search

firecat53 / keepmenu

Dmenu/Rofi frontend for Keepass databases
GNU General Public License v3.0
204 stars 32 forks source link

Add simple ability to show passwords via CLI #150

Open vaygr opened 1 year ago

vaygr commented 1 year ago

keepmenu can already read keepass databases, so implementation of this should be trivial. We probably don't need to spin up a daemon for this and should forego caching altogether.

Rationale: software like mutt or weechat allow you to specify commands to decrypt data that can be used for passphrase purposes (SMTP/POP3/IMAP/IRC auth, certificate decryption, etc.). Typically you would use plain gpg for this: gpg --batch -q --decrypt ~/.config/mutt/master.gpg. Or a password manager like pass: pass show weechat/passphrase. This forces to either use another password manager or different encrypted files, which promotes secret sprawl.

Furthermore, solving this will unlock usage in software like chezmoi for secret retrieval: https://www.chezmoi.io/reference/templates/secret-functions/secret/. Maybe it'll deserve its own function for chezmoi in the future.

This way all secrets can be kept in one database and retrieved by the same tool.

The proposal is to add -s/--show "mode" with an argument to display a password entry at the specified path. This can be extended to other fields, but I think just the password entry could be a good start.

firecat53 commented 1 year ago

Sounds reasonable and likely not too difficult.