Add Password manager by default

[0brand]

Ive been using pass-qubes with SecBrowser.

https://github.com/kulinacs/pass-qubes

@0brand

Would pass-qubes have any benefit if your pass Vault AppVM was network isolated. I can understand you would not want to expose your GPG keys to a networked AppVM (i.e. user wants to sync with git). Am I missing something?

@Patrick

Non-networked is always nice just to limit the attack surface of it.

But Qubes split password manager has limitations indeed either way. Since the password requesting AppVM can request passwords from the vault VM and see them in cleartext. And what if you wanted to split passwords for multiple AppVMs, separate for example for banking, shopping, social and so forth? Are you going to use several separate vault VMs or could we invent a mechanism…?

It is possible to use the same vault for multiple AppVMs. I have that configured now for my SecBrowser. For example, i can add just my email password to my Thunderbird (only) AppVM. Then set environment QUBES_GPG_DOMAIN=my-vault.

Next I could add my whonix forum password in separate AppVM with environment QUBES_GPG_DOMAIN=my-vault set in that as well.

Also possible to add the password-store to an dvm template (AppVM with pref template_for_dispvms=true).