Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

131–140 of 406 posts

Re: 1Password for SSH and Git (Beta)

#131

Post by valenaut »

aniforprez wrote: post #93
gspr wrote: post #42

Earlier quoted context omitted.

Because the idea of shipping a goddamn browser for each and every little GUI app is revolting and disturbing. What other crazy decisions have these people made?!

I seriously don't understand making blanket statements like this All this fearmongering made me properly look at and note the memory usage of the native windows app and then the electron app after I upgraded. The new app uses a whopping 50MB more when the desktop app is open and uses 10MB less when it's not People keep ranting and raving about this with no context and zero research. I'm sick of this especially on HN

I don't have strong feelings about Electron, but 50MB more memory for the same functionality does seem like a lot. If every app I have open on my machine suddenly used 50MB more memory, it would be a noticeable hit.

Re: 1Password for SSH and Git (Beta)

#133

Post by the_arun »

rcarmo wrote: post #99

I'd rather use Secretive ( https://github.com/maxgoedjen/secretive ), to be honest. I've stopped using 1Password everywhere I can due to their product "focus", and am working my way through a set of alternatives (currently using Secrets on the Mac and looking at the KeePass ecosystem, which keeps improving monthly): https://taoofmac.com/space/apps/1password Edit: It's been fun watching this get upvoted and downvoted…

1Password cloud product is kinda expensive. $19.99 per month. I didn't see a free option for personal use.

Is there a way I could use this on my devices with my own cloud setup (eg. dropbox/google drive/ etc.,)?

Re: 1Password for SSH and Git (Beta)

#134

Post by bityard »

Cthulhu_ wrote: post #109
rcarmo wrote: post #99

I'd rather use Secretive ( https://github.com/maxgoedjen/secretive ), to be honest. I've stopped using 1Password everywhere I can due to their product "focus", and am working my way through a set of alternatives (currently using Secrets on the Mac and looking at the KeePass ecosystem, which keeps improving monthly): https://taoofmac.com/space/apps/1password Edit: It's been fun watching this get upvoted and downvoted…

I started using it back when because it just worked and I could keep my passwords synced between devices (windows, iOS and Mac) via Dropbox. Before that I used KeePass, but its Linux and Android clients were terrible. I still have 1password 4 on Windows PC and (apparently) version 7 on Mac; they still work together, but I'm afraid at some point they will decide to drop support for dropbox and force you to use their s…

I have been using KeePassXC on Linux for years, it works great.

On Android, you want KeePassDX which can be found on f-droid.

I have multiple keepass databases and keep them in sync with a self-hosted Nextcloud instance.

Re: 1Password for SSH and Git (Beta)

#135

Post by otterley »

TameAntelope wrote: post #115
otterley wrote: post #73

Earlier quoted context omitted.

Memory is a precious resource. Every additional Electron app that’s running increases the likelihood that your system will have to swap, and then it will feel like a a turtle in a tarpit. Also, there’s some concern that continuous swapping prematurely ages SSDs, reducing the overall lifetime of laptops. The modern trend is to solder storage chips directly to the main board, making them difficult to replace.

Memory is not a precious resource, this narrative needs to die an unceremonious death. This isn't the 90s, we live in the future.

Please elaborate to those of us who have actually experienced the “swap swamp” within the last year, in the 2020s, and who have enough systems knowledge to properly instrument this stuff. Are you gaslighting us?

Re: 1Password for SSH and Git (Beta)

#136

Post by lillecarl »

soheil wrote: post #129
Androider wrote: post #98

Earlier quoted context omitted.

Where is the ssh-agent reading your private key from? If from ~/.ssh/, you're just one "npm install" away from the key being exfiltrated by a compromised package. If the private key is on your Yubikey, you're already good. The 1password agent will provide a good hardwareless method of keeping your private keys off the local filesystem, and it'll sync between your devices too.

Why can the compromised package not also access wherever 1p is storing the keys or access the part of memory they're loaded into?

Because the keys never exist "on disk"? Why isn't every password manager pwned on every persons machine is what you're asking it seems.

Re: 1Password for SSH and Git (Beta)

#137

Post by somehnguy »

dangus wrote: post #119
trvr wrote: post #28

Earlier quoted context omitted.

I think a lot of the hate (myself included) is coming from the fact that we already had a really good native macOS app. Feels like something is being taken away. I do understand where you are coming from with Linux. It's better than what you had, no doubt. But that doesn't feel like the case to us macOS users.

What features/usability/performance was lost with the switch to the Electron app? If the answer is "nothing," then really the argument is purely about aesthetics. I didn't even know it was an Electron app until months after I had installed it.

I was fully prepared to say 'memory usage' as a kneejerk to Electron. But I decided to open System Monitor real quick and it turns out my 1Password 7 instance is using 201MB itself. Another ~30MB if the helpers are included. My machine has been on for about a week and I invoke 1Password a lot throughout the day + have about 500 entries.

How much memory is yours consuming (assuming you're using 8)?

Re: 1Password for SSH and Git (Beta)

#138

Post by maccard »

AndyMcConachie wrote: post #123
trabant00 wrote: post #20

My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities? And why would I replace the openssh agent with 1password agent? They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cl…

I have no idea why you're getting downvoted. I don't use 1password for anything and I don't recommend anyone use it for anything. I will never use a 3rd party service to manage my passwords or key phrases. And why in God's name are people generating SSH keys in the browser? The thought of using it for SSH or GitHub just sounds insane to me. And as you say it doesn't even really offer any benefit over cutting and past…

They're being downvoted for making unsubstantiated claims about security vulnerabilities, and for not understanding the benefits of avoiding copy+pasting.

> And as you say it doesn't even really offer any benefit over cutting and pasting from the CLI.

It saves you from the fact that every application on your system, and some browser extensions can read your clipboard silently with no way for you to know. It saves you from phishing attacks from gіthub.com (note the i is a cyrillic i), it saves you from misconfigured permissions on your ssh folder, and from any "nosey" pip/npm install scripts that you might run on your development machine. It also means you don't lose your ssh keys in the case of data failure.

Re: 1Password for SSH and Git (Beta)

#139

Post by DonHopkins »

A huge problematic deficiency of 1Password is that it lacks literal multi-line text field types.

The items in its database let you define custom fields for them, but there is no literal multi line text field. There's a "File" type, but you can't simply define fields with multi-line text values. However, every item has exactly one built-in "notes" field, but that's actually styled markdown text. And you only get one. And its name is always "notes".

It would obviously be extremely useful to be able to define an arbitrary number of arbitrarily labeled multi line text fields that are not interpreted as markdown text.

It boggles my mind that 1Password doesn't support this. What were they thinking??? It makes it a real pain in the butt to store ssh keys and certificates and a lot of other types of information in 1Password.

A single markdown "notes" field just doesn't cut it. It's not as if it's technically challenging or a security risk. It already has a "notes" field, so just turn off the "rich text" feature and allow me to make my own! I would have thought it was a pretty obvious and often requested feature, but as far as I can tell, it's impossible!

Post reply on HN