Password management is a critical part of any personal infrastructure. I've had a few people ask me how I manage my passwords.

I use pass. This is a shell script that provides porcelain over a directory of plain text files encrypted with a gpg keypair.

The on disk format looks like this:

qlyoung@host ~> tree .password-store/
.password-store/
├── airlines
│   ├── volantis.gpg
│   ├── aerlingus.gpg
│   ├── aircanada.gpg
│   └── united.gpg
├── web
│   ├── twitch.tv.gpg
│   ├── github.gpg
│   ├── bandcamp.gpg
...

Copying a password to the clipboard looks like this:

qlyoung@host ~> pass -c web/github
<unlock gpg keypair>
Copied web/github to clipboard. Will clear in 45 seconds.

The “unlock gpg keypair” bit is some UX that asks for the key to unlock my GPG keypair. I use a yubikey so this is a prompt to insert my yubikey and enter its pin.

This directory is version controlled and synchronized to all my devices using git.

It is a very simple and secure setup.

This setup requires my personal GPG keypair to unlock the store. This means that the keypair has to be accessible to every device that needs access to passwords.

A GPG keypair is for practical purposes two files, one containing the public key and the other containing the private key. It's very important to the security of any system involving GPG that the private key file not be made public. For this reason it's usually encrypted with a symmetric password. If you use the conventional setup, this symmetric password effectively becomes the “master” password for the password store.

However, even though the keypair is itself encrypted, having it stored on disk isn't ideal from a security perspective - particularly on mobile devices, which are very exposed and historically very insecure. It's better if we don't store the key on disk at all. To accomplish this I store my keypair on a OpenPGP smart card (a yubikey). This small, unobtrusive device lives on my keychain along with my car keys.

On my desktop and laptop, whenever I need a password, I'm prompted to plug in and unlock my yubikey with a 6 digit pin. The encrypted file containing the password is then sent, over USB, to the embedded processor on the yubikey. The yubikey decrypts it using the GPG private key and sends back the cleartext contents. The flow is the same on my phone, except that communication occurs over NFC so I am prompted to tap my yubikey on the device.

Using a smartcard means the GPG keypair itself is never on disk and thus cannot be stolen. Even if the yubikey is stolen, the key cannot be extracted from it, and it is still locked with a pin so it cannot be used to perform any operations.

It would be inconvenient on desktop to open a terminal and type pass -c <password> every time I want a password. Fortunately there are various porcelain programs that wrap pass.

There are plugins that provide browser autofill which I used to use.

Currently I have a global system shortcut (^-alt-p) which launches rofi-pass. This is a floating launcher prompt, similar to Spotlight on a Mac. It allows me to type a few characters of the name of the password I want until it matches the correct one. Then I unlock the password store as previously described. Instead of copying the password to the clipboard, it then types it out using a virtual keyboard device. This is nice because it works everywhere - in the browser, in the terminal, and so on.

For git synchronization, pass automatically creates a new git commit whenever a password file is changed, and wraps git operations so that pass git push and pass git pull do the obvious things.

On my iPhone, I use this app, which handles the git operations and integrates with the iOS password management UX.