---
title: "Auditing passwords with \"pass oldest\"  | Northern.tech"
description: "pass oldest
I and my colleagues at Northern.tech use pass to store and share passwords in a secure way. Pass uses git and gpg to secure and keep track of..."
---

<https://northern.tech/>

[ Contact us ](https://northern.tech/contact)

Menu

<https://northern.tech/>

[ security ](https://northern.tech/careers/blog/tag/security)

# [Auditing passwords with "pass oldest"](https://northern.tech/careers/blog/auditing-passwords-with-pass-oldest)

By craigcomstock,  3rd October 2019

### pass oldest

I and my colleagues at Northern.tech use [pass](https://www.passwordstore.org) to store and share passwords in a secure way. Pass uses git and gpg to secure and keep track of changes. Each password is just a gpg file in a special directory, by default ~/.password-store.

I wanted to help myself automate and refresh passwords when appropriate. After doing some research, see References below, I found that likely the best reason to change your passwords are:

- the site has been compromised This can be dealt with by visiting [https://haveibeenpwned.com/](https://haveibeenpwned.com/) periodically
- your password is rather old, say 1-2 years, especially if you can't setup multi-factor auth for that site I wrote some small scripts and eventually a pass extension!

The other recommendations about passwords can generally be handled by letting a password manager like pass handle the generation of the passwords. Problem solved!

First I wrote a script to show me the oldest gpg file recursively from the current location:

~/bin/oldestfile:

> find -type f -name '*.gpg' -printf '%T+ %p\n' | sort | head -n 1

Then I used that to find the oldest file in my password database

~/bin/oldestpassword:

> (cd ~/.password-store; oldestfile)

And now comes the hard part, logging in to whatever that is and choosing to delete the account or generating a new password. Would be nice if pass tracked when the last time I accessed the password but that will have to wait until another time. ;)

Password entries can contain more than just a first line with the password, such as account id, recovery secrets, meta information so when you regenerate a new password make sure you use the -i (in place edit) option

> pass generate -i sample-pass-entry-path

To make this easier and more sharable I created a pass extension called "oldest".

Get at [https://gitlab.com/craigcomstock/pass-oldest](https://gitlab.com/craigcomstock/pass-oldest), install, and then you can type

> pass oldest

And get back similar info as my simpler scripts.

### Further Ideas

- base oldest on git commit timestamp instead of filesystem
- find some way to mark an old password as "fine" so "pass oldest" doesn't report it again for a while
- add workflow to oldest to include deciding to refresh/delete/defer a password

### References (with TL;DR summaries aka LMGTFY ;)

- 2018: [https://www.us-cert.gov/ncas/current-activity/2018/03/27/Creating-and-Managing-Strong-Passwords](https://www.us-cert.gov/ncas/current-activity/2018/03/27/Creating-and-Managing-Strong-Passwords) 
    - multi-factor auth
    - unique password for each site
    - no personal information
    - longest password or passphrase permissible
    - no words from a dictionary? (Hmm...) (password manager takes care of this one!)
    - Supplementing passwords (2010, revised 2019) [https://www.us-cert.gov/ncas/tips/ST05-012](https://www.us-cert.gov/ncas/tips/ST05-012)
    - Choosing and Protecting Passwords (2009, revised 2019) [https://www.us-cert.gov/ncas/tips/ST04-002](https://www.us-cert.gov/ncas/tips/ST04-002)
- 2018: [https://blog.lastpass.com/2018/08/often-change-password](https://blog.lastpass.com/2018/08/often-change-password) 
    - Nice article. Would be amazing if a tool could monitor for website changes and breaches automagically!? Does last pass do this?
    - They have a nice list:
    - After a service discloses a security incident.
    - There is evidence of unauthorized access to your account.
    - There is evidence of malware or other compromise of your device.
    - You shared access to an account with someone else and they no longer use the login.
    - You logged in to the account on a shared or public computer (such as at a library or hotel).
    - It's been a year or more since you last changed the password, especially if you don't have multi-factor authentication enabled.
- 2017: [https://www.schneier.com/blog/archives/2017/10/changes_in_pass.html](https://www.schneier.com/blog/archives/2017/10/changes_in_pass.html) 
    - use pass phrases
    - only change passwords if there is a compromise
    - use password managers
- 2017: [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf) 
    - woah. Way too deep there.
- 2017: [https://www.npr.org/sections/alltechconsidered/2017/08/14/543434808/forget-tough-passwords-new-guidelines-make-it-simple](https://www.npr.org/sections/alltechconsidered/2017/08/14/543434808/forget-tough-passwords-new-guidelines-make-it-simple) 
    - phrases, lowercase letters and typical english words work well
    - no special chars or mix of upper/lower
    - passwords never need to expire
- 2017: [https://www.theverge.com/2017/8/7/16107966/password-tips-bill-burr-regrets-advice-nits-cybersecurity](https://www.theverge.com/2017/8/7/16107966/password-tips-bill-burr-regrets-advice-nits-cybersecurity)
- 2016: [https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes](https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes) 
    - time to rethink mandatory password changes
    - change them if they might have been compromised: stolen, shared with a friend, looking over your shoulder, phishing, weak?
- 2016: [https://www.microsoft.com/en-us/research/publication/password-guidance/](https://www.microsoft.com/en-us/research/publication/password-guidance/) 
    - 8 char minimum
    - eliminate char-composition requirements
    - eliminate mandatory periodic password resets
    - ban common passwords
    - educate not to re-use passwords
    - enforce registration for multi-factor auth
    - enable risk based multi-factor auth challenges
- 2016: [https://jumpcloud.com/blog/best-practices-password-management/](https://jumpcloud.com/blog/best-practices-password-management/) 
    - greater than 18 chars
    - if shorter, increase entropy with random-ness
    - each password unique, not reused
    - leverage password manager
    - multi-factor auth, mandatory for email
- 2016: wired says don't change passwords so often [https://www.wired.com/2016/03/want-safer-passwords-dont-change-often/](https://www.wired.com/2016/03/want-safer-passwords-dont-change-often/)
- 2011: [https://xkcd.com/936/](https://xkcd.com/936/) 
    - use four common random words, increases entropy from 28 bits -> 44 bits
- 2002: [https://www.symantec.com/connect/articles/simplest-security-guide-better-password-practices](https://www.symantec.com/connect/articles/simplest-security-guide-better-password-practices) 
    - no dictionary words, proper nouns or foreign words
    - no personal information
    - length, width and depth
    - extra protection - password manager
    - changing passwords, once per fiscal year, once per fiscal quarter

[« Back to the blog](https://northern.tech/careers/blog)

![craigcomstock](https://northern.tech/hubfs/Northerntech_June2023/Images/craigcomstock.png)

craigcomstock

[« Back to the blog](https://northern.tech/careers/blog)

Search the blog

### Tags

- [culture (17)](https://northern.tech/careers/blog/tag/culture)
- [Mender (13)](https://northern.tech/careers/blog/tag/mender)
- [management (10)](https://northern.tech/careers/blog/tag/management)
- [cfengine (9)](https://northern.tech/careers/blog/tag/cfengine)
- [products (8)](https://northern.tech/careers/blog/tag/products)
- [Announcements (7)](https://northern.tech/careers/blog/tag/announcements)
- [security (5)](https://northern.tech/careers/blog/tag/security)
- [IoT (3)](https://northern.tech/careers/blog/tag/iot)
- [events (2)](https://northern.tech/careers/blog/tag/events)
- [internships (2)](https://northern.tech/careers/blog/tag/internships)
- [open source (2)](https://northern.tech/careers/blog/tag/open-source)
- [remote work (2)](https://northern.tech/careers/blog/tag/remote-work)
- [HR (1)](https://northern.tech/careers/blog/tag/hr)
- [hiring (1)](https://northern.tech/careers/blog/tag/hiring)
- [other (1)](https://northern.tech/careers/blog/tag/other)

#### Feeds

[ RSS ](https://northern.tech/careers/blog/rss.xml)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "craigcomstock",
    "url" : "https://northern.tech/careers/blog/author/craigcomstock"
  },
  "dateModified" : "2023-06-09T18:29:00.847Z",
  "datePublished" : "2019-10-03T04:00:00.000Z",
  "headline" : "Auditing passwords with \"pass oldest\"  | Northern.tech",
  "mainEntityOfPage" : {
    "@id" : "https://northern.tech/careers/blog/auditing-passwords-with-pass-oldest",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://northern.tech/hubfs/symbolL-1.png"
    },
    "name" : "Northern.tech AS"
  }
}
```