OneQuery VS pass-import

I store my passwords using this: https://www.passwordstore.org/

It's a shell script that stores passwords in a git repository, containing one file per entry. The files are encrypted using a GPG key. Because it's just a git repository, you can synchronise it between devices using whatever infrastructure you want. I use a FOSS client for it on iOS, and there was one for Android before I got an iPhone.

> I don't understand how this solves the issue in this case.

I'd say since it is a local only tool, you don't really need to update it constantly provided you are a sane person that don't use a browser extension. It makes it easier to audit and yourself less at risk of having your tool compromised.

It doesn't have to be keypass though, it can be any local password management tool like pass[1] or its guis or simply a local encrypted file.

[1] https://www.passwordstore.org/

A more secure option is to use a password manager/vault application with console integration, like Bitwarden, vault, pass, etc. Some will allow you to launch applications with environment variables pulled from secure storage.

I've been storing OTP secrets using `pass`[0] with `pass-otp`[1]. This does the whole symmetric encryption for me using `gpg`, decodes the URL for me to pass it into oathtool, and allows me to share the codes with my phone using Android Password Store[2]. This is all deceptively simple to set up, assuming you have a git server you trust to synchronize the codes with, or some kind of other method using maybe tailscale or syncthing? As long as you don't need the codes on Windows, where the QtPass app is unmaintained and can't generate OTP codes on Windows, you're mostly good.

Oh and I use `zbarimg` to decode the QR, as I've integrated it with my screenshot script and it can decode more than just QR codes.

[0]: https://www.passwordstore.org/

[1]: https://github.com/tadfisher/pass-otp

[2]: https://f-droid.org/packages/app.passwordstore.agrahn/