I too have been using safe(1) for the last year, and I love it. Because it feels good to use something you made, but also because I took the time to correctly setup a password management process with it.

(08-12-2020, 04:30 AM)venam Wrote: As usual in security, you need at least 2 or more of a combination of the following: something you know, something you have, something you are.

I don't fully agree with this statement. While this is a good advice, security isn't about seeking top-notch security at all cost. In my case, relying on a GPG key (something you have) was too much involved, and I ended up avoiding my password manager like the plague, because I knew that I would struggle to recover the password for different reasons. GPG require too much involvement to secure a secret store. You gotta rotate your keys, sync them between devices, or setup a complex, multi-key system, make sure you keep the revoke key, and you can't use your secret store for that, …

safe(1) was my solution to that. It is a flat-file encrypted secret store, requiring only a master password to unlock its entries. The master password is saved in the store itself (only to check that you typed your password correctly), so the store is "self-contained", meaning that to retrieve a secret, all you need is the secret entry you need, the master password and the tool to decrypt it.

As I backup the store in "THE CLOUD", I can quickly and easily fetch the store from my phone, and unlock it there (safe compiles just fine on my phone !). The file format is also simple enough that using openssl to decrypt an entry should be possible too (I should try it out someday).

The main issue I had in the past with password based key stores is that you always had to type the password for every single operation (encrypt AND decrypt). So modifying an entry would require to type it twice. Not practical at all !
That's why I also created an agent for sage, conveniently named safe-agent(1). It will accept connections from a socket and either store the key in-memory when someone writes on the socket, or send the in-memory key to a client reading from the socket. The master password is NEVER exchanged between client and agent.

This can, of course, be a security concern, just as with ssh-agent and gpg-agent, so you're not forced into using it. It's just a more convenient way to use the tool.

As for security, it's all about how far you can push the security cursor, without impacting too much the usability.