Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

241–250 of 406 posts

Re: 1Password for SSH and Git (Beta)

#241

Post by minimaul »

RubberShoes wrote: post #219

I have used 1pass for years. I think I bought my lifetime license sometime in 2014? I loved it and even advocated for our 2000+ company to adopt it back in 2018. I would say in the past 2-3 years it has slowly become an absolute nightmare. I do not recommend it to anyone anymore. They have somehow screwed up the very basic functionality of filling in passwords on any browser I try. They continue to shift features aro…

Honestly I find one of the biggest missteps for me is that they started injecting UI into the web page itself.

I'm sure it reqires less work from the locally installed app (and lets them do away with it altogether, even), but it creates issues - it obscures UI elements in the page with a hard to dismiss overlay (no obvious clickable way to do it) that fits below webpage UI elements when it's heuristics identify it as an appropriate field.

edit: plus I regularly find that when I try to fill form fields in Safari and Firefox that selecting the appropriate login and hitting autofill does absolutely nothing.

Re: 1Password for SSH and Git (Beta)

#242

Post by aprdm »

minimaul wrote: post #241
RubberShoes wrote: post #219

I have used 1pass for years. I think I bought my lifetime license sometime in 2014? I loved it and even advocated for our 2000+ company to adopt it back in 2018. I would say in the past 2-3 years it has slowly become an absolute nightmare. I do not recommend it to anyone anymore. They have somehow screwed up the very basic functionality of filling in passwords on any browser I try. They continue to shift features aro…

Honestly I find one of the biggest missteps for me is that they started injecting UI into the web page itself. I'm sure it reqires less work from the locally installed app (and lets them do away with it altogether, even), but it creates issues - it obscures UI elements in the page with a hard to dismiss overlay (no obvious clickable way to do it) that fits below webpage UI elements when it's heuristics identify it as…

Yes, I agree. It's a real pain in the ass. That and still not allowing to ignore localhost for password fields...

Re: 1Password for SSH and Git (Beta)

#243

Post by cmckn »

RubberShoes wrote: post #219

I have used 1pass for years. I think I bought my lifetime license sometime in 2014? I loved it and even advocated for our 2000+ company to adopt it back in 2018. I would say in the past 2-3 years it has slowly become an absolute nightmare. I do not recommend it to anyone anymore. They have somehow screwed up the very basic functionality of filling in passwords on any browser I try. They continue to shift features aro…

This is weird, I legitimately have none of these problems. I use Firefox, and the extension story has gotten a bit more odd in the last couple years*, but I don’t feel it’s any less reliable. The way 1p handles 2FA is really slick in my opinion, auto-filling the code after a login screen and even hitting return for me most of the time. Honestly the only rough edge I hit is when browsers try to force their own password management, and end up fighting with 1p for password generation, saving login details, etc.

* to expand on this, the model used to be a desktop app where the magic happened, plus a thin browser extension that hooked into the app. Now, there seems to be a lot more happening in the browser extension, which seems to talk to the cloud service and not directly to the desktop app. (Totally possible this is completely wrong, just my WAG)

Re: 1Password for SSH and Git (Beta)

#244

Post by qbasic_forever »

ents wrote: post #16

For those not buying into 1password, what is the "correct" non-1password way to manage SSH keys?

Look into SSH certificates if you control the server, it's much better than littering public keys everywhere: https://smallstep.com/blog/use-ssh-certificates/ Hashicorp's Vault provides a CA for SSH keys along with all kinds of other secrets and such, it's very commonly used in the industry.

Re: 1Password for SSH and Git (Beta)

#246

Post by markstos »

bityard wrote: post #154
Androider wrote: post #98

Earlier quoted context omitted.

Where is the ssh-agent reading your private key from? If from ~/.ssh/, you're just one "npm install" away from the key being exfiltrated by a compromised package. If the private key is on your Yubikey, you're already good. The 1password agent will provide a good hardwareless method of keeping your private keys off the local filesystem, and it'll sync between your devices too.

> you're just one "npm install" away from the key being exfiltrated It's not as easy as that if your private key is protected with a passphrase, which IMO ought to be the default option. I am amused by the rationalization going on here, though... taking extra steps to secure your SSH private key because you might "npm install" something bad. There's nothing wrong with enhancing the security of your private keys throu…

Even better is defense-in-depth. Do development in VMs AND don’t store your private SSH in plain text on your laptop.

Re: 1Password for SSH and Git (Beta)

#247

Post by aniforprez »

RubberShoes wrote: post #238
aniforprez wrote: post #233

Earlier quoted context omitted.

> the webpage attached to the original 'save login' prompt is not the one you are on - the auto popup underneath the login field has nothing to show and I cannot manually find and enter it Is it the same URL as what was saved in the login? If not, then this is intended behaviour to stop phishing attacks and has saved my butt several times. If the autofill doesn't work, either the website has changed the base URL, I'v…

To both your points - a great example is right here on HN. If I right click and go to 1pass, I no longer can open any mini window. I instead am given the option of Lock, Save Login, Help, or Hide on this page. Completely breaks my 5+ years of muscle memory to right click on a field and find what I need. Now if I open the browser extension in the top right, my Favorites are not my favorites...they're the favorites of…

Hmm yeah I'm really not sure what the issue is here. Maybe try contacting support on their forums if you've not already. I never really used the right click menu and never needed to so far since the suggestions have always worked so maybe there's some other problem you're facing

Re: 1Password for SSH and Git (Beta)

#248

Post by barkerja »

Saint_Genet wrote: post #50
yabones wrote: post #15

Ah neat, the app exposes an ssh agent socket: export SSH_AUTH_SOCK=~/.1password/agent.sock So you would essentially replace Keychain, Gnome-keyring, or the vanilla SSH-agent with 1password. Very nice solution.

Not really into replacing vetted, well tested open source software with a proprietary app with cloud storage.

They have a nice little tidbit on this: https://developer.1password.com/docs/ssh/agent/security

> The standard OpenSSH agent (ssh-agent) that comes preinstalled on most systems requires you to add keys to the agent (ssh-add) every time it launches. After you've added your keys, any process can use any SSH key that the OpenSSH agent is managing. It is then up to you to remove those keys when they're not needed anymore.

> The 1Password SSH agent uses a different approach. 1Password will ask for your consent before an SSH client can use your SSH key. Because of this, there's no concept of adding or removing keys like with the OpenSSH agent.

> When your turn on the SSH agent from the 1Password preferences or settings, every eligible key is automatically available to use for SSH, but your private keys will never be used without your consent.

Re: 1Password for SSH and Git (Beta)

#249

Post by rickosborne »

vngzs wrote: post #224

I think this is a bad idea for users. I don't think SSH keys are things you should share across machines in a password manager. If you have two devices, then you should have two keys (though this is the subject of some debate; see [0]). Using the 1Password SSH agent encourages people to have "one" SSH key across devices, which means that any leaks will disproportionately impact them. It's unfortunate, because there i…

> I don't think SSH keys are things you should share across machines in a password manager.

While I agree with the first half of your statement (don't share SSH keys), I cannot agree with the second (don't put SSH keys in a password manager).

For my home use of 1Password, I absolutely want to keep backups of my SSH keys in 1Password. Because, in general, there's exactly 1 SSH key which can get into my cloud instances, and I've had enough laptops die suddenly that I'm not willing to risk getting locked out by not having a backup.

You could say "well, just have a second device with backup keys" but again for home use, why would I buy another laptop just for that? Or maybe just "well keep an offline backup of your keys". Sure. In 1Password. Where I keep pretty much all of my sensitive credentials and info.

> Using the 1Password SSH agent encourages people to have "one" SSH key across devices, which means that any leaks will disproportionately impact them.

Eh. IMO, people who are inclined to use 1 key across machines are going to do it, no matter the process. I doubt this feature is going to make that any worse. But I guess we shall see.

Re: 1Password for SSH and Git (Beta)

#250

Post by RubberShoes »

TheRealDunkirk wrote: post #240
RubberShoes wrote: post #219

I have used 1pass for years. I think I bought my lifetime license sometime in 2014? I loved it and even advocated for our 2000+ company to adopt it back in 2018. I would say in the past 2-3 years it has slowly become an absolute nightmare. I do not recommend it to anyone anymore. They have somehow screwed up the very basic functionality of filling in passwords on any browser I try. They continue to shift features aro…

I'm just as frustrated, but given how convoluted and complicated web site authentication has become, I've blamed the web sites, not 1Password. They can't possibly be expected to handle every scenario that every major internet site comes up with, and festoons with trackers and ads and javascript malfeasance and second-factor redirects. I guess if you're right, and 1Password is, in fact, to blame for this mess, then yo…

That's a great point and something I was very okay with because I could still navigate 1pass to the necessary fields. Google broke the automatic user/pw/login flow years ago but being able to still manually right-click on the necessary account for each stage of the login was easy. This is no longer possible. The blank suggestions they shove underneath every available field breaks my ability to click something that the browser itself might have stored and never has what I need. I am back to copying and pasting from the app itself.
Post reply on HN