Security on Bitsy Services Wiki

Secret Management with pass

Mon, 01 Jan 0001 00:00:00 +0000

pass (passwordstore.org) is a thin shell wrapper over GPG and git. It is built for exactly the problem of secrets scattered across .env files, exported private keys, and API tokens pasted into notes: it pulls them into one encrypted, versioned, greppable tree on disk.

This guide covers one-time setup (including the WSL Ubuntu wrinkles), the daily workflow, migrating your existing secrets in, scripting against the store, and the YubiKey hardening path. It assumes you are comfortable on the command line.

GPG (GnuPG)

Mon, 01 Jan 0001 00:00:00 +0000

GnuPG (GPG) is the free, complete implementation of the OpenPGP standard. It provides public-key encryption and digital signatures from the command line, and it is the encryption engine underneath pass: every secret in a password store is an individual file encrypted to your GPG public key, decryptable only with the matching private key.

The model is asymmetric. A key pair has a public half (used to encrypt to you, safe to share) and a private half (used to decrypt, guarded by a passphrase and never shared). A modern GPG identity is usually a primary key plus subkeys for signing, encryption, and authentication – which is what lets the private key be moved onto hardware like a YubiKey one subkey at a time.

YubiKey

Mon, 01 Jan 0001 00:00:00 +0000

A YubiKey is a small USB (and NFC) hardware authenticator made by Yubico. Among several applets it implements an OpenPGP smartcard, which can hold GPG private keys on the device itself. Once a key is moved onto the card, the private material never exists on disk and never leaves the hardware – cryptographic operations happen on the YubiKey, and the host only sends in ciphertext and gets back plaintext.

This makes it the natural hardening step for a pass store: the GPG key that can decrypt every secret stops being a file an attacker can copy and becomes a physical object you hold. With a touch policy enabled, each decryption also requires a deliberate tap, so malware cannot silently drain the store even while the key is plugged in.