Now would it be possible to make something like this for GPG?
GPG already allows you to authenticate and your SSH key is protected by GPG.
1Password for SSH and Git (Beta)
121–130 of 406 posts
Re: 1Password for SSH and Git (Beta)
#122Earlier quoted context omitted.
Not really into replacing vetted, well tested open source software with a proprietary app with cloud storage.
I have pretty high confidence in 1password's security, because it's a very attractive target for both security researchers and malicious actors. I just hope they have a decent and fair bug bounty program.
Re: 1Password for SSH and Git (Beta)
#123My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities? And why would I replace the openssh agent with 1password agent? They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cl…
I have no idea why you're getting downvoted. I don't use 1password for anything and I don't recommend anyone use it for anything.
I will never use a 3rd party service to manage my passwords or key phrases. And why in God's name are people generating SSH keys in the browser?
The thought of using it for SSH or GitHub just sounds insane to me. And as you say it doesn't even really offer any benefit over cutting and pasting from the CLI.
Re: 1Password for SSH and Git (Beta)
#124I'd rather use Secretive ( https://github.com/maxgoedjen/secretive ), to be honest. I've stopped using 1Password everywhere I can due to their product "focus", and am working my way through a set of alternatives (currently using Secrets on the Mac and looking at the KeePass ecosystem, which keeps improving monthly): https://taoofmac.com/space/apps/1password Edit: It's been fun watching this get upvoted and downvoted…
I agree. They disabled 1Password for Firefox on iOS and force users to use safari with 1Password extension. Before you could access it through share menu and get forms filled out, but they removed that feature. Reached out to support regarding that and their answer was just to use safari.
There is no extension to use 1Password with FF on iOS. iOS recognizes 1Password as part of the normal password system on the device. I, and others in this thread, have no problem doing so.
Re: 1Password for SSH and Git (Beta)
#125I'd rather use Secretive ( https://github.com/maxgoedjen/secretive ), to be honest. I've stopped using 1Password everywhere I can due to their product "focus", and am working my way through a set of alternatives (currently using Secrets on the Mac and looking at the KeePass ecosystem, which keeps improving monthly): https://taoofmac.com/space/apps/1password Edit: It's been fun watching this get upvoted and downvoted…
I agree. They disabled 1Password for Firefox on iOS and force users to use safari with 1Password extension. Before you could access it through share menu and get forms filled out, but they removed that feature. Reached out to support regarding that and their answer was just to use safari.
Password filling on iOS and Android is built in to the OS. There's no need for an extension anywhere.
Re: 1Password for SSH and Git (Beta)
#126For those not buying into 1password, what is the "correct" non-1password way to manage SSH keys?
private key never leaves the device it is on; public key is .. well public so not something to store in a password manager. If the device is replaced, you create a new ssh key pair or restore your old one from a backup. In case your device is stolen/lost, you revoke access by removing the public key wherever you used it. This too is something a password manager can't do for you. If you are in a cloud environment, you let it manage keys for you. E.g. we don't provision any keys to GCP vms and instead login via a gcloud command that provisions temporary ssh credentials.
In short, I see no need for using a password manager for managing ssh keys. The public key is not something that needs protecting. The private key is something that you should not share between multiple devices or generally pass around.
But of course being able to paste your public key from some tool is nice if that is a regular thing in your life. And if you switch between multiple key pairs, it's probably nice to have something more user friendly than very fiddly command line tools. I guess the latter is what 1password is trying to solve here.
Re: 1Password for SSH and Git (Beta)
#127Earlier quoted context omitted.
Other commenters have mentioned sync, which is absolutely nice, but one other advantage is shared keys. Obviously it's not ideal to share SSH keys, but lots of teams will share the default EC2 keypair for example. This makes it much easier to pop that key into 1Pass, share it with the team, and easily get everyone into the box. And, frankly, 1Password gui is much more user-friendly than other SSH agents. Personally,…
> Other commenters have mentioned sync Isn't this an anti-feature? The ability to revoke an SSH key specific to a stolen laptop from a server or your Github account seems like a benefit. Using the same SSH key on every machine is a downgrade. On the other hand, the ability to manage access to shared keys is really nice.
Presumably if the laptop is stolen, the key isn’t exposed because it’s in 1Password, and the attacker doesn’t have your master password?
Re: 1Password for SSH and Git (Beta)
#128I still have no idea why people use these kinds of programs. I have no idea how companies managed to sell this security nightmare as a feature to actually serious people. A single point of failure. Yeah, great idea!
Genuinely curious, where do you store your passwords and sensitive info like SSH keys? I hear a lot of "cloud password managers are bad!" but I rarely see someone follow up with a better approach. Even better to them. I've been using a password manager for years and I've always thought I was making a good decision but then I see all these comments and I wonder if I'm missing something.
I use KeyPassXC for almost all of my secret storage needs.
Re: 1Password for SSH and Git (Beta)
#129Earlier quoted context omitted.
What is the benefit over ssh-agent?
Where is the ssh-agent reading your private key from? If from ~/.ssh/, you're just one "npm install" away from the key being exfiltrated by a compromised package. If the private key is on your Yubikey, you're already good. The 1password agent will provide a good hardwareless method of keeping your private keys off the local filesystem, and it'll sync between your devices too.
Why can the compromised package not also access wherever 1p is storing the keys or access the part of memory they're loaded into?
Re: 1Password for SSH and Git (Beta)
#130Earlier quoted context omitted.
What is the benefit over ssh-agent?
The cloud syncing, I suppose. If you migrate devices frequently and have more than a single ssh key, it might make sense to log into 1Password instead of trying to securely copy your private key from one device to another. It does seem like a weirdly specific use-case. I wonder if they're trying to instead target people who need to use ssh keys but aren't comfortable generating or managing them on the command line. W…
But don't you restore a backup from iCloud whenever you get a new laptop anyway? And by device I don't think you mean an iPhone.