[blfr]

Yeah, yeah, but if an adversary can do things like

> replace the contents of ./Personal/malicious-site.com with the contents of ./Work/id_ed25519

then it's pretty much game over anyway.

[gruez]

1. presumably people using pass are using some sort of syncing system, which might be cloud based or otherwise compromised.

2. if that's "game over anyway", you might as well store your passwords in an unencrypted .txt file :^)

[blfr]

I probably could since I have my filesystem encrypted anyway and de facto do since my GPG keys are unlocked on login.