Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

61–70 of 406 posts

Re: 1Password for SSH and Git (Beta)

#61

Post by jbverschoor »

snide wrote: post #17
tonyedgecombe wrote: post #3

>Set up the 1Password 8 desktop app That will be the Electron version. No thanks.

I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on m…

Besides that it's bloated. I really don't want to have my passwords and keys managed by something that's built on a software supply chain, which is so prone to malicious attempts (npm packages). There are way too many deep dependencies and mini packages out there.

Re: 1Password for SSH and Git (Beta)

#62

Post by tempay »

bombcar wrote: post #23
fredley wrote: post #8

Earlier quoted context omitted.

A mix. Typically I'll use one key per machine and add those keys in the places they need to be. This is good as you're reasonably well protected if that machine gets lost or stolen. The nature of public key cryptography means there's no risk associated with handing over your public key to many different places. However sometimes it's practical to use the same (private) key in multiple places. I do this for access to…

There is a slight risk - if someone has your public key they can setup a MITM server and pretend to be the one you’re expecting - and watch what you’re doing, or redirect test to production or similar. It’s really very minor and ssh itself should warn that the servers fingerprint changed.

This shouldn't be possible for any server you've previously connected to. Each machine should have a unique "host key" and OpenSSH prints a very loud message and refuses to connect if it ever changes.

Re: 1Password for SSH and Git (Beta)

#64

Post by otabdeveloper4 »

api wrote: post #47
yabones wrote: post #15

Ah neat, the app exposes an ssh agent socket: export SSH_AUTH_SOCK=~/.1password/agent.sock So you would essentially replace Keychain, Gnome-keyring, or the vanilla SSH-agent with 1password. Very nice solution.

Doesn't this give 1Password root on the universe? That's a general theme I see with all this SSO stuff. You have a few companies with root on the universe. Am I weird that this concerns me?

No, you're not.

Re: 1Password for SSH and Git (Beta)

#65

Post by sbarre »

api wrote: post #47
yabones wrote: post #15

Ah neat, the app exposes an ssh agent socket: export SSH_AUTH_SOCK=~/.1password/agent.sock So you would essentially replace Keychain, Gnome-keyring, or the vanilla SSH-agent with 1password. Very nice solution.

Doesn't this give 1Password root on the universe? That's a general theme I see with all this SSO stuff. You have a few companies with root on the universe. Am I weird that this concerns me?

The data that 1Password stores on their end is encrypted with your personal passphrase. So they can't see it even if they want to.

Unless their local client was compromised (not impossible - but if your local is compromised you're in trouble regardless), even if someone hacked them and stole their data, they would not have your clear-text info.

It's everyone's choice to make but I am personally OK with this security/convenience trade-off.. It's "good enough" for me - mostly because I trust them to know how to do this better than I could - if it means I can manage all my passwords in one place and access them from any device.

1Password also has useful (to me) quality-of-life features like integration with HaveIBeenPwned, it can also show you re-used passwords, and if you store credit cards or other info, it will also tell you when they're about to expire etc..

Plus you can store any arbitrary metadata with any record, so I even use it to store non-sensitive, but still private, info associated with logins, docs, ID, etc..

Re: 1Password for SSH and Git (Beta)

#66

Post by sbarre »

MrYellowP wrote: post #57

I still have no idea why people use these kinds of programs. I have no idea how companies managed to sell this security nightmare as a feature to actually serious people. A single point of failure. Yeah, great idea!

Genuinely curious, where do you store your passwords and sensitive info like SSH keys?

I hear a lot of "cloud password managers are bad!" but I rarely see someone follow up with a better approach. Even better to them.

I've been using a password manager for years and I've always thought I was making a good decision but then I see all these comments and I wonder if I'm missing something.

Re: 1Password for SSH and Git (Beta)

#67

Post by teeray »

api wrote: post #47
yabones wrote: post #15

Ah neat, the app exposes an ssh agent socket: export SSH_AUTH_SOCK=~/.1password/agent.sock So you would essentially replace Keychain, Gnome-keyring, or the vanilla SSH-agent with 1password. Very nice solution.

Doesn't this give 1Password root on the universe? That's a general theme I see with all this SSO stuff. You have a few companies with root on the universe. Am I weird that this concerns me?

The intention of the user is to give them encrypted blobs of credentials that are useless to them. Those blobs are only decrypted locally. That distinguishes password managers from traditional SSO solutions where credentials are sent to a centralized system that grants authorization.

Re: 1Password for SSH and Git (Beta)

#68

Post by api »

sbarre wrote: post #65
api wrote: post #47

Earlier quoted context omitted.

Doesn't this give 1Password root on the universe? That's a general theme I see with all this SSO stuff. You have a few companies with root on the universe. Am I weird that this concerns me?

The data that 1Password stores on their end is encrypted with your personal passphrase. So they can't see it even if they want to. Unless their local client was compromised (not impossible - but if your local is compromised you're in trouble regardless), even if someone hacked them and stole their data, they would not have your clear-text info. It's everyone's choice to make but I am personally OK with this security/…

I am more concerned with the long term social and political implications of giving a small number of corporations elevated privileges (or the ability to obtain them easily) on everything in the world.

If the NSA asked for escrow or root everywhere people would freak out, yet central SSO mostly accomplishes the same thing and people are running toward it because convenience. Of course the same is true for surveillance. Private adtech does things with surveillance that would give people a heart attack if the NSA did it, and unlike the NSA they don't even pretend to be accountable to anyone we can elect.

(It's the same because governments can compel corporations under their jurisdiction and there isn't a ton a company can do about it.)

While some may find this debatable, I happen to think we just had a rather incompetent but still very concerning fascist coup attempt in the USA. Historically civilizations lose their collective minds periodically. Given that computing infrastructure is becoming the basis for virtually all communication and much of life, is it wise to centralize access control like this?

I feel like younger people of virtually all political stripes are just blithely unconcerned with this and assume "it can't happen here" or "that's something that happened back in the early 20th century but not anymore, we have totally solved stable government." I think that's incredibly naive.

Re: 1Password for SSH and Git (Beta)

#69

Post by kitsunesoba »

Since krypto.co use case of SSH key handling fell to the wayside, I recently switched my keys over to Secretive[0], which stores keys in your Mac’s Secure Enclave or YubiKey and the case of the former, uses Touch ID to authorize use of your key.

It’s very simple and works very well. Better than krypt.co did for me, actually — krypt.co would occasionally randomly break, but Secretive has been rock solid. Every time something tries to use your key you get a Touch ID prompt and a notification indicating what triggered it.

This 1Password feature looks nice, but I’m switching away when version 7 stops working. AgileBits just isn’t taking 1Password in a direction that’s appealing for me… they’re clearly more interested in corporate users than individuals, and in the pursuit of a one-size-fits-all-platforms UI they’re losing the attention to detail and polish that used to be a major selling point.

[0]: https://github.com/maxgoedjen/secretive

Re: 1Password for SSH and Git (Beta)

#70

Post by otabdeveloper4 »

bitexploder wrote: post #13
nerdawson wrote: post #5

I’ve been treating SSH keys in the same way I would a password. Each service gets a new key generated for it. From doing some reading though it sounds like I might be wasting my time. Apparently it’s fine to have one key for an individual machine and to use that for everything. What’s everyone else’s take on that? Are you reusing a single key or generating each time?

I use a handful of keys. Thing is, your secret is never shared with the server. Just the public key bits. Passwords are stored (hashed) on the services. Totally different threat models. With your public key the biggest risk is someone tracking what you are up to if they compromised multiple services/servers you use.

Not really. Do you think the ssh client machine is easier to secure than the ssh server? (It isn't.)
Post reply on HN