I just wish they would implement the ability to disable 1Password for certain domains or even just local host (talking about the browser extension here). There is a menu option in the right click menu but it only works for a short duration and isn’t configurable ahead of time.
1Password for SSH and Git (Beta)
381–390 of 406 posts
Re: 1Password for SSH and Git (Beta)
#382A huge problematic deficiency of 1Password is that it lacks literal multi-line text field types. The items in its database let you define custom fields for them, but there is no literal multi line text field. There's a "File" type, but you can't simply define fields with multi-line text values. However, every item has exactly one built-in "notes" field, but that's actually styled markdown text. And you only get one.…
Could you share a little bit about what you'd want to use this for? (I'm part of the 1Password design team)
Also for storing backup keys.
Re: 1Password for SSH and Git (Beta)
#383Earlier quoted context omitted.
Why be obtuse? Are you talking about compromising the client machine? In which case, you’ve already lost all your keys, and you’re relying on their passphrases being set.
I'm saying private keys are not more secure by default. If your development machine is compromised (which is really easy to do, BTW) they'll steal your keys and probably will have root on your servers and access to your github accounts. Stealing passwords is much harder in comparison.
As an attacker, maybe true depending on your target. As a user I have had my passwords compromised many times. My SSH keys never have and I don’t know of any prominent evidence this happens much at all. I have been doing reversing, netsec, and appsec for 15 years now, so my memory goes back a ways. Plus, for example, my main system a Linux desktop. You can and should password protect your SSH keys, which further eliminates a number of key compromise scenarios.
Re: 1Password for SSH and Git (Beta)
#384Earlier quoted context omitted.
I guess rotating one key is easier though. Just update in 1psw and done.
But why are you "rotating" keys? Most of the reasons people give involve unnecessary exposure of the private key material, which is exactly what you're encouraging by having 1password keep these keys instead of them living on individual hardware.
Well keeps are also shared via chat or emails and people exit the company. Sure taking out one key is more precise but rotating all is probably easier
Re: 1Password for SSH and Git (Beta)
#385Earlier quoted context omitted.
But why are you "rotating" keys? Most of the reasons people give involve unnecessary exposure of the private key material, which is exactly what you're encouraging by having 1password keep these keys instead of them living on individual hardware.
Well keeps are also shared via chat or emails and people exit the company. Sure taking out one key is more precise but rotating all is probably easier
You may notice they aren't called "Fun size sharing keys" or "Family pack keys" but instead "Private keys" because of that word "Private".
You don't need to wait for people to "exit the company". Sharing private keys was wrong, invalidate those keys. If somebody else knows your private key it isn't private any more. Get this stuff right and rotating keys is unecessary, get it wrong and rotating keys can't help you.
Re: 1Password for SSH and Git (Beta)
#386Ahh, this is such a nice improvement over literally anything i've used for agent key management on Windows or Linux, and easily competes with using the Keychain integration available on OSX; It sucks that I can't really use the functionality due to the v8 requirement, and am once again in the position of paying for something where I don't get to actually use new and useful features due to really aggressive ( if not o…
I’m not sure your critique of v6 to v7 migration is fair. Im sure v6 continued to work fine on that old version of chrome. But it seems perfectly reasonable for developers to be compensated for writing new code to work with new versions with new requirements.
I also feel I should be realistic about the incentive structure. I want 1password to continually work on security, additional features, and quality of life stuff. That requires steady income.
As to your local vault concerns. I think you have a really valid point.
Re: 1Password for SSH and Git (Beta)
#387Earlier quoted context omitted.
Would that be a good use case for something like Userify, so that there's no need to store any keys in a base image/AMI where they can't be easily updated/removed? Then you don't need to give your private keys to a third party, either.
We didn't store keys in the AMI. We added the public half to EC2 then attached that key to the launch configuration where it gets added to the VMs authorized_keys on startup. I don't think running a Userify daemon on the server is better than a private key in 1Password. At least with the private key approach, you can layer on network access restrictions (firewall rules or VPN). Userify would need to create an outboun…
The Userify daemon in this case is just a shell or python script (https://github.com/userify/shim) so pretty simple to audit.
Re: 1Password for SSH and Git (Beta)
#388Earlier quoted context omitted.
Attaching files is the worst functionality of 1password. I put images of my health insurance card in 1pw. do this. now, pretend you want to upload those image to a web portal that's asking for your insurance information. To pretend, just try and put the images of your insurance card into an email body to yourself. See how many clicks it takes.
I find it to be a decent experience (and use it for exactly what you mentioned). Comparing the two methods I've personally used to store my insurance card below. What are you comparing to? 1Password: - Search - Click on the relevant entry - Click "Quick Look" - Click down menu - Click show in Finder - Drag onto upload form field Google Drive: - Search - Right click - Download - Right click on downloaded file botton -…
Ideally I should be able to copy things directly out of 1PW. right click, copy. Or the app should use a widget that supports click/drag.
It took me a while just to DISCOVER the steps to getting a file out of 1pw, which involved a lot of false starts into different menus/screens that allow you to view the file's metadata (or preview) without actually getting the file.
Considering "copy field" is THE main functionality of 1PW, it's absolutely insane you can't just copy a file field.
the comparison to me is having the file in my downloads/desktop, which is a very simple procedure to do, as many or fewer clicks, and is a well-worn path.
Re: 1Password for SSH and Git (Beta)
#389Earlier quoted context omitted.
Just wanted to add that the nightly build 80600030 is now available. Would love if you could give it a try and see if the newly added textfields are working better for you?
Thank you so much! Works as expected, with a small caveat: note that only newly created text fields support multiline; text fields which have already been created with an older build than 80600030 seem to remain single line.
Yes, it was the simplest change we could make. Hopefully it makes things better without breaking anything else
Re: 1Password for SSH and Git (Beta)
#390Earlier quoted context omitted.
Thank you for the feedback! We spoke about it internally many times in the past but couldn't get the solution implemented because there was always something in the way. After reading your comments and I talked to the team and we just merged a change that should appear in the nightly build and make the handling of the multi-line fields better. Having a single core in 1Password 8 makes things so much easier when it com…
Thank you, I really appreciate that, and it will save me and others a lot of time and effort! Spectacular turn-around. I'm looking forward to upgrading to 1Password 8. Please also put some love into the 1Password CLI utility "op" too, so it's safe and useful for unattended scripts.
Oh, if you are using CLI then you will love the new integration we are building in 1Password 8: https://developer.1password.com/docs/cli/use-biometric-unloc...