Ditch pass dependency in binary

[dannyvankooten]

Since the files are simply GPG encrypted, we could use GPG directly for decrypting the password files.

This way, other software that use a similar approach to storing passwords can be used too. Some people use GPG directly, for example.

[emersion]

This will make installation easier and we'll be able to support more platforms too (like Windows without cygwin/mingw/whatever).

One question is: how to get the PGP key's password? Ask it in the extension? How to save the password in memory?

(Note: this could solve #20)

[phryneas]

Start a gpg-agent and keep the correct environment variables. That will also do pop-ups and ask for the password.
No application except gpg itself should ever ask for, or even cache, a gpg key passphrase. This will open all kind of serious attack vectors.

PS: doing a gpg-connect-agent '' /bye should be sufficient and in most cases, environment variables would not need to be modified.

[emersion]

If we ditch the pass dependency, we'll likely also ditch the gpg dependency as soon as there is a good pgp implementation in Go.

There are some pinentry libraries in Go if that helps.

[phryneas]

That would make the use of hardware tokens like the OpenPGP Smartcard, the Yubikey or the Nitrokey impossible.
Those devices have a growing userbase - I myself would be quite sad to see a promising project that I could not use in the end :/

[wiktor-k]

+1 for GPG agent approach. The agent works flawlessly in complex scenarios (Enigmail or SSH via OpenPGP with smart cards) on Windows too.

[emersion]

Note: ditching the GPG dependency would solve issues with env vars such as #28 and #23.

Maybe we could just have an option to use gpg-agent.

[wgroenewold]

To separate this issue, we could separate the GPG bridge and the frontend, thereby making it more suitable for others to build on. If we clearly define the format of the JSON for the extension and the way it has to connect.

[emersion]

We already have an interface for password stores, so adding a store without using the GPG binary should be pretty straightforward.

EDIT: my bad, decrypting with GPG happens somewhere else. We could define something like type ReadLoginFunc func(r io.Reader) (*Login, error).

[maximbaz]

As I read from the code, pass binary is not used anywhere anymore, everything is being decrypted via gpg binary. I'll close the issue since it seems to be implemented, let me know if this is not so and there is more to be done here.