Hello James, this seems like a good idea to me. With unsigned passwords anyone with access to a) public key used to encrypt the store and b) password store files can modify encrypted passwords by simply re-encrypting new value, and user has no way of telling whether passwords were tampered with other than try to use them. Being password manager, failure to protect integrity of the data should be considered a weakness.
However, it is quite difficult to come up with a possible attack scenario (maybe DoS against one-time-only passwords, when user has to try the password, but since he has just one try to enter the correct one, failure to see if it was tampered with would lead to being locked out. Just fantasizing.), so this weakness might not be exploitable at all, i.e. lead to any vulnerability. Will this alway be true ? Don`t know. On the other hand, signing the entries would degrade user experience, when user would be asked for password when modifying the store. But is the added security worth the inconvenience ? For me, it would make sense to make it optional to sign the entries with a GPG key (note: not necessarily the same one as used to encrypt them. Think of a shared password store, where multiple people can read but only a subset of them is trusted to modify. This would be a new feature though). Just my 2 cents. On 21.07.2014 08:49, James Wald wrote: > It appears that additions to pass are not signed by default? I understand > that anyone can encrypt data using my public key, so the passphrase wouldn't > be required for unsigned files. -- Jan Rusnacko, Red Hat Product Security _______________________________________________ Password-Store mailing list [email protected] http://lists.zx2c4.com/mailman/listinfo/password-store
