Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

401–406 of 406 posts

Re: 1Password for SSH and Git (Beta)

#401

Post by gunapologist99 »

nijave wrote: post #400
gunapologist99 wrote: post #387

Earlier quoted context omitted.

The Userify daemon in this case is just a shell or python script ( https://github.com/userify/shim ) so pretty simple to audit.

Sure but it's still reaching out to a cloud service for auth info. You swap "someone could steal my private key from SaaS" with "someone could upload an additional key to SaaS" which I guess just helps if you're reusing keys for unrelated systems? I think Userify could potentially increase auditability by limiting key sharing but I don't see it actually increasing security assuming you can revoke/rotate shared keys.

Well, rather than have my private key stored in a remote repository, I upload only my public key to Userify, and that shim thing automatically distributes my public key to the authorized_keys file in my homedir, exactly in the same way as if I was doing it by hand.

If 1Password was ever compromised, the attacker could use my private key to log into any server that I have access to at any time forever, and in fact I won't even know! But, if Userify is compromised, then the attacker can only deploy their OWN public key but my private key is still safe.

This means that if 1Password is compromised, ALL private keys are compromised forever. If Userify is compromised, the compromise only lasts for as long as the attacker is actually logged in as you, and the prize for the attacker isn't getting your key (because it's public already), but only that they can deploy their own public key (and that produces a notification).

So, you're right in that you still have to place some degree of trust in a third party SaaS, but the simplicity of Userify's model and narrow scope which minimizes access to any secret material is very appealing because it's very easy to understand and audit. Userify is about as close to Zero Knowledge as you can get for an SSH connection.

And, if that's not enough, I can just buy my own Userify Express server and close it off on my own private Wireguard network or VPC and never let the outside world anywhere near it.

Re: 1Password for SSH and Git (Beta)

#402

Post by MrYellowP »

sbarre wrote: post #66
MrYellowP wrote: post #57

I still have no idea why people use these kinds of programs. I have no idea how companies managed to sell this security nightmare as a feature to actually serious people. A single point of failure. Yeah, great idea!

Genuinely curious, where do you store your passwords and sensitive info like SSH keys? I hear a lot of "cloud password managers are bad!" but I rarely see someone follow up with a better approach. Even better to them. I've been using a password manager for years and I've always thought I was making a good decision but then I see all these comments and I wonder if I'm missing something.

I don't store them anywhere. I don't need to remember my passwords, they're the results of functions based on logical deduction and observation within the context of the "thing" I need the password for.

And my passwords are all, without exception, beyond 10 characters.

Re: 1Password for SSH and Git (Beta)

#403

Post by MrYellowP »

karmajunkie wrote: post #152
sbarre wrote: post #66

Earlier quoted context omitted.

Genuinely curious, where do you store your passwords and sensitive info like SSH keys? I hear a lot of "cloud password managers are bad!" but I rarely see someone follow up with a better approach. Even better to them. I've been using a password manager for years and I've always thought I was making a good decision but then I see all these comments and I wonder if I'm missing something.

You're not missing anything—some people just like to grumble. I've never seen anyone come up with a reasonable alternative that isn't "rely on your own faulty memory."

Okay, so you're an asshole. Let's set this straight.

I don't store my passwords anywhere. I don't need to remember my passwords, they're the results of functions based on logical deduction and observation within the context of the "thing" I need the password for.

And my passwords are all, without exception, beyond 10 characters.

Re: 1Password for SSH and Git (Beta)

#404

Post by nijave »

gunapologist99 wrote: post #401
nijave wrote: post #400

Earlier quoted context omitted.

Sure but it's still reaching out to a cloud service for auth info. You swap "someone could steal my private key from SaaS" with "someone could upload an additional key to SaaS" which I guess just helps if you're reusing keys for unrelated systems? I think Userify could potentially increase auditability by limiting key sharing but I don't see it actually increasing security assuming you can revoke/rotate shared keys.

Well, rather than have my private key stored in a remote repository, I upload only my public key to Userify, and that shim thing automatically distributes my public key to the authorized_keys file in my homedir, exactly in the same way as if I was doing it by hand. If 1Password was ever compromised, the attacker could use my private key to log into any server that I have access to at any time forever , and in fact I…

>If 1Password was ever compromised, the attacker could use my private key to log into any server that I have access to at any time forever, and in fact I won't even know!

Right, this is only a problem if you don't have another form of key and don't have login auditing

With access to Userify, an attacker could upload a key to any server anywhere and still have access.

In the original post, I mentioned we already had an easy way to rotate keys via automation. We also had CloudTrail alerts and AWS Config alerts around port 22 security group rules (they were closed by default).

Sure Userify provides a lot of these things like key management and audit trails but my original point was it's silly to worry about storing private keys in SaaS when you use SaaS for other authentication and authorization anyway.

Re: 1Password for SSH and Git (Beta)

#405

Post by [deleted] »

somehnguy wrote: post #137
dangus wrote: post #119

Earlier quoted context omitted.

What features/usability/performance was lost with the switch to the Electron app? If the answer is "nothing," then really the argument is purely about aesthetics. I didn't even know it was an Electron app until months after I had installed it.

I was fully prepared to say 'memory usage' as a kneejerk to Electron. But I decided to open System Monitor real quick and it turns out my 1Password 7 instance is using 201MB itself. Another ~30MB if the helpers are included. My machine has been on for about a week and I invoke 1Password a lot throughout the day + have about 500 entries. How much memory is yours consuming (assuming you're using 8)?

[deleted]

Re: 1Password for SSH and Git (Beta)

#406

Post by lillecarl »

toyg wrote: post #340
lillecarl wrote: post #235

Earlier quoted context omitted.

Why? You don't have to use Electron for everything, you can integrate using whatever language you want and some RPC, like Keybase did.

And that's still more involved (and slower) than "just use this function that desktop vendors helpfully provided for the purpose".

That one part yes, but if you can build most of your application cross-platform and only do certain things with "native" solutions you might get better bang for the buck. Discord and VS Code comes to mind.
Post reply on HN