Top all-time · #10069
ROT256.
Personal blog · rot256.devsecurityprogramming
ROT256. is a personal blog at rot256.dev about security and programming. Since 2022, 8 different Hacker News readers have linked it 9 times, most often “(In)Security of the "Pass" password manager (2021)”. It is still writing: the last post was on 2026-09-03, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN commenters link this blog's post on the Unix password manager pass, which covers its weaknesses, such as GPG's asymmetric keys letting someone swap in a new password file, and what it still exposes.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- (In)Security of the "Pass" password manager (2021)4 people · 5 mentions · first linked 2022-06-17
- Proof-Carrying Border Gateway Protocol2 people · 2 mentions · first linked 2026-04-01
What Hacker News says?
This article goes into some of the deficiencies of using GPG with pass. In particular, GPG uses asymmetric keys, so someone could encrypt a new password file with your public key and you wouldn't know. https://rot256.dev/post/pass/
Comment linking /post/pass/
on “Pass: Unix Password Manager”Submitted (In)Security of the "Pass" password manager (2021) as a story · 4 points
HN discussionhttps://rot256.dev/post/pass/ Make sure you understand how exactly it encrypts your data, and what are the things that are still exposed by it.
Comment linking /post/pass/
on “pass – the standard Unix password manager”Submitted Proof-Carrying Border Gateway Protocol as a story · 3 points
HN discussionI think that way to solve BGPs security problems might be to use a new cryptographic hammer, "Proof-Carraying Data", where messages come with cryptographic proofs that they were produced correctly. This allows you to basically just run BGP, but every AS proves that it ran it correctly. The proofs take constant time to verify, regardless of how large the network is, or how many hops the routing message has taken. Fea…
Comment linking /post/bgp-pcd/
on “Is BGP Safe Yet? No. Test Your ISP”Submitted (In)Security of the “Pass” password manager as a story · 2 points
HN discussionpass has issues: https://rot256.dev/post/pass/ This is very much a case of "don't invent your own cryptosystem", especially not in bash.
Comment linking /post/pass/
on “Ask HN: What is the best password manager available today?”Submitted Code Signing for web apps using Signed HTTP Exchange (2023) as a story · 1 points
HN discussionSubmitted Git-Ring: Easy and Flexible SSH Ring Signatures as a story · 1 points
HN discussion