docker-credential-helpers VS passforios

Docker supports a credential-helper module[0], which supports 4 different backends for fetching the docker registry credentials: osxkeychain, pass, wincred, and secretservice.

pass lets you use GPG-smartcards, and many of those (such as Yubikeys) will let you enforce touch-policies for signing/encruption.

As a combination of both these however, I must touch my Yubikey every time I pull a new docker image.

Another cool use-case is that I use the terraform-pass-provider to save secrets for my personal terraform project.

[0]: https://github.com/docker/docker-credential-helpers

# Finds the latest version $ wincred_version=$(curl -fsSL -o /dev/null -w "%{url_effective}" https://github.com/docker/docker-credential-helpers/releases/latest) # Downloads and extracts the .exe $ sudo curl -fL \ "https://github.com/docker/docker-credential-helpers/releases/download/${wincred_version}/docker-credential-wincred-${wincred_version}-$(dpkg --print-architecture).zip" | zcat | sudo tee /usr/local/bin/docker-credential-wincred.exe >/dev/null # Assigns execution permission to it $ sudo chmod +x /usr/local/bin/docker-credential-wincred.exe

Yes you can, you can use the https://github.com/mssun/passforios app which as of over a year ago supports Yubikeys.

The UX of having to grab your Yubikey every time is a bit clunky though (although that is limitation of the security key medium itself rather than the app).

But there is, and it supports OTP where if I remember correctly is a paid feature for Bitwarden. https://github.com/mssun/passforios

But who you gonna trust then? It's open source[1] at least, so you can always review it yourself.

But from "paranoid" point of view you can't verify is this is the same code used in app and all of currently available stores lacks in reproducible builds department. So it's always a tradeoff between ease of use and hassle.

[1]: https://github.com/mssun/passforios

https://github.com/mssun/passforios which also uses the safari password manager flow so its pretty seamless

passforios

Many Linux folks use pass, which I personally love for its simplicity and easy way to synch on different devices. There is an iOS (and an android) app.