Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

371–380 of 406 posts

Re: 1Password for SSH and Git (Beta)

#371

Post by otabdeveloper4 »

KyeRussell wrote: post #329
otabdeveloper4 wrote: post #191

Earlier quoted context omitted.

Hint, the server won't be the hostile party stealing your keys here. Neither will be your ISP.

Why be obtuse? Are you talking about compromising the client machine? In which case, you’ve already lost all your keys, and you’re relying on their passphrases being set.

I'm saying private keys are not more secure by default. If your development machine is compromised (which is really easy to do, BTW) they'll steal your keys and probably will have root on your servers and access to your github accounts.

Stealing passwords is much harder in comparison.

Re: 1Password for SSH and Git (Beta)

#372

Post by varenc »

tksb wrote: post #256
varenc wrote: post #222

Earlier quoted context omitted.

As one datapoint: I’ve used 1P for 11+ years, have over 1200 items in it, and I’ve literally never lamented the lack of multiline fields.

While I agree about the specific ask for multiline support (and the decade plus hourly usage of 1p), it's abundantly clear that things are slipping with regards to the core product. For awhile there were no public links to any downloadable desktop apps for macOS while they pushed web + subs + and the MAS version. These days I'm just delighted when 1password doesn't open a totally different browser when invoked from t…

Totally agree there are many other frustrating things with 1P. I’m still self-hosting my vault locally and I hate that someday they’re going to force me to switch to their cloud based options. Just on my list of issues lack of multiline support is near the bottom.

Re: 1Password for SSH and Git (Beta)

#373

Post by YATA0 »

KyeRussell wrote: post #327
YATA0 wrote: post #271

And here I am, logging into Linux boxes without entering passwords nor SSH keys thanks to the magic known as Kerberos. Open up my corporate laptop and login with my smart card and username/pass combo, then I can just log into any Linux machine I have authorization (group permissions) to. Been doing it this way for over a decade at this rate. It's like all of these password manager tools were created by people who've…

Lol. Kerberos? Smart cards!? What if I have less than a full team of full time employees able to be put aside to implement a solution? I, as a developer, could integrate 1Password’s solution in my org in an afternoon. Enterprise tooling isn’t for everybody. That approach is what gave us the needless proliferation of Kubernetes.

>Kerberos?

Yes?

>Smart cards!?

Yes!? Or a YubiKey.

>What if I have less than a full team of full time employees able to be put aside to implement a solution?

This used to be something a middling UNIX sysadmin could configure and manage. You can also pay for someone to help you implement/manage a solution for this. Though I admit it may be overkill.

Re: 1Password for SSH and Git (Beta)

#374

Post by drcongo »

terabytest wrote: post #205
drcongo wrote: post #30

And yet we still can't use the keyboard to navigate to the `Generate Password` button like we could in every version of 1Password before the current one.

I work at 1Password. Could you tell me a little more about this? I tested this in the latest version of 1Password 8 and when I'm creating or editing a password, I see a "Generate Password" button pop up beneath the password field. I can access it by either pressing the down arrow or tab. Does this not work on your end?

macOS, 1Password 7, try this: Hit Cmd+Alt+\ and try to tab to the Generate Password button in the top right of that window that pops up. This was possible in earlier 1Password, isn't now. Tabbing moves you between the left pane list of suggestions etc. and the right pane. If there's something in the right pane, you can arrow through them, there's no way to get to the Generate Password button without taking your hands off the keyboard.

Additionally, now when I do generate a password, it saves that password in my shared vault for all the world to see instead of defaulting to a private vault where only I can see it. It doesn't appear to be possible to tell it where to save that password until it becomes a login, but by that point 1Password has already leaked the password I just generated. That seems like a really terrible default, and the only way I've found around this so far is to try to remember to open the main app, go into my shared vault and delete the password that I never wanted saved in there in the first place.

Re: 1Password for SSH and Git (Beta)

#375

Post by gspr »

aniforprez wrote: post #93
gspr wrote: post #42

Earlier quoted context omitted.

Because the idea of shipping a goddamn browser for each and every little GUI app is revolting and disturbing. What other crazy decisions have these people made?!

I seriously don't understand making blanket statements like this All this fearmongering made me properly look at and note the memory usage of the native windows app and then the electron app after I upgraded. The new app uses a whopping 50MB more when the desktop app is open and uses 10MB less when it's not People keep ranting and raving about this with no context and zero research. I'm sick of this especially on HN

It's not about the memory use. It's about the insane complexity.

An old grandma is looking for a little city car to take her to the neighborhood store. Solution: Use an Airbus A380. The fact that the engineers have made the plane weigh only 50 times as much as the city car is great, but it doesn't really change the fact that it's a crazy approach.

Re: 1Password for SSH and Git (Beta)

#376

Post by gspr »

Galanwe wrote: post #46
gspr wrote: post #42

Earlier quoted context omitted.

Because the idea of shipping a goddamn browser for each and every little GUI app is revolting and disturbing. What other crazy decisions have these people made?!

How is it different than using a GUI framework like Qt or GTK?

They solve the task at hand (cross-platform GUIs), plus some auxiliary tasks like cross-platform FS access etc etc. That's much cleaner and more principled than "screw it, let's ship a browser".

Re: 1Password for SSH and Git (Beta)

#377

Post by egberts1 »

judge2020 wrote: post #194
egberts1 wrote: post #132

Ummm, no. No need for even more in-between software prompting for passwords. I’m sticking with certificate+publickey SSH

The point behind all ssh-agents is to prevent any application with access to ~ being able to read your ssh key and exfiltrate it somewhere, or simply using it to drop malware on hosts listed in your ~/.bash_history. If it's in an agent and that agent requires user interaction before it performs SSH logins, you'll be made aware of the malicious activity.

And I keep my SSH agents entirely down and disabled too for many security reason.

Stick with the publickey and more so the SK certificates.

Each leg of the SSH hops should have their own set of SK certificates with their own distinctive SSH options.

Re: 1Password for SSH and Git (Beta)

#378

Post by tialaramex »

Yeri wrote: post #120
AlexandrB wrote: post #111

Earlier quoted context omitted.

> Other commenters have mentioned sync Isn't this an anti-feature? The ability to revoke an SSH key specific to a stolen laptop from a server or your Github account seems like a benefit. Using the same SSH key on every machine is a downgrade. On the other hand, the ability to manage access to shared keys is really nice.

I guess rotating one key is easier though. Just update in 1psw and done.

But why are you "rotating" keys? Most of the reasons people give involve unnecessary exposure of the private key material, which is exactly what you're encouraging by having 1password keep these keys instead of them living on individual hardware.

Re: 1Password for SSH and Git (Beta)

#379

Post by nijave »

hobobaggins wrote: post #355
nijave wrote: post #103

Earlier quoted context omitted.

1Password is used at a lot of medium-small businesses where employees have shared credentials (usually these smaller businesses don't have built-out identity management systems to cover everything with SSO). A place I worked before would store SSH keys for build machine base images (AWS AMIs) in 1Password. It wasn't worth the trouble trying to setup SSO since the machines rarely needed accessed and only by a handful…

Would that be a good use case for something like Userify, so that there's no need to store any keys in a base image/AMI where they can't be easily updated/removed? Then you don't need to give your private keys to a third party, either.

We didn't store keys in the AMI. We added the public half to EC2 then attached that key to the launch configuration where it gets added to the VMs authorized_keys on startup.

I don't think running a Userify daemon on the server is better than a private key in 1Password. At least with the private key approach, you can layer on network access restrictions (firewall rules or VPN). Userify would need to create an outbound connection to its control plane to manage keys

Re: 1Password for SSH and Git (Beta)

#380

Post by drcongo »

drcongo wrote: post #374
terabytest wrote: post #205

Earlier quoted context omitted.

I work at 1Password. Could you tell me a little more about this? I tested this in the latest version of 1Password 8 and when I'm creating or editing a password, I see a "Generate Password" button pop up beneath the password field. I can access it by either pressing the down arrow or tab. Does this not work on your end?

macOS, 1Password 7, try this: Hit Cmd+Alt+\ and try to tab to the Generate Password button in the top right of that window that pops up. This was possible in earlier 1Password, isn't now. Tabbing moves you between the left pane list of suggestions etc. and the right pane. If there's something in the right pane, you can arrow through them, there's no way to get to the Generate Password button without taking your hands…

Now that I think about it, I should Tell HN this second thing as it's potentially extremely serious for some users.
Post reply on HN