Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

11–20 of 406 posts

Re: 1Password for SSH and Git (Beta)

#11

Post by eloisius »

tiernano wrote: post #2

hmmm.... this could make me move from LastPass to 1Password... after krypt.co got bought by Akamai and discontinued work on their developer stuff, i have been looking for a better way of managing SSH keys... this might be it...

If you're considering a migration anyway, I recommend you give KeePassXC a try before paying for 1Password. It also serves as an SSH agent. I haven't upgraded 1Password since they became a subscription model, so I'm not sure how it stands now, but KeePassXC was an upgrade for me. The browser integration is more configurable and I have fewer instances of not being able to use the auto-sign in with certain sites. Strongbox on iOS works beautifully with KeePass, and found it to be just as good as the 1Password iOS app too.

Re: 1Password for SSH and Git (Beta)

#13

Post by bitexploder »

nerdawson wrote: post #5

I’ve been treating SSH keys in the same way I would a password. Each service gets a new key generated for it. From doing some reading though it sounds like I might be wasting my time. Apparently it’s fine to have one key for an individual machine and to use that for everything. What’s everyone else’s take on that? Are you reusing a single key or generating each time?

I use a handful of keys. Thing is, your secret is never shared with the server. Just the public key bits. Passwords are stored (hashed) on the services. Totally different threat models. With your public key the biggest risk is someone tracking what you are up to if they compromised multiple services/servers you use.

Re: 1Password for SSH and Git (Beta)

#15

Post by yabones »

Ah neat, the app exposes an ssh agent socket:

    export SSH_AUTH_SOCK=~/.1password/agent.sock
So you would essentially replace Keychain, Gnome-keyring, or the vanilla SSH-agent with 1password. Very nice solution.

Re: 1Password for SSH and Git (Beta)

#17

Post by snide »

tonyedgecombe wrote: post #3

>Set up the 1Password 8 desktop app That will be the Electron version. No thanks.

I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on my machine and has never really gotten in the way.

Also, they have a nice CLI. I'm sure getting some of these features there is only a matter of time.

Re: 1Password for SSH and Git (Beta)

#18

Post by captn3m0 »

nerdawson wrote: post #5

I’ve been treating SSH keys in the same way I would a password. Each service gets a new key generated for it. From doing some reading though it sounds like I might be wasting my time. Apparently it’s fine to have one key for an individual machine and to use that for everything. What’s everyone else’s take on that? Are you reusing a single key or generating each time?

I'd love to, but I keep keys on my Yubikey - which only supports 1 auth key. Even using U2F for SSH keeps the same restrictions. And using a different yubikey for various services isn't ideal either.

I have considered keeping encrypted keys in my password manager per-service, and decrypt+add them to my SSH agent when they're used to offer almost the same guarantees.

Re: 1Password for SSH and Git (Beta)

#19

Post by deknos »

nerdawson wrote: post #5

I’ve been treating SSH keys in the same way I would a password. Each service gets a new key generated for it. From doing some reading though it sounds like I might be wasting my time. Apparently it’s fine to have one key for an individual machine and to use that for everything. What’s everyone else’s take on that? Are you reusing a single key or generating each time?

As we do not know which threat models or new applications or secrets-deployment systems are coming up, i do this also.

It's automatable and one less thing to worry about.

Re: 1Password for SSH and Git (Beta)

#20

Post by trabant00 »

My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities?

And why would I replace the openssh agent with 1password agent?

They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard?

(the above logic is why I don't make any serious money)

Post reply on HN