[{"data":1,"prerenderedAt":311},["ShallowReactive",2],{"project-14517671":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":45,"post_text":46,"what":47,"said":62,"maker_in_thread":157,"shape":168,"grid":172,"attempts":271,"same_week":277,"maker_shows":31,"maker_hidden":303,"reader_version":304,"card":305},"14517671","kbsecret","A password manager using Keybase for encryption and storage","title","Show HN: A password manager using Keybase for encryption and storage","https:\u002F\u002Fgithub.com\u002Fwoodruffw\u002Fkbsecret","github.com","woodruffw",1496961154,2017,172,40,208,2242,10,"notable","security_privacy","password manager","cli",[21,24,25,26,27],"keybase","kbfs","encrypted secrets","pass alternative","mixed",-0.172,{"positive":31,"neutral":32,"mixed":33,"critical":34},3,7,2,5,17,{"execution":37,"design":39,"privacy":41,"idea":42,"docs":43,"performance":44},{"positive":38,"critical":38},1,{"positive":38,"critical":40},0,{"positive":40,"critical":31},{"positive":38,"critical":38},{"positive":40,"critical":40},{"positive":40,"critical":40},[38,40,34,40,31,38,40,38,40,31,40,38,40,31,40,40,40,40,31,40,34,40,31,40,31,40,40,40,40,31,31,40,31,38,40,40,40,34,40,40],null,{"problem":46,"audience":46,"pricing":46,"motivation":48,"time_to_build":46,"stack":58,"openness":59,"stage":60,"team_size":61},{"value":49,"source":50,"evidence":51},"Wanted structured records and easy sharing via KBFS, unlike pass","maker",[52,55],{"id":53,"by":11,"text":54},"14517867","Well, I wanted something with structured records. `pass` can sort of do that, but it's not built into it. I also wanted to take advantage of KBFS to do the encryption…",{"id":56,"by":11,"text":57},"14521552","Well, this has a few advantages beyond just a folder hierarchy: * KBSecret's records are structured, meaning that they have \"type\" information and can be filtered by use (logins,…",[],"unknown","prototype","solo",{"praise":63,"objections":76,"requests":105,"questions":124,"alternatives":139},[64],{"value":65,"source":66,"evidence":67},"KBFS-based design is a clever way to encrypt and share records","commenter",[68,72],{"id":69,"by":70,"text":71},"14517892","45h34jh53k4j","Great idea! i will follow the evolution of this product",{"id":73,"by":74,"text":75},"14519134","songgao","Thanks for making `kbsecret` and having it based on KBFS! > Records are shared under the \u002Fkeybase\u002Fprivate\u002Fuser1,user2,user3\u002Fkbsecret hierarchy, so adding or removing a user would…",[77,87,98],{"value":78,"source":50,"evidence":79},"Still experimental; warned to use with caution",[80,84],{"id":81,"by":82,"text":83},"14518363","Shank","Everything about Keybase FS is experimental, I guess. This password manager says: > Note: This is still a work in process. Use it with caution. Meanwhile, Keybase FS says: > At…",{"id":85,"by":11,"text":86},"14518391","I put that in there because I'm just one person, working on this in my spare time. I don't think there are any immediate vulnerabilities in KBSecret itself - that's more of a…",{"value":88,"source":66,"evidence":89},"Passwords on command line end up in shell history and are readable via \u002Fproc argv",[90,94],{"id":91,"by":92,"text":93},"14518910","chias","Unless I'm missing something, this looks like it ends up sprinkling all of your passwords into your .bash_history file. Maybe saving a credential should be a prompted action: ```…",{"id":95,"by":96,"text":97},"14519856","minitech","That’s unsafe even for scripts; unprivileged processes can, by default, read the argv of any other process. (Try `sudo -u nobody cat \u002Fproc\u002F$(pgrep -n kbsecret)\u002Fcmdline`.)",{"value":99,"source":66,"evidence":100},"Plaintext exposure through mounted KBFS and editor copies",[101],{"id":102,"by":103,"text":104},"14520274","zimbatm","A couple of thoughts on security: How I understand this, when the \u002Fkeybase VFS is mounted, all the files are accessible in clear from the user's point of view. It means that file…",[106,116],{"value":107,"source":66,"evidence":108},"Support for adding and removing team members",[109,113],{"id":110,"by":111,"text":112},"14517862","eridius","Interesting, but how does this handle adding\u002Fremoving members from a team? And I assume every single member of the team has to independently set up the session?",{"id":114,"by":11,"text":115},"14517878","> Interesting, but how does this handle adding\u002Fremoving members from a team? Not at the moment, but this wouldn't be too difficult. Records are shared under the…",{"value":117,"source":66,"evidence":118},"Interactive password input by default",[119,120],{"id":91,"by":92,"text":93},{"id":121,"by":122,"text":123},"14519106","Daviey","You could use $stdout.isatty as an indicator if it is a shell or interactive and make the default for each?",[125,129],{"value":126,"source":66,"evidence":127},"How does it handle team membership changes?",[128],{"id":110,"by":111,"text":112},{"value":130,"source":66,"evidence":131},"Has KBFS been formally audited?",[132,136],{"id":133,"by":134,"text":135},"14518023","rrggrr","Makes sense. Do we know if KBFS is deemed cryptographically secure? I haven't kept up on it.",{"id":137,"by":11,"text":138},"14518068","I don't know if there's been a formal audit, but they've published an overview of their cryptographic methods and practices [1]. They've also open-sourced KBFS itself and the…",[140,150],{"value":141,"source":66,"evidence":142},"pass (passwordstore.org)",[143,146],{"id":144,"by":134,"text":145},"14517833","Why not simply use PASS with your Keybase gpg key?",{"id":147,"by":148,"text":149},"14521420","smoyer","This is effectively what I'm already doing - I use pass for Linux and save my folder hierarchy to KBFS. It has the added advantage of already have browser plugins and a desktop…",{"value":151,"source":66,"evidence":152},"gopass",[153],{"id":154,"by":155,"text":156},"14525825","swalladge","The original pass program allows overriding the default directory with the PASSWORD_STORE_DIR environment variable. I use gopass [0] though which supports directly configuring…",{"comments":158,"answered":159,"key":160},12,4,[161,162,165],{"id":85,"text":86},{"id":163,"text":164},"14518478","Have you just been dumping them in a directory, or have you come up with a system for organizing and accessing them? Most of my work on KBSecret so far has been aimed at my own…",{"id":166,"text":167},"14518937","You're not missing something; I documented that under \"Security Considerations\" for `kbsecret login` [1]. `kbsecret login` provides the `-i` and `--interactive` flags for exactly…",{"commenters":169,"max_depth":34,"maker_replies":158,"first_comment_mins":170,"lifespan_hours":171},22,26,41,[173,175,177,181,183,187,189,193,194,195,196,198,199,202,205,208,212,215,217,219,220,222,225,227,229,230,231,235,239,241,243,246,248,252,255,256,259,262,264,266],[81,40,38,174,82,40],"project\u002Fcritical\u002Fexecution",[85,40,40,176,11,38],"maker\u002Fneutral\u002Fexecution",[178,40,34,179,180,40],"14518461","project\u002Fpositive\u002Fexecution","indytechcook",[163,40,40,182,11,38],"maker\u002Fneutral\u002Fdesign",[184,40,31,185,186,40],"14519702","project\u002Fmixed\u002Fdesign","shakna",[102,38,38,188,103,40],"project\u002Fcritical\u002Fprivacy",[190,38,40,191,192,40],"14521059","other\u002Fneutral\u002Fprivacy","Bluestrike2",[91,33,38,188,92,40],[166,33,40,182,11,38],[121,33,31,182,122,40],[197,33,40,182,11,38],"14519146",[95,33,38,188,96,40],[200,33,40,201,11,38],"14522052","maker\u002Fneutral\u002Fprivacy",[203,33,31,204,96,40],"14522479","project\u002Fneutral\u002Fprivacy",[206,33,40,191,207,40],"14519986","aequitas",[209,33,40,210,211,40],"14520102","other\u002Fneutral\u002Fnone","kchr",[213,33,40,210,214,40],"14520194","kseistrup",[216,33,40,210,211,40],"14527624",[110,31,31,218,111,40],"project\u002Fneutral\u002Fdesign",[114,31,40,182,11,38],[73,31,34,221,74,40],"project\u002Fpositive\u002Fdesign",[223,31,40,224,11,38],"14519152","maker\u002Fpositive\u002Fnone",[144,159,31,226,134,40],"project\u002Fneutral\u002Fidea",[53,159,40,228,11,38],"maker\u002Fneutral\u002Fidea",[133,159,31,204,134,40],[137,159,40,204,11,38],[232,159,40,233,234,40],"14518281","other\u002Fpositive\u002Fnone","shusson",[236,159,40,237,238,40],"14519259","commenter\u002Fneutral\u002Fnone","omdv",[240,159,40,210,234,40],"14519679",[242,159,31,226,155,40],"14520307",[244,159,31,245,134,40],"14520760","project\u002Fneutral\u002Fdocs",[154,159,40,247,155,40],"other\u002Fneutral\u002Fdocs",[249,34,31,250,251,40],"14520020","project\u002Fmixed\u002Fperformance","Diti",[147,253,38,254,148,40],6,"project\u002Fcritical\u002Fidea",[56,253,40,228,11,38],[257,253,40,258,148,40],"14521612","commenter\u002Fneutral\u002Fidea",[260,253,40,261,11,38],"14521653","maker\u002Fneutral\u002Fnone",[69,32,34,263,70,40],"project\u002Fpositive\u002Fidea",[265,32,40,224,11,38],"14517901",[267,268,40,269,270,40],"14521169",8,"other\u002Fneutral\u002Fidea","daddykotex",[272,276],{"id":273,"t":274,"points":275,"comments":40},"13557421",1486092356,14,{"id":4,"t":12,"points":14,"comments":15},[278,283,287,292,296,300],{"id":279,"name":280,"points":281,"category":282},"14552615","DemandRush",1100,"web_saas",{"id":284,"name":285,"points":286,"category":20},"14553401","StatiCrypt",348,{"id":288,"name":289,"points":290,"category":291},"14553551","Vexlio",309,"dev_tools",{"id":293,"name":294,"points":295,"category":291},"14552140","SimulDocs",220,{"id":297,"name":298,"points":299,"category":291},"14515494","Retool",190,{"id":301,"name":302,"points":299,"category":282},"14538351","Keygen",false,"v2",{"id":306,"name":5,"line":6,"ai":303,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":307,"top":18,"kw":308,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":309,"url":9,"mix":310,"praise":65,"objection":78,"sub":21},14517671,-0.17,[21,24,25,26,27],"1050310103010300003050303000033031000500",[31,32,33,34],1794036556141]