Secrets on Tom Meurs

YubiKey + Pass + GPG + SSH: One Key to Rule Them All

Tue, 13 Jan 2026 17:00:00 +0100

TL;DR One YubiKey carries a GPG key with a signing, an encryption and an authentication subkey. gpg-agent hands the authentication subkey to SSH, git signs with the signing subkey and pass decrypts with the encryption subkey, so one PIN in the morning and a touch per action replace every password I used to type. The SSH part alone is three steps and worth doing on its own.

Every morning I plug in my YubiKey, type one PIN, and that’s the last secret I type until I pull it out again. SSH to a server, no password. Sign a commit, no passphrase. Pull a secret out of pass, touch the key. One thing in a USB port, and the rest of the day my authentication happens without me.

Pass: the Unix password manager that just works

Sat, 10 Jan 2026 12:00:00 +0100

TL;DR pass keeps each password as a GPG-encrypted file in a directory, and the directory is the whole data model. pass -c email/gmail puts a password in your clipboard from any terminal, pass git push backs the store up, and the fzf script further down is how I look up every password I have. The price is GPG key management, and it’s a real price.

I used KeePass for years. Then 1Password. Then Bitwarden. All decent tools, and every one of them was too much for what I asked of it. Too much UI, too many features, and a password always lived on the other side of an app I had to alt-tab into. A small interruption, and they added up.

Vault for Beginners: Secrets Management in Kubernetes

Wed, 02 Jul 2025 10:00:00 +0200

The first time I ran kubectl get secret myapp -o yaml and base64-decoded the value, I felt my stomach drop. There was my database password, sitting in etcd, readable by anyone who could reach the API with the right RBAC. Kubernetes Secrets are not secrets. They’re base64-encoded plain text with a fancy name. That’s the default, and it’s the thing nobody warns you about on day one.

Every cloud provider has a fix for sale. AWS has Secrets Manager, Google has Secret Manager, Azure has Key Vault. They work. The catch shows up later: the day you need to migrate, the day you want to know exactly what happens to a secret after you write it, the day you realise your most sensitive data lives in a system you can’t inspect.