kbsecret
Security and privacy
password manager
SHOW HN2017
How HN took it
3 positive, 7 neutral or asking, 2 mixed, 5 critical, out of 17 comments about the project. Thread score -0.17.
Privacy: 0 for, 3 againstExecution: 1 for, 1 againstIdea: 1 for, 1 againstDesign: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
KBFS-based design is a clever way to encrypt and share records
From 2 comments
Great idea! i will follow the evolution of this product
45h34jh53k4j on HNThanks for making `kbsecret` and having it based on KBFS! > Records are shared under the /keybase/private/user1,user2,user3/kbsecret hierarchy, so adding or removing a user would…
songgao on HN
Objections
Still experimental; warned to use with caution
From 2 comments
Everything about Keybase FS is experimental, I guess. This password manager says: > Note: This is still a work in process. Use it with caution. Meanwhile, Keybase FS says: > At…
Shank on HNI put that in there because I'm just one person, working on this in my spare time. I don't think there are any immediate vulnerabilities in KBSecret itself - that's more of a…
woodruffw on HN
Passwords on command line end up in shell history and are readable via /proc argv
From 2 comments
Unless I'm missing something, this looks like it ends up sprinkling all of your passwords into your .bash_history file. Maybe saving a credential should be a prompted action: ```…
chias on HNThat’s unsafe even for scripts; unprivileged processes can, by default, read the argv of any other process. (Try `sudo -u nobody cat /proc/$(pgrep -n kbsecret)/cmdline`.)
minitech on HN
Plaintext exposure through mounted KBFS and editor copies
From 1 comment
A couple of thoughts on security: How I understand this, when the /keybase VFS is mounted, all the files are accessible in clear from the user's point of view. It means that file…
zimbatm on HN
Requests
Support for adding and removing team members
From 2 comments
Interesting, but how does this handle adding/removing members from a team? And I assume every single member of the team has to independently set up the session?
eridius on HN> Interesting, but how does this handle adding/removing members from a team? Not at the moment, but this wouldn't be too difficult. Records are shared under the…
woodruffw on HN
Interactive password input by default
From 2 comments
Unless I'm missing something, this looks like it ends up sprinkling all of your passwords into your .bash_history file. Maybe saving a credential should be a prompted action: ```…
chias on HNYou could use $stdout.isatty as an indicator if it is a shell or interactive and make the default for each?
Daviey on HN
Questions
How does it handle team membership changes?
From 1 comment
Interesting, but how does this handle adding/removing members from a team? And I assume every single member of the team has to independently set up the session?
eridius on HN
Has KBFS been formally audited?
From 2 comments
Makes sense. Do we know if KBFS is deemed cryptographically secure? I haven't kept up on it.
rrggrr on HNI don't know if there's been a formal audit, but they've published an overview of their cryptographic methods and practices [1]. They've also open-sourced KBFS itself and the…
woodruffw on HN
Alternatives named
pass (passwordstore.org)
From 2 comments
Why not simply use PASS with your Keybase gpg key?
rrggrr on HNThis is effectively what I'm already doing - I use pass for Linux and save my folder hierarchy to KBFS. It has the added advantage of already have browser plugins and a desktop…
smoyer on HN
gopass
From 1 comment
The original pass program allows overriding the default directory with the PASSWORD_STORE_DIR environment variable. I use gopass [0] though which supports directly configuring…
swalladge on HN