>>109662609
They're probably not all running all the time for starters.

They're stored encrypted and those packages can't access the area in RAM where they're temporary stored in decrypted form.

>>109662673
couldn't a malicious program just invoke

ls .password-store; pass PASSWORD_FILE

?

Open source developers are trustworthy people.

>>109662769
that's why you use a password manager without a CLI

>>109662778
this kek
just audit the code, you have time to audit 2000 packages don't you? and the updates they keep getting?

File: 5690879685746786978078654.png (2.17 MB, 1024x1024)

2.17 MB PNG

>>109662609
MacOs doesn't have this problem every software runs in a "bottle".

>>109662609
you have nothing worth stealing

>>109662769
what?

>>109663504
programs can execute arbitrary shell commands

>>109663543
your command does nothing

>>109663557
it's an example, you don't literally type it in an expect it to work, you would need to choose a result from ls and use it with pass. A more useful thing to write is one that lists the filenames along with the pass output line-by-line but I'm not going to go to that much effort for a one-off post.

>password manager
I have a text file on an external HDD there is never connected longer than 30 seconds in which all "passwords" are mnemonics that only I could ever possibly know, and with a priority system from weakest to strongest based on my personal interpreted likelihood of said service getting pwnd

what the fuck do you need a password manager for?

>>109663572
i dont know how pass works but chances are it's not that fucking retarded

>>109663582
It's literally just

pass "$PASSWORD_FILE_NAME"

. So long as your gpg key is cached you can just get it as plain text.

So, during that 2 hour window where your gpg key is cached, what's to stop any other process from just accessing all of your passwords?

>>109663610
can you not use a competent manager that purges the cache when you close it / log out? Surely you're not sitting around logged into your vault at all times for no reason

>>109663610
i dont know fucking go check yourself if you care

>>109663623
what options are there to not have to type the key in literally every time?

>>109662609
it's not hard to encrypt using openssl
you don't need password managers

>>109662609
isn't that the whole point of SELINUX?
packages can't access those passwords

>>109663673
good luck setting that up
desktop linux is inherently insecure because it's a shitty old system held together by zip ties with no central authority (on the desktop, kernel is very well maintained)

>>109662609
If you didn't install 2000 packages, maybe you'd have time to audit them

>>109662609
iirc the passwords are in an encrypted file.
when decrypted/opened they are inside the volitile memory of of kwallet. to read them there you'd need to do something like a full memory dump of the program which requires sudo.

i dont remember how it works with pass i think its the same but it doesnt keep the passwords in RAM it just decrypts them when you ask for it and exits, its more secure but more of a hassle

>>109663706
bubblewrap exists
userspace exists
not that you'd know

>>109663573
a password manager is the same exact thing that you're doing except automated with software and also it does a 10,000x better job than your retarded notepad strategy

>>109663635
biometrics, keypass, phishing resistant MFA (yubikey)
not a question of whether or not you choose to use those, but alternative options exist

Android doesn't have this problem

on windows 11 if you enable memory integrity, you can utilize window's hypervisor by creating a VBS enclave, and essentially you can encrypt data using the master key hidden in the TPM, so you can encrypt stuff without the possibility of leaking the master key, and you can decrypt stuff with only the same VBS (but a fully compromised PC can gain access to the decrypted data).
The problem is that if you want to log into a website or whatever, the second the password gets transferred out of the VBS enclave, it is compromised (assuming that there is a virus running on your PC and it has the same security level as the password keeping app BUT no access to the VBS).
So that means that every application with a login token (ideally with a login token that never expires) needs to manually utilize the VBS to store it.
But if you are a programmer and you want to utilize the VBS enclave, you must have a code signing certificate (for HVCI), which is pretty expensive ($300~ a year?).
Also VBS enclaves don't have remote attestation, which means there is no way for the server to double check if the hardware is the same hardware it originally gave the login-token for (this was possible with intel SGX which was removed in intel 11th gen, still used on xeons, but authoring SGX enclaves is hard + disabled in bios).

>>109663755
yes i'm going to bubblewrap fucking chromium and spend 50 days trying to figure out why half of the shit isnt working because the presets work like shit and on top of that i cant even access photos because there's no system wide file access permission system like on android so ti's incredibly fucking tedious if i cared about security i'd either use VMs for everything or run grapheneos in desktopmode

File: 1787860864433.jpg (236 KB, 1200x726)

236 KB JPG

>>109664219
holy fvcking this

also, for me its crosscut

>>109664336
whats your setup

>>109663610
Why are you caching your key? Why are you not using a USB smart card as an HSM that requires physical interaction every single time?

>>109662789
Audited by the distro.
>AUR
And I love love love to suck cocks. Biiiig black cocks. BLACKED.

File: peakschizophrenia.gif (31 KB, 228x221)

31 KB GIF

it doesn't matter what you do. on linux and windows (havent used mac so idk), as soon as you run untrusted unknown code it's over. it's stupidly easy to sidestep to root from regular user, and even with regular user you can do lots of stuff.

the only place where this is not an issue is qubes. trying to use 10 encapsulation layers like bubblewrap flatpak apparmor selinux is retarded and might fuck you more.

in the big26' you are compromised unless proven otherwise. a single npm install, a single cargo build and its over.