Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

161–170 of 406 posts

Re: 1Password for SSH and Git (Beta)

#161

Post by doliveira »

DonHopkins wrote: post #139

A huge problematic deficiency of 1Password is that it lacks literal multi-line text field types. The items in its database let you define custom fields for them, but there is no literal multi line text field. There's a "File" type, but you can't simply define fields with multi-line text values. However, every item has exactly one built-in "notes" field, but that's actually styled markdown text. And you only get one.…

Wow, I was thinking of leaving KeepassXC for 1password but that is very much a deal-breaker. The UI isn't as pretty or well-thought, of course, but at the very least there aren't as many limitations

Re: 1Password for SSH and Git (Beta)

#162

Post by zaik »

turboponyy wrote: post #51
trabant00 wrote: post #20

My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities? And why would I replace the openssh agent with 1password agent? They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cl…

cat key | xclip -selection clipboard # is even easier after you alias the second part (edit: or whatever the Wayland equivalent for xclip is)

wl-copy < key

Re: 1Password for SSH and Git (Beta)

#163

Post by ajnin »

ents wrote: post #16

For those not buying into 1password, what is the "correct" non-1password way to manage SSH keys?

I don't know is that's "correct" bit what I use is KeePass with the KeeAgent plugin, which acts as an SSH agent.

The keystore is stored on a nextcloud instance which allows to share the key easily between multiple hosts. It works flawlessly with git, ssh, also Windows tools like Putty will pick it up.

Re: 1Password for SSH and Git (Beta)

#164

Post by solarengineer »

DonHopkins wrote: post #147
wtetzner wrote: post #142

Earlier quoted context omitted.

I believe you can attach files, so that might be an option for keys/certs.

Have you tried actually using that in practice? It's extremely clumsy and inconvenient, requiring a whole lot more pointing and clicking and waiting and typing to attach the file, look at its contents, copy its value, or even edit it, than a simple multi-line text field would require. And in the common case that the text is only on my clipboard, for example if I copied it from a web page or shell, then I have to go t…

I store all my ssh keys as attachments. All my ssh keys are passphrase protected as well.

When I do download the keys, it isn’t much of an everyday activity either

I do not need to keep transferring ssh keys regularly to my Mac- it is either a one time or a set up related activity.

1Password is just fine for storing ssh keys as attachments.

Have you considered writing to them to ask for what you need?

Re: 1Password for SSH and Git (Beta)

#165

Post by DonHopkins »

doliveira wrote: post #161
DonHopkins wrote: post #139

A huge problematic deficiency of 1Password is that it lacks literal multi-line text field types. The items in its database let you define custom fields for them, but there is no literal multi line text field. There's a "File" type, but you can't simply define fields with multi-line text values. However, every item has exactly one built-in "notes" field, but that's actually styled markdown text. And you only get one.…

Wow, I was thinking of leaving KeepassXC for 1password but that is very much a deal-breaker. The UI isn't as pretty or well-thought, of course, but at the very least there aren't as many limitations

Unfortunately for me it was the kind of a thing that I didn't notice until I'd actually paid for a license and started using it. Then I tried to put my ssh public and private keys in there, and hit the wall.

It's such an obvious feature that would be so easy for them to implement, it made me feel like it must be possible and super-obvious to most people, but I was just too dumb to figure out how to do it.

(No, pressing shift-return in a single line text field doesn't work. And pasting multi-line text into a text field replaces newlines by spaces, thank you.)

Re: 1Password for SSH and Git (Beta)

#166

Post by staticassertion »

chiefalchemist wrote: post #87
cpach wrote: post #78

Earlier quoted context omitted.

To each their own.

Not really. What is the case for not using well vetted best practices and replacing those with an unvetted proprietary solution? What problems does 1PW solve that necessitates taking on such risk? We're not talking about social media PWs. ssh keys are not something to add risk to, eh.

Who says your best practices are well tested?

Re: 1Password for SSH and Git (Beta)

#167

Post by terabytest »

DonHopkins wrote: post #139

A huge problematic deficiency of 1Password is that it lacks literal multi-line text field types. The items in its database let you define custom fields for them, but there is no literal multi line text field. There's a "File" type, but you can't simply define fields with multi-line text values. However, every item has exactly one built-in "notes" field, but that's actually styled markdown text. And you only get one.…

Could you share a little bit about what you'd want to use this for? (I'm part of the 1Password design team)

Re: 1Password for SSH and Git (Beta)

#168

Post by minitoar »

terabytest wrote: post #167
DonHopkins wrote: post #139

A huge problematic deficiency of 1Password is that it lacks literal multi-line text field types. The items in its database let you define custom fields for them, but there is no literal multi line text field. There's a "File" type, but you can't simply define fields with multi-line text values. However, every item has exactly one built-in "notes" field, but that's actually styled markdown text. And you only get one.…

Could you share a little bit about what you'd want to use this for? (I'm part of the 1Password design team)

He already said. Private keys, certs, etc.

Re: 1Password for SSH and Git (Beta)

#169

Post by staticassertion »

Androider wrote: post #98
emptybottle wrote: post #81

Earlier quoted context omitted.

What is the benefit over ssh-agent?

Where is the ssh-agent reading your private key from? If from ~/.ssh/, you're just one "npm install" away from the key being exfiltrated by a compromised package. If the private key is on your Yubikey, you're already good. The 1password agent will provide a good hardwareless method of keeping your private keys off the local filesystem, and it'll sync between your devices too.

Your ~/.ssh/ private key is not readable by normal users since it's encrypted, so that isn't going to work.

The main security benefit is here:

> 1Password will ask for your consent before an SSH client can use your SSH key. Because of this, there's no concept of adding or removing keys like with the OpenSSH agent.

This prevents SSH agent hijacking, requiring either a social engineering attack to bypass or a privesc.

Post reply on HN