Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

71–80 of 406 posts

Re: 1Password for SSH and Git (Beta)

#71

Post by sroussey »

Nextgrid wrote: post #38
snide wrote: post #17

Earlier quoted context omitted.

I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on m…

With Electron you're one XSS away from your entire password database being stolen.

This is not true (though was an issue around Electron 1.0)

Re: 1Password for SSH and Git (Beta)

#72

Post by tempay »

I'm quite excited about this as a potential way to avoid the problems that once a key is added to an agent any process can then use it. It looks like this prompts for permission for each process that wants to use the key, but then doesn't prompt again.[1] I've tried using various tools for this but they've always been too clunky. YubiKeys work well with their requirement to be physically touched, except you continuously have to press them when using git commands (multiple times if fetching many remotes).

I haven't been able to see anything about how this handles agent forwarding over SSH. Does anyone know?

[1] https://developer.1password.com/docs/ssh/agent/security

Re: 1Password for SSH and Git (Beta)

#73

Post by otterley »

snide wrote: post #17
tonyedgecombe wrote: post #3

>Set up the 1Password 8 desktop app That will be the Electron version. No thanks.

I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on m…

Memory is a precious resource. Every additional Electron app that’s running increases the likelihood that your system will have to swap, and then it will feel like a a turtle in a tarpit. Also, there’s some concern that continuous swapping prematurely ages SSDs, reducing the overall lifetime of laptops. The modern trend is to solder storage chips directly to the main board, making them difficult to replace.

Re: 1Password for SSH and Git (Beta)

#74

Post by otabdeveloper4 »

Galanwe wrote: post #46
gspr wrote: post #42

Earlier quoted context omitted.

Because the idea of shipping a goddamn browser for each and every little GUI app is revolting and disturbing. What other crazy decisions have these people made?!

How is it different than using a GUI framework like Qt or GTK?

If each app bundled its own build of Qt then it wouldn't be.

Re: 1Password for SSH and Git (Beta)

#75

Post by sbarre »

bvm wrote: post #60
trabant00 wrote: post #20

My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities? And why would I replace the openssh agent with 1password agent? They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cl…

> that has had multiple recent serious vulnerabilities? has it? could you detail them, i'm OOTL.

Yeah I'm also curious about this rather bold yet detail-free statement..

https://www.cvedetails.com/vulnerability-list/vendor_id-1255...

I see only one CVE from 2018. But I am not an expert in these circles, so would also love to know more.

Re: 1Password for SSH and Git (Beta)

#76

Post by detaro »

tzs wrote: post #59
trabant00 wrote: post #20

My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities? And why would I replace the openssh agent with 1password agent? They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cl…

EDIT: Never mind. I misread and thought he was talking about password managers in general, not specifically for public keys. > They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard? In the case of browsers cat and copy/paste is often more risky than having code such as a password manag…

... for public keys?

Re: 1Password for SSH and Git (Beta)

#77

Post by phantomathkg »

MrYellowP wrote: post #57

I still have no idea why people use these kinds of programs. I have no idea how companies managed to sell this security nightmare as a feature to actually serious people. A single point of failure. Yeah, great idea!

I still have no idea why people think password manager is not a good thing. Maybe you should read this?

https://www.troyhunt.com/password-managers-dont-have-to-be-p...

Re: 1Password for SSH and Git (Beta)

#78

Post by cpach »

Saint_Genet wrote: post #50
yabones wrote: post #15

Ah neat, the app exposes an ssh agent socket: export SSH_AUTH_SOCK=~/.1password/agent.sock So you would essentially replace Keychain, Gnome-keyring, or the vanilla SSH-agent with 1password. Very nice solution.

Not really into replacing vetted, well tested open source software with a proprietary app with cloud storage.

To each their own.

Re: 1Password for SSH and Git (Beta)

#79

Post by judge2020 »

kitsunesoba wrote: post #69

Since krypto.co use case of SSH key handling fell to the wayside, I recently switched my keys over to Secretive[0], which stores keys in your Mac’s Secure Enclave or YubiKey and the case of the former, uses Touch ID to authorize use of your key. It’s very simple and works very well. Better than krypt.co did for me, actually — krypt.co would occasionally randomly break, but Secretive has been rock solid. Every time so…

Krypt pretty much works all the time for me, with the main reason I still use it being that WSL can't use the host OS's ssh-agent for logging in without aliasing ssh to ssh.exe. That and the Windows ssh agent itself can't use native Windows Hello APIs[0] to have an experience similar to secretive on Mac where the keys never leave the device and are protected by the secure processor in the device.

0: https://github.com/PowerShell/Win32-OpenSSH/issues/1804#issu...

Re: 1Password for SSH and Git (Beta)

#80

Post by maccard »

trabant00 wrote: post #20

My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities? And why would I replace the openssh agent with 1password agent? They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cl…

> Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities?

Can you share some info on those serious vulnerabilities?

> They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard?

So they don't offer any additional functionality except for the functionality that you don't think is worth it?

Post reply on HN