Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

301–310 of 406 posts

Re: 1Password for SSH and Git (Beta)

#301

Post by WhyNotHugo »

Androider wrote: post #98
emptybottle wrote: post #81

Earlier quoted context omitted.

What is the benefit over ssh-agent?

Where is the ssh-agent reading your private key from? If from ~/.ssh/, you're just one "npm install" away from the key being exfiltrated by a compromised package. If the private key is on your Yubikey, you're already good. The 1password agent will provide a good hardwareless method of keeping your private keys off the local filesystem, and it'll sync between your devices too.

> If the private key is on your Yubikey, you're already good.

This is the way.

Re: 1Password for SSH and Git (Beta)

#302

Post by mwarkentin »

saturn_vk wrote: post #299
cmckn wrote: post #243

Earlier quoted context omitted.

This is weird, I legitimately have none of these problems. I use Firefox, and the extension story has gotten a bit more odd in the last couple years*, but I don’t feel it’s any less reliable. The way 1p handles 2FA is really slick in my opinion, auto-filling the code after a login screen and even hitting return for me most of the time. Honestly the only rough edge I hit is when browsers try to force their own passwor…

Isn't storing passwords island 2fa in the same place a bad idea?

It's not as strong as storing them in an entirely separate device (although hardware keys are even better).. however I suspect most people would have their 2fa generator in the same place as 1password (eg. Google Authenticator on the same phone).

It still provides improved security in case of things like server-side credential breaches.

They discussed it on their blog here: https://blog.1password.com/totp-and-1password/#totp-isnt-the...

Re: 1Password for SSH and Git (Beta)

#303

Post by dasil003 »

PragmaticPulp wrote: post #178
dasil003 wrote: post #153

Earlier quoted context omitted.

Frankly I'd rather pay for 1Password sync that have Dropbox installed on my machines anymore with all the low-level hackery and product shenanigans they've pulled as the internal pressure to "innovate" and move up market has taken hold. I'm also worried about 1Password in the long-term with this recent VC investment which likely will create the same kind of pressures, but for now they still have the best product in t…

That's reasonable if you don't already pay for any cloud synchronized storage solution. But many of us already pay for cloud file syncing across our devices and 1Password's previous solution worked just fine. Having it removed so they can charge their SaaS fees feels like a blatant worsening of the product.

"Blatant worsening" is overstating the case a bit IMHO.

I understand how you could object to the pricing model. I understand if 1Password sync works worse than whatever file sync you have (in my experience it's been better than Dropbox but YMMV).

However I don't think a unified data sync that all your apps plug into is some kind of unassailable product high ground. The tradeoffs for this are numerous and not always good, starting with the basic limitation that you now have a single type of sync semantics that operates at file granularity and can not optimize for the domain. Personally I don't see the huge value of having an encrypted binary blob syncing through my one-true-sync-solution—what am I gonna do with that file outside of 1Password anyway? To take some other examples I am perfectly happy to let Apple sync my Contacts and Google sync my calendar and email, and I don't object to paying for those things if they bring me significant value. It's not like I have 100 SaaS subscriptions, but 10-20 sure, and I'm happy to pay a fraction of what I pay to heat my house or streaming subscriptions in order to support solid development and maintenance of a handful of critical apps and services I use.

Re: 1Password for SSH and Git (Beta)

#304

Post by otterley »

TameAntelope wrote: post #294
otterley wrote: post #291

Earlier quoted context omitted.

First, average primary system memory in a typical laptop does not double every two years. Growth of average installed memory has been linear, not exponential (see, e.g., https://techtalk.pcmatic.com/research-charts-memory/ ). Second, even if it did grow, software can consume memory faster than it can be provisioned; there's no law that prevents software developers from writing software that utilizes an arbitrary amou…

Aaand now you've gone on to dispute Moore's Law, as if the specificity of the "two years" part was at all critical or even important to our conversation. Also, that link you provided seriously undercuts your own argument, you do realize that right? It very clearly shows how over 90%+ of computers have 4 GB or more of memory installed, which is plenty to run multiple Electron apps.

I encourage you to read my argument from the top again. I speak in terms of probabilities, not absolutes. I don't disagree that many people might not notice performance degradation when running multiple Electron apps. However, it is an incontrovertible fact that (all other things being equal) an Electron app will consume more memory than a native app will; and some people will experience swapping and reduced performance when running Electron apps where they might not experience that if they were solely running native apps instead. Also, it's important to keep in mind that people often run a healthy mix of apps at once--both native and Electron--and they'd have the ability to run more of them without risking swapping if they ran fewer Electron apps (again, all other things being equal). The closer you get to exhaustion, the more economy of consumption really matters.

I just can't see how this is that controversial a claim.

Re: 1Password for SSH and Git (Beta)

#305

Post by [deleted] »

otterley wrote: post #304
TameAntelope wrote: post #294

Earlier quoted context omitted.

Aaand now you've gone on to dispute Moore's Law, as if the specificity of the "two years" part was at all critical or even important to our conversation. Also, that link you provided seriously undercuts your own argument, you do realize that right? It very clearly shows how over 90%+ of computers have 4 GB or more of memory installed, which is plenty to run multiple Electron apps.

I encourage you to read my argument from the top again. I speak in terms of probabilities, not absolutes. I don't disagree that many people might not notice performance degradation when running multiple Electron apps. However, it is an incontrovertible fact that (all other things being equal) an Electron app will consume more memory than a native app will; and some people will experience swapping and reduced performa…

[deleted]

Re: 1Password for SSH and Git (Beta)

#306

Post by TameAntelope »

otterley wrote: post #304
TameAntelope wrote: post #294

Earlier quoted context omitted.

Aaand now you've gone on to dispute Moore's Law, as if the specificity of the "two years" part was at all critical or even important to our conversation. Also, that link you provided seriously undercuts your own argument, you do realize that right? It very clearly shows how over 90%+ of computers have 4 GB or more of memory installed, which is plenty to run multiple Electron apps.

I encourage you to read my argument from the top again. I speak in terms of probabilities, not absolutes. I don't disagree that many people might not notice performance degradation when running multiple Electron apps. However, it is an incontrovertible fact that (all other things being equal) an Electron app will consume more memory than a native app will; and some people will experience swapping and reduced performa…

What you have here is not a controversial claim. It's also not what you've been arguing until this moment, but for whatever reason you've softened your position substantially, now to the point of (IMO) banality.

What's controversial (because it's false) is the claim that, "Memory is a precious resource." That is not a true statement.

Re: 1Password for SSH and Git (Beta)

#307

Post by soheil »

lillecarl wrote: post #136
soheil wrote: post #129

Earlier quoted context omitted.

Why can the compromised package not also access wherever 1p is storing the keys or access the part of memory they're loaded into?

Because the keys never exist "on disk"? Why isn't every password manager pwned on every persons machine is what you're asking it seems.

No but what you seem to be saying is .ssh is pwned on every machine that doesn’t use a password manager.

Re: 1Password for SSH and Git (Beta)

#308

Post by leokennis »

DonHopkins wrote: post #186
terabytest wrote: post #167

Earlier quoted context omitted.

Could you share a little bit about what you'd want to use this for? (I'm part of the 1Password design team)

SSH keys have both a private and a public file. The private file is multi-line text. I don't like putting the private key in the notes field, because its name is still "notes" (but I'd prefer the label be the key's file name), it's actually markdown formatted text, not literal text, and what if I still want to write a note, but I've already used the notes field for the key? HTTPS certificates including multiple certi…

I don’t know your workflow or demands so maybe this is simplistic. But you can just drop any file over a 1Password entry and it gets attached to that entry.

So, if you have a .crt, .pfx, .txt or whatever, just attach it to the entry.

Re: 1Password for SSH and Git (Beta)

#309

Post by otterley »

TameAntelope wrote: post #306
otterley wrote: post #304

Earlier quoted context omitted.

I encourage you to read my argument from the top again. I speak in terms of probabilities, not absolutes. I don't disagree that many people might not notice performance degradation when running multiple Electron apps. However, it is an incontrovertible fact that (all other things being equal) an Electron app will consume more memory than a native app will; and some people will experience swapping and reduced performa…

What you have here is not a controversial claim. It's also not what you've been arguing until this moment, but for whatever reason you've softened your position substantially, now to the point of (IMO) banality. What's controversial (because it's false) is the claim that, "Memory is a precious resource." That is not a true statement.

We call memory a "precious resource" because it is often a fixed quantity in a given computer, and often the most expensive component after the display unit. Many laptops these days do not offer upgradeable memory, and even when they do, they often have very few slots in which to add it. So for many people, an upgrade involves an entire unit replacement at significant cost. I think most people understand this, so again, I don't see how it's particularly controversial.

Re: 1Password for SSH and Git (Beta)

#310

Post by yohannparis »

terabytest wrote: post #205
drcongo wrote: post #30

And yet we still can't use the keyboard to navigate to the `Generate Password` button like we could in every version of 1Password before the current one.

I work at 1Password. Could you tell me a little more about this? I tested this in the latest version of 1Password 8 and when I'm creating or editing a password, I see a "Generate Password" button pop up beneath the password field. I can access it by either pressing the down arrow or tab. Does this not work on your end?

1Password 8 is not the current version. On 1Password 7 on macOS, when the browser extension offers a "Generated Password" there is no way to configure how it is generated. You have to open the main app to create a new password.
Post reply on HN