Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

151–160 of 406 posts

Re: 1Password for SSH and Git (Beta)

#151

Post by ossusermivami »

soheil wrote: post #129
Androider wrote: post #98

Earlier quoted context omitted.

Where is the ssh-agent reading your private key from? If from ~/.ssh/, you're just one "npm install" away from the key being exfiltrated by a compromised package. If the private key is on your Yubikey, you're already good. The 1password agent will provide a good hardwareless method of keeping your private keys off the local filesystem, and it'll sync between your devices too.

Why can the compromised package not also access wherever 1p is storing the keys or access the part of memory they're loaded into?

they would have access to the socket not the key, sure a very elaborated attack can probably figure out how to exfiltrate a lot of things (since they have already compromised the host) but for most, if they don't see things in ~/.ssh they would just go away and figure out another host to exfiltrate keys

Re: 1Password for SSH and Git (Beta)

#152

Post by karmajunkie »

sbarre wrote: post #66
MrYellowP wrote: post #57

I still have no idea why people use these kinds of programs. I have no idea how companies managed to sell this security nightmare as a feature to actually serious people. A single point of failure. Yeah, great idea!

Genuinely curious, where do you store your passwords and sensitive info like SSH keys? I hear a lot of "cloud password managers are bad!" but I rarely see someone follow up with a better approach. Even better to them. I've been using a password manager for years and I've always thought I was making a good decision but then I see all these comments and I wonder if I'm missing something.

You're not missing anything—some people just like to grumble. I've never seen anyone come up with a reasonable alternative that isn't "rely on your own faulty memory."

Re: 1Password for SSH and Git (Beta)

#153

Post by dasil003 »

Cthulhu_ wrote: post #109
rcarmo wrote: post #99

I'd rather use Secretive ( https://github.com/maxgoedjen/secretive ), to be honest. I've stopped using 1Password everywhere I can due to their product "focus", and am working my way through a set of alternatives (currently using Secrets on the Mac and looking at the KeePass ecosystem, which keeps improving monthly): https://taoofmac.com/space/apps/1password Edit: It's been fun watching this get upvoted and downvoted…

I started using it back when because it just worked and I could keep my passwords synced between devices (windows, iOS and Mac) via Dropbox. Before that I used KeePass, but its Linux and Android clients were terrible. I still have 1password 4 on Windows PC and (apparently) version 7 on Mac; they still work together, but I'm afraid at some point they will decide to drop support for dropbox and force you to use their s…

Frankly I'd rather pay for 1Password sync that have Dropbox installed on my machines anymore with all the low-level hackery and product shenanigans they've pulled as the internal pressure to "innovate" and move up market has taken hold.

I'm also worried about 1Password in the long-term with this recent VC investment which likely will create the same kind of pressures, but for now they still have the best product in the space by far and I'm in no hurry to switch to an inferior product in order to save $3/month.

Re: 1Password for SSH and Git (Beta)

#154

Post by bityard »

Androider wrote: post #98
emptybottle wrote: post #81

Earlier quoted context omitted.

What is the benefit over ssh-agent?

Where is the ssh-agent reading your private key from? If from ~/.ssh/, you're just one "npm install" away from the key being exfiltrated by a compromised package. If the private key is on your Yubikey, you're already good. The 1password agent will provide a good hardwareless method of keeping your private keys off the local filesystem, and it'll sync between your devices too.

> you're just one "npm install" away from the key being exfiltrated

It's not as easy as that if your private key is protected with a passphrase, which IMO ought to be the default option.

I am amused by the rationalization going on here, though... taking extra steps to secure your SSH private key because you might "npm install" something bad. There's nothing wrong with enhancing the security of your private keys through dongles or TPM chips but it's a lot better to attack the root of the problem: just don't run "npm install" (or similar untrusted code) in an environment that you don't want to get pwned.

My day job has me working with javascript packages but I don't have npm installed on my system, and never will. All of my work with npm happens inside docker containers. This offers many workflow advantages besides a layer of security.

Re: 1Password for SSH and Git (Beta)

#155

Post by zie »

ammmir wrote: post #9
nerdawson wrote: post #5

I’ve been treating SSH keys in the same way I would a password. Each service gets a new key generated for it. From doing some reading though it sounds like I might be wasting my time. Apparently it’s fine to have one key for an individual machine and to use that for everything. What’s everyone else’s take on that? Are you reusing a single key or generating each time?

default SSH key is the same one for GitHub (since they leak users’ pubkeys anyway), and private repos (eg. hosted GitLab instances) get their own keys. not really sure if it buys any privacy though.

Uh, "leak" is a strong word. They are PUBLIC keys, to think of them as anything other than public is your mental block. If you share your public key with someone, expect them to publish it publicly.

Try thinking of SSH pub keys as identities or usernames and you are more on the right track.

I tend to have 1 pubkey per thing I care about, so 1 per github account, 1 per gitlab account, 1 for work, etc.

Re: 1Password for SSH and Git (Beta)

#156

Post by roustem »

jolux wrote: post #122
Cthulhu_ wrote: post #110

Earlier quoted context omitted.

I have pretty high confidence in 1password's security, because it's a very attractive target for both security researchers and malicious actors. I just hope they have a decent and fair bug bounty program.

https://bugcrowd.com/agilebits

Also, 1Password security audits: https://support.1password.com/security-assessments/

Re: 1Password for SSH and Git (Beta)

#157

Post by burnte »

the_arun wrote: post #133
rcarmo wrote: post #99

I'd rather use Secretive ( https://github.com/maxgoedjen/secretive ), to be honest. I've stopped using 1Password everywhere I can due to their product "focus", and am working my way through a set of alternatives (currently using Secrets on the Mac and looking at the KeePass ecosystem, which keeps improving monthly): https://taoofmac.com/space/apps/1password Edit: It's been fun watching this get upvoted and downvoted…

1Password cloud product is kinda expensive. $19.99 per month. I didn't see a free option for personal use. Is there a way I could use this on my devices with my own cloud setup (eg. dropbox/google drive/ etc.,)?

Did you mistype $2.99? Because it's $2.99 for one person. The $19.99 is for ten team members using the business product. A family of 5 gets it for $5 per month.

Re: 1Password for SSH and Git (Beta)

#158

Post by xfer »

TameAntelope wrote: post #115
otterley wrote: post #73

Earlier quoted context omitted.

Memory is a precious resource. Every additional Electron app that’s running increases the likelihood that your system will have to swap, and then it will feel like a a turtle in a tarpit. Also, there’s some concern that continuous swapping prematurely ages SSDs, reducing the overall lifetime of laptops. The modern trend is to solder storage chips directly to the main board, making them difficult to replace.

Memory is not a precious resource, this narrative needs to die an unceremonious death. This isn't the 90s, we live in the future.

Then why is your cloud provider charging by GB-secs? This is the future after all.

Re: 1Password for SSH and Git (Beta)

#159

Post by xeromal »

the_arun wrote: post #133
rcarmo wrote: post #99

I'd rather use Secretive ( https://github.com/maxgoedjen/secretive ), to be honest. I've stopped using 1Password everywhere I can due to their product "focus", and am working my way through a set of alternatives (currently using Secrets on the Mac and looking at the KeePass ecosystem, which keeps improving monthly): https://taoofmac.com/space/apps/1password Edit: It's been fun watching this get upvoted and downvoted…

1Password cloud product is kinda expensive. $19.99 per month. I didn't see a free option for personal use. Is there a way I could use this on my devices with my own cloud setup (eg. dropbox/google drive/ etc.,)?

Strange. I think I pay 50-60 a year.

Re: 1Password for SSH and Git (Beta)

#160

Post by cytzol »

dangus wrote: post #119
trvr wrote: post #28

Earlier quoted context omitted.

I think a lot of the hate (myself included) is coming from the fact that we already had a really good native macOS app. Feels like something is being taken away. I do understand where you are coming from with Linux. It's better than what you had, no doubt. But that doesn't feel like the case to us macOS users.

What features/usability/performance was lost with the switch to the Electron app? If the answer is "nothing," then really the argument is purely about aesthetics. I didn't even know it was an Electron app until months after I had installed it.

I tried the Electron version six months ago, and I wrote up its weaknesses here: https://news.ycombinator.com/item?id=28147305

EDIT: I just tried the latest beta, and I'm happy to say that scrolling the list is now much faster! On the other hand, the blurry fonts, the lack of overscroll, the non-native dropdown menus, the inability to view your vault with the Preferences window open, and the lag when resizing the window are all still there. This does not fill me with hope that the final released version is going to be any better.

Post reply on HN