Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

351–360 of 406 posts

Re: 1Password for SSH and Git (Beta)

#351

Post by hamandcheese »

bityard wrote: post #154
Androider wrote: post #98

Earlier quoted context omitted.

Where is the ssh-agent reading your private key from? If from ~/.ssh/, you're just one "npm install" away from the key being exfiltrated by a compromised package. If the private key is on your Yubikey, you're already good. The 1password agent will provide a good hardwareless method of keeping your private keys off the local filesystem, and it'll sync between your devices too.

> you're just one "npm install" away from the key being exfiltrated It's not as easy as that if your private key is protected with a passphrase, which IMO ought to be the default option. I am amused by the rationalization going on here, though... taking extra steps to secure your SSH private key because you might "npm install" something bad. There's nothing wrong with enhancing the security of your private keys throu…

> just don't run "npm install" (or similar untrusted code) in an environment that you don't want to get pwned.

So it is unreasonable to want to develop a JS app on the same machine I use for SSH?

Docker works I guess, but adds a lot of mental (and in the case of Docker for Mac, performance) overhead.

Re: 1Password for SSH and Git (Beta)

#352

Post by tgamma »

roustem wrote: post #347
roustem wrote: post #320

Earlier quoted context omitted.

Thank you for the feedback! We spoke about it internally many times in the past but couldn't get the solution implemented because there was always something in the way. After reading your comments and I talked to the team and we just merged a change that should appear in the nightly build and make the handling of the multi-line fields better. Having a single core in 1Password 8 makes things so much easier when it com…

Just wanted to add that the nightly build 80600030 is now available. Would love if you could give it a try and see if the newly added textfields are working better for you?

Thank you so much! Works as expected, with a small caveat: note that only newly created text fields support multiline; text fields which have already been created with an older build than 80600030 seem to remain single line.

Re: 1Password for SSH and Git (Beta)

#353

Post by tgamma »

roustem wrote: post #175
Y-bar wrote: post #146

Earlier quoted context omitted.

From my own experience with Electron apps and 1Password beta a few months ago, putting resource usage aside (even if we should not): OS-native spell checking is missing. Lack of OS standard shortcuts. Everything is a single window. UX performance: lots of things has just a little bit longer.

We added spellcheck and text transformations options recently. Our team contributed a few patches to Electron to enable better macOS integration. For example: https://github.com/electron/electron/pull/32024 I believe the UX performance in 1Password 8 is better than any other app we built in the past: https://twitter.com/mitchchn/status/1491253916004147203?s=20 Would love to learn more about the standard shortcuts tha…

The first thing that I noticed and really bugs me is the absence of the alt key to quickly reveal the password.

Re: 1Password for SSH and Git (Beta)

#354

Post by thamer »

throwanem wrote: post #341
jaboutboul wrote: post #202

Earlier quoted context omitted.

1Password already has this…

Judging by both the GP's not having been aware of it, and the process described in a sibling comment [1], I suspect the feature has a discoverability problem. (Does the same feature exist on mobile? How are file attachments represented on mobile?) [1] https://news.ycombinator.com/item?id=30365088

The feature exists on mobile, there's a "Related items" section that has a list of file names with a ">" caret next to each one. If you tap on an entry it opens in a new page where you can tap "View document" to see its contents. You can also see when it was created and updated, share it, add tags to it, add it your favorites, and more.

It works perfectly fine, with no missing features. I use it to store private keys and recovery codes, mainly.

Re: 1Password for SSH and Git (Beta)

#355

Post by hobobaggins »

nijave wrote: post #103
chiefalchemist wrote: post #87

Earlier quoted context omitted.

Not really. What is the case for not using well vetted best practices and replacing those with an unvetted proprietary solution? What problems does 1PW solve that necessitates taking on such risk? We're not talking about social media PWs. ssh keys are not something to add risk to, eh.

1Password is used at a lot of medium-small businesses where employees have shared credentials (usually these smaller businesses don't have built-out identity management systems to cover everything with SSO). A place I worked before would store SSH keys for build machine base images (AWS AMIs) in 1Password. It wasn't worth the trouble trying to setup SSO since the machines rarely needed accessed and only by a handful…

Would that be a good use case for something like Userify, so that there's no need to store any keys in a base image/AMI where they can't be easily updated/removed? Then you don't need to give your private keys to a third party, either.

Re: 1Password for SSH and Git (Beta)

#356

Post by captn3m0 »

tialaramex wrote: post #342
captn3m0 wrote: post #18

Earlier quoted context omitted.

I'd love to, but I keep keys on my Yubikey - which only supports 1 auth key. Even using U2F for SSH keeps the same restrictions. And using a different yubikey for various services isn't ideal either. I have considered keeping encrypted keys in my password manager per-service, and decrypt+add them to my SSH agent when they're used to offer almost the same guarantees.

> Even using U2F for SSH keeps the same restrictions Er, what? The SSH keys are being generated the same way keys for web sites are under FIDO, which is to say they're random - your physical device has no idea how many keys you have, it couldn't mandate that there's only one key if it tried. It only knows how to tell if these are keys it made (otherwise presumably a different FIDO authenticator made them) and if so u…

That makes sense. I need to try U2F for SSH more thoroughly I guess.

Re: 1Password for SSH and Git (Beta)

#357

Post by [deleted] »

culturestate wrote: post #92
chiefalchemist wrote: post #87

Earlier quoted context omitted.

Not really. What is the case for not using well vetted best practices and replacing those with an unvetted proprietary solution? What problems does 1PW solve that necessitates taking on such risk? We're not talking about social media PWs. ssh keys are not something to add risk to, eh.

> We're not talking about social media PWs. ssh keys are not something to add risk to, eh. I mean, 1Password already stores my credentials for the AWS console, Cloudflare, Netlify, GitHub, et al . I’m not sure adding my commit keys to that pile is dramatically increasing my exposure.

[deleted]

Re: 1Password for SSH and Git (Beta)

#358

Post by riverdroid »

aetherspawn wrote: post #338
roustem wrote: post #320

Earlier quoted context omitted.

Thank you for the feedback! We spoke about it internally many times in the past but couldn't get the solution implemented because there was always something in the way. After reading your comments and I talked to the team and we just merged a change that should appear in the nightly build and make the handling of the multi-line fields better. Having a single core in 1Password 8 makes things so much easier when it com…

Amazing, I wanted this too. Thank you. 1Password has literally blown me away every second that I've used it. And the ability to sync MFA between all your devices was the push that I needed to start using MFA. I do have a feature request though - any chance we could lock our 1Password wallet using 2FA with SMS (like Office365 or banks) rather than a device authentication key? Main concern is that personal devices are…

SMS is not strong enough, especially for protecting ALL of your 2FA codes + passwords. SIM swapping attacks frequently occur, and it doesn't even have to be with your carrier.

Re: 1Password for SSH and Git (Beta)

#359

Post by hobobaggins »

yabones wrote: post #95
emptybottle wrote: post #81

Earlier quoted context omitted.

What is the benefit over ssh-agent?

Other commenters have mentioned sync, which is absolutely nice, but one other advantage is shared keys. Obviously it's not ideal to share SSH keys, but lots of teams will share the default EC2 keypair for example. This makes it much easier to pop that key into 1Pass, share it with the team, and easily get everyone into the box. And, frankly, 1Password gui is much more user-friendly than other SSH agents. Personally,…

Has anyone compared the new 1password GUI for ssh keys to the Userify one, esp for a team? The userify one is only for SSH keys, but it seems great for safely managing public keys and leaving the private keys safe on our dev laptops (you can put in more than one key so a user can just disable one key at a time, and then it also has a great feature of actually killing all remote sessions when you remove the user account across all the servers -- haven't seen anything else that can do that.) The UI is perhaps a bit simplistic but it seems to do the job.
Post reply on HN