>Set up the 1Password 8 desktop app That will be the Electron version. No thanks.
It runs just fine.
1Password for SSH and Git (Beta)
21–30 of 406 posts
Re: 1Password for SSH and Git (Beta)
#22It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone.
This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single-factor + TOTP, where you previously had a phishing-resistant cryptographic protocol.
Is this really an improvement for security, or is it just a usability improvement (i.e. sync of keys) intended to work around policies trying to improve security (i.e. required use of keys)?
(The other option is I skimmed the docs badly and maybe I've misunderstood something, it's possible.)
Edit: I did skim the docs badly, it is possible to use a FIDO2/WebAuthN key for 2FA. https://support.1password.com/security-key/
Re: 1Password for SSH and Git (Beta)
#23I’ve been treating SSH keys in the same way I would a password. Each service gets a new key generated for it. From doing some reading though it sounds like I might be wasting my time. Apparently it’s fine to have one key for an individual machine and to use that for everything. What’s everyone else’s take on that? Are you reusing a single key or generating each time?
A mix. Typically I'll use one key per machine and add those keys in the places they need to be. This is good as you're reasonably well protected if that machine gets lost or stolen. The nature of public key cryptography means there's no risk associated with handing over your public key to many different places. However sometimes it's practical to use the same (private) key in multiple places. I do this for access to…
There is a slight risk - if someone has your public key they can setup a MITM server and pretend to be the one you’re expecting - and watch what you’re doing, or redirect test to production or similar.
It’s really very minor and ssh itself should warn that the servers fingerprint changed.
Re: 1Password for SSH and Git (Beta)
#24I’ve been treating SSH keys in the same way I would a password. Each service gets a new key generated for it. From doing some reading though it sounds like I might be wasting my time. Apparently it’s fine to have one key for an individual machine and to use that for everything. What’s everyone else’s take on that? Are you reusing a single key or generating each time?
I treat them as identities. Each identity gets it's own key and each identity may have access to numerous accounts. It's bad opsec to share keys between identities.
Re: 1Password for SSH and Git (Beta)
#25For those not buying into 1password, what is the "correct" non-1password way to manage SSH keys?
keyring?
Re: 1Password for SSH and Git (Beta)
#26Now would it be possible to make something like this for GPG?
A simple wrapper around pass might do the trick. Someone just needs to implement an agent that does this (tho I'm sure someone out there is working on it).
Re: 1Password for SSH and Git (Beta)
#27>Set up the 1Password 8 desktop app That will be the Electron version. No thanks.
From the article: "Our new 1Password apps are built in Rust..."
Maybe give this version a try then?
Re: 1Password for SSH and Git (Beta)
#28>Set up the 1Password 8 desktop app That will be the Electron version. No thanks.
I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on m…
I think a lot of the hate (myself included) is coming from the fact that we already had a really good native macOS app. Feels like something is being taken away. I do understand where you are coming from with Linux. It's better than what you had, no doubt. But that doesn't feel like the case to us macOS users.
Re: 1Password for SSH and Git (Beta)
#29>Set up the 1Password 8 desktop app That will be the Electron version. No thanks.
I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on m…
Apparently 1password is developed Linux-first now.
Re: 1Password for SSH and Git (Beta)
#30And yet we still can't use the keyboard to navigate to the `Generate Password` button like we could in every version of 1Password before the current one.