created some test entries and then some real entries and committed them to git and pushed them to github. When I looked at my github repository I did see some non .gpg file with the plain text versions of the passwords pushed to github. Those file also exists local. I have removed my real passwords from ~/.password-store:

$ pass
Password Store
├── test
│   ├── test
│   └── test
├── test1
│   └── test2
└── test3
    └── test4

The double test is strange already:

$ ls ~/.password-store/test
test  test.gpg
$ more !$/test
more ~/.password-store/test/test
uJ94!qmv}E\41GjLxJx`
$ gpg -dq <  ~/.password-store/test/test.gpg 
uJ94!qmv}E\41GjLxJx`

Is this normal? What can I do against the plain text versions of the passwords being stored?

  • 1
    Look through your shell history for the command(s) that created files without the .gpg extension: this sounds like a severe bug report... – jasonwryan Dec 3 '14 at 16:20
2

I have seen that application do that as well. I think it is a result of the bash script (that is the pass program) not catching some errors. For me it was reason not to start using the program for real.

If you can live with the plain text files being stored locally, you can prevent them from being stored in git (and pushed out to github) by setting up a .gitignore file in your ~/.password-store:

*
!*/
!.gitignore
!.gpg-id
!*.gpg

(this first ignores everything to be stored, then allows subdirs and allows the configuration files as well as all files ending in .gpg).

If you haven't done so yet, you should immediately change all passwords that you pushed out to github. Also remove ~/password-store/.git and everything underneath and reinitialize git (pass git init) for the password store, as the old, committed, plaintext files will still be in there.

  • Perhaps using git crypt would suffice? twinbit.it/en/blog/…, or even roll your own: gist.github.com/shadowhand/873637 – slm Dec 3 '14 at 13:46
  • @slm although that is interesting the local files should not be plain/unencrypted in the first place. Although git-crypt would help against not uploading unencrypted material, it would not do anything for the non-encrypted local files. – Anthon Dec 3 '14 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.