3

I just started using pass of by Jason A. Donenfeld as a password manager.

I entered a password (e.g. email/[email protected]). To retrieve it I type

pass email/[email protected]

I'm being asked the master password. But then if I type again pass email/[email protected], the master password is not being asked and the password for email/[email protected] is output in the terminal.

For security reasons, I want to be asked the master password each time I retrieve a password. How can I do it?

Improve this question

1 Answer 1

Reset to default
7

pass uses GnuPG to handle encryption. Recent releases of GnuPG uses a GPG daemon. This GPG daemon caches your valid authentication for 600 seconds (default-cache-ttl), which may be refreshed to another 600 seconds if you use GnuPG again within that time, up to a maximum of two hours (max-cache-ttl).

You have two options:

  1. Kill the GPG agent process after each use of pass. You do this with

    gpgconf --kill gpg-agent

  2. Configure the "cache max time to live" for the GPG agent (the maximum time a valid authentication is remembered, by default two hours).

    This number may be changed by changing the GPG daemon's configuration file.

    You do this by adding the following line to your ~/.gnupg/gpg-agent.conf file (you may have to create this file):

    max-cache-ttl 0

    If a GPG agent is currently running, then make sure to terminate it with the gpgconf command as shown above to ensure that the agent reads the updated configuration file when it is started.

See also the gpg-agent manual, specifically the documentation for the --max-cache-ttl option (which corresponds to the max-cache-ttl configuration setting). The manual also mentions the gpgpconf --kill gpg-agent command.

Improve this answer
2
  • @many thanks for your answer @Kusalananda. I prefer to use the second option as the first require an active command after each use, which seems te me as a not optimized (as I might forget to do it). Regarding the second option: I'm on MacOS 11.2.3, I created ~/.gnupg/gpg-agent.conf in which I added the line max-cache-ttl 0. I also did source ~/.gnupg/gpg-agent.conf but got .gnupg/gpg-agent.conf:1: command not found: max-cache-ttl zsh: command not found: i. Do you have an idea what I should do to use the second option?
    – ecjb
    Jun 5, 2021 at 9:44
  • 1
    @ecjb You don't source this file. The GPG agent will read it when it starts. If you have a GPG agent currently running, then kill it with the gpgconf --kill gpg-agent first.
    – Kusalananda ♦
    Jun 5, 2021 at 9:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .