Quick unlock: PIN

[msladek]

The desktop app offers multiple quick unlock options, see here. It would also be convenient to have something similar for the cli. Biometrics might be complicated, but a PIN should be doable.

Now there are multiple ways to do this, but the desktop app "does not actually close the Enpass database but adds just an extra screen for authorization". I don't think this can be done easily without writing a daemon that keeps the db connection open.

We could however encrypt the derived database key with the PIN and write it to (ram)disk. This file could be checked for consecutive runs and decrypted by only providing the PIN.

• this PIN feature would be disabled by default and only be prompted if a -pin flag is provided.
• require PIN min length, e.g. 8 characters
• encryption could be done similar to how the Enpass database itself is encrypted, e.g. with this aes-256-gcm
• the encrypted file shouldn't survive a system restart, thus a ramdisk like /run/user/$UID aka XDG_RUNTIME_DIR or /dev/shm or /tmp for darwin seem like suitable locations.
• 600 file permissions

@hazcod WDYT? Is this idea sensible?

[fasher]

I would love if an agent daemon can be implemented so we can login once (within a se time) and keep a session env variable that can communicate with the agent that does the actual decryption.
lastpass-cli has something like that implemented

[msladek]

while an agent daemon certainly has many advantages, it is also much more complex to implement and setup. I feel this would overwhelm the current development capacity of this project. but of course any help is welcome.

[hazcod]

@msladek That sounds like a reasonable implementation.

[msladek]

thanks for your assessment. you can expect a PR addressing this within a few days.