encpass.sh VS OkcAgent

https://github.com/plyint/encpass.sh/archive/v${pkgver}/${pkgname}-${pkgver}.tar.gz

The difficulties mentioned in the article with passing secrets on the command line is one of the reasons why we wrote encpass.sh (https://github.com/plyint/encpass.sh). We had a similar need for a lightweight solution for managing secrets for simple shell scripts on our local workstations and in restricted environments. Bonus, it can be easily customized with extension scripts to adapt functions for your own specific needs. See our keybase extension for an example -> https://github.com/plyint/encpass.sh/blob/master/extensions/...

We made an extension for encpass.sh that stores secrets in Keybase (https://github.com/plyint/encpass.sh/blob/master/extensions/...) if that sort of thing is of interest to you. Outside of personal secrets, it can be used as a sort of low cost stand in for shared secrets that you might use something like Vault for in a team environment.

It's a bit complicated, but you can use GPG for this! You can follow this guide to setup GPG, and follow this issue to set it up with Termux, then use OKCAgent's GPG function to en/decrypt any files. You can then use any CLI TOTP program and de/encrypt the key files with your GPG key. It's not as secure as having them on the key, as the private keys for the TOTP have to be in your phone's RAM. You can write a shell script for that and put a widget to it on your home screen.

[1]: https://github.com/DDoSolitary/OkcAgent

Simple password decrypt: okc-gpg -d ~/.password-store/mypass.gpg

I made a termux shortcut (button on homescreen) to emulate pass-dmenu via this ( store in ~/.shortcuts):

  #!/data/data/com.termux/files/usr/bin/env bash