Recipients question

[revengel]

If after deleting recipient

gopass recipients rm xxxxx

run command

gopass fsck --decrypt

Will the user xxxxx lose the ability to decrypt keys they previously had access to?

[AnomalRoil]

They will still be able to access all the secrets they had access to until then simply by not updating their store, but cannot access new secrets or modified ones.

These is in general true of all passwords manager: you cannot prevent someone from writing all passwords on a sheet or so, and therefore it's important to rotate important secrets when you do so.

I believe the recipients rm operation has a warning about it when you use it.

[dominikschulz]

Yes, this is a fundamental limitation that gopass isn't even trying to address.
The problem can be somewhat limited by a central password store (e.g. web based) with strict read auditing and frequent credential changes. But this is not something gopass is trying to do. It's more meant as a personal and small team password store.

One thing we might want to support better is rolling large amounts of credentials, but that's tricky and has a number of limitations not I'm not sure how useful that'd be.