Fadi
Members
-
Joined
-
Last visited
-
@Tobi This is not a problem but a workflow for enpass. Posted here because i did not found any other appropriate section on forum for this.
-
Update: v1.1.0 — Touch ID unlock Download: https://github.com/x-o-r-r-o/alfred-enpass/releases/latest New: Touch ID Turn on Touch ID in the Workflow's Configuration, then choose when the vault locks again with Auto-Lock: after every copy, after 1 minute to 4 hours of inactivity, or only when the Mac restarts. The default is 15 minutes. While locked, enp shows Unlock with Touch ID instead of your entries, and a copy asks for Touch ID first. Works on every Mac: Macs without Touch ID (or with the lid closed) ask for your Mac password, and an Apple Watch can confirm too. On a Mac without a login password, the Enpass master password is asked instead. Type lock and choose Lock Vault to lock it right away. While Touch ID is on, search results are never cached, so a locked vault never shows entries. The master password is still needed once, the first time. Touch ID is off by default, so nothing changes until you switch it on. Also since the first release (v1.0.1) Fixed ⌘↩, ⌥↩, ⌃↩, ⇧↩ and fn↩ doing nothing in Alfred. Only the entries you act on are decrypted, never the whole vault. Usernames, websites and other non-secret fields are copied without decrypting anything. Notifications no longer name the entry or show website addresses. Logins inside website addresses (user:pass@…) are never displayed. To update, download Enpass.alfredworkflow from the link above and open it. Your settings are kept. Everything is covered by 138 automated tests, and the changelog is here: https://github.com/x-o-r-r-o/alfred-enpass/blob/main/CHANGELOG.md Feedback and bug reports are welcome, here or at https://github.com/x-o-r-r-o/alfred-enpass/issues
-
Hi everyone, I use Enpass as my password manager and missed a quick way to reach it from Alfred, so I built a workflow for it. It searches your Enpass vault straight from Alfred and copies passwords, usernames, one-time codes (2FA) or any other field without opening Enpass. GitHub: https://github.com/x-o-r-r-o/alfred-enpass Download (latest release): https://github.com/x-o-r-r-o/alfred-enpass/releases/latest Usage Search your Enpass vault via the enp keyword. Type to filter by title, username, category or website. ↩ Copy password (or paste it, as set in the Workflow's Configuration). fn↩ Do the opposite: paste instead of copy, or copy instead of paste. ⌘↩ Copy username. ⌥↩ Copy one-time code. ⌃↩ Open website. ⇧↩ Show all fields of the entry. ⌘Y Quick Look website. In the fields list, ↩ copies a field, ⌘↩ pastes it and ⌃↩ opens a website field. Card numbers, PINs, recovery codes and other hidden fields are masked. Type lock to forget the saved master password. Alternatively, search Enpass for selected text or a website's domain via the Universal Action. Configure the Hotkey to open the search directly. Setup Install enpass-cli, which reads the vault: brew install enpass-cli Download Enpass.alfredworkflow from the release page above and open it. If your vault is protected with a keyfile, choose it in the configuration window. The default vault folder is Enpass's primary vault; change it if you use another one (Enpass → Settings → Advanced → Data Location). Type enp, press ↩ on "Unlock … vault" and enter your master password. It's checked against the vault and saved in your macOS Keychain. Requirements: Alfred 5 with the Powerpack, Enpass 6 on the same Mac, enpass-cli. Configuration Keyword (default enp) Vault Folder Keyfile (only for keyfile-protected vaults) Action on ↩: copy or paste into the frontmost app Clear Clipboard: after 10–90 seconds, or never (default 30 seconds) Include entries in the Enpass trash enpass-cli path (found automatically in /opt/homebrew/bin or /usr/local/bin) How it works and security Enpass doesn't offer an API or AppleScript support, and its browser extensions use a private connection to the app. So this workflow reads the vault file directly through the open-source enpass-cli (https://github.com/hazcod/enpass-cli) by hazcod, which handles the decryption. Read-only: the vault is never modified, and nothing is sent over the network. The master password is stored in your login Keychain and passed to enpass-cli only through its environment, never on a command line. Search results never contain secrets. Passwords and codes are only read when you pick an action, and go straight to the clipboard without passing through Alfred. Copied values are marked as concealed/transient, so Alfred's Clipboard History and other clipboard managers skip them, and they're kept off Universal Clipboard. The clipboard is cleared after the configured delay, unless you copied something else in the meantime. Only http and https websites are opened. Please be aware that while your login keychain is unlocked, any program running as your user can read the saved master password through Apple's security tool. This is the same trust model as other password-manager workflows, so I don't recommend it on a Mac you share an account on. Known limitations Entries with no fields at all (for example a secure note with only note text) aren't listed, because enpass-cli skips them. Archived entries are listed like any other. One vault per workflow; duplicate the workflow for a second vault. Testing I've tested it with Enpass 6.12.5 on macOS 26 against a vault of about 2,400 entries protected with a keyfile, including 2FA codes and paste mode. The repository also has 96 automated end-to-end checks that run against encrypted test vaults (Unicode and odd characters in passwords, duplicate titles, keyfiles, wrong passwords, clipboard clearing and more). Disclosure This workflow was built with the help of an AI assistant (Claude). I reviewed and tested it on my own vault, and the full source is on GitHub for anyone to audit. It isn't affiliated with or endorsed by Enpass. Feedback, bug reports and ideas are very welcome, here or on GitHub: https://github.com/x-o-r-r-o/alfred-enpass/issues
-
well i think this needs attention to make it easy to use in enpass.
-
-
Well I am here just to let enpass team know that we have been waiting for many major features and major release for enpass to keep it self updated to the industry standards. People have been requesting several features to make sure enpass becomes the best password manager in market but I assume enpass does not want any customer base anymore to stick to it since past few years I have been waiting patiently for enpass to work on new features and listen to it's customers but we ended up being told that our request has been forwarded to development team and after that nothing came out with any new features. Enpass v6 was released 5 years ago in 2018 and now it is 2023 in past 5 years things have changed a lot in password manager industry. Enpass maybe unique for it's offline usage but rest assured is not being maintained the way it should be. There is no roadmap no updates about any new features. Every feature request made on forum is being ignored. No implementation of FIDO2. I mean I can go on and on and on with list of the features and options people have been requesting but non of those were implemented. I thought maybe soon they will add all new features with a major release of v7 but that is not happening any sooner. I have been using almost every password manager including Lastpass, Keeper, Bitwarden, Nordpass, Roboform, Stickypassword, passwordboss, dashlane, 1password and few others but now there is a new password manager which checks all the boxes for me and it even provides you temporary emails and passkey support. It might be new and fresh in market but after reviewing and testing it's features I think it is time to say goodbye to enpass and move everything to locker.io password manager. I am glad to be part of enpass for a very long time but enough is enough and I have had enough of this wait. I would like to thank you enpass team for serving us with this great piece of software which I still love to use but I have my own reasons explained. In future I will keep an eye on enpass as I have lifetime subscription and will monitor it's progress but until than I am done with enpass and there are many others like me who stopped using enpass due to its slow development as everyone wants new and better softwares specially when it is about personal security. Password manager being offline is not enough to keep customers engaged as in the end to end up uploading your enpass database somewhere on cloud storage services to use it remotely anywhere in the world. All enpass had to do was listen to us and add features to enpass but you guys did not listened to us. So have a great journey in this competitive and features pack industry. Sooner or later you guys will realize that you need to keep up the pace if you want to keep your customers and trust me just google about enpass and find out how much enpass has disappointed it's customers by just not keeping it self updated. Thank you and good bye.
-
I don't think this will be implemented any sooner. Because people have been requesting many useful major features but i have never seen them being implemented. Development in enpass is very very slow. No new features but few bug fixes in every update. I just hope they will listen to us and implement because if they don't it's gonna bad and people will move to other better available options. We love enpass but when it comes to lack of features it hurts us as i have been using almost every available password manager i can see not every password manager is perfect but that's why we are here in first place to suggest and help enpass to become better than all others. I just hope it happens sooner or enpass will lose it's customers.
-
+1 You have not been able to add yubikey or 2FA for encryption to the database as they were also required but I hope Passkey will be implemented sooner.
-
People expect Enpass to come back with new and improved features, but it's unclear what's happening behind the scenes.No buddy has even a clue if enpass is even planning to release any new version with major upgrades including new features. They have made features request section in forum, but mostly those requests get noted than no buddy knows if anyone is even working on them. The response received only acknowledges that the request has been forwarded and that it will be reviewed. However, there is no indication as to when the requested feature will be implemented.
-
@Thoughts? The only question I have is how do we make it more secure from unknown access. Storing a security key file in an encrypted vault requires unlocking the vault before accessing the file and unlocking Enpass. Once the volume is unlocked, it becomes vulnerable to RAT attacks and enpass may be subject to key logging. Therefore, it is crucial to find a more robust encryption solution that ensures no unauthorized access to the database. Enpass must be able to access both the database and the security key files simultaneously for maximum security. Storing these files in separate Cryptomator vaults will not suffice as neither vault will function unless both are unlocked. Furthermore, once both vaults are unlocked, anyone could potentially gain access to them, compromising the security of both files. Enpass is maybe not crackable, but it is hackable with much easier tricks than the other password managers.
-
Well due to this lack of security feature I have started using Bitwarden which seems to be much more secure. @hacked_user I am just in love with enpass, but I cannot risk it for a few accounts including my bank and everything else I have moved those logins to Bitwarden which requires more security. I just hope they will come up with a solution since security key needs to be accessed by enpass to unlock it even if you use cryptomator or any other tool to encrypt it when you want to load it in enpass you have to unlock that encryption for enpass to load that file which also allow remote access to access that mounted drive. So having a security key file is not a reliable solution in my opinion. FIDO2 can be implemented since it is even an offline password manager but still it goes to enpass server or to App Store on Mac and Windows to check and receive updates, so it is not 100% offline. I think if they want to implement this it can be done. I understand @Thoughts? explanation but there are encryption tools who are using Yubikey (Example: HiCrypt.com, Veracrypt.fr) I am not a programmer or don't know much in depth stuff all I need is a much more secure way to encrypt my enpass data with 2FA or security key. I own almost every company: Trezor, Ledger, Yubikey 5, Nitro key 3, Token2, Solo key, Onlykey. I know it is a bit complicated and time-taking process to implement something like this, but this is something which needs serious attention and solution. I saw other people also requesting this from past few years but still it is not developed. I just hope they will get it done some day.
-
Ok so this happens when you update your macos and in mac there are 2 applications folders. 1 is for default mac apps and second applications folder gets created when you update your macos and second applications folder contains user installed apps. Just move all apps from second applications folder (user installed apps) to first applications folder. Before doing that kill all applications to make sure you don't get any error. This is the only possible solution i found for myself.
-
-
@Thoughts? So in short 2FA or FIDO2 cannot be implemented with enpass and once your system got hacked and hacker keylogged you and downloaded your database and enpass key file there is nothing you can do to protect yourself? Bitwarden is way better than loosing my all passwords just because enpass is not able to implement 2FA which i am not sure why is not possible to implement even with yubikey. Because no matter where you secure your key file even in cryptomator enpass requires access to that file and once the cryptomator vault is unlocked you can access all files using any RAT. So how come enpass calls it self secure when you have to have access to key file or master password which can be keylogged or even key file can be stolen? Just because enpass is encrypting database is not enough. What enpass is doing to secure that database once key file and database and master password gets stolen?
-
