Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for SSH and Git (Beta)

developer.1password.com

Post reply on HN
Print view View original

91–100 of 406 posts

Re: 1Password for SSH and Git (Beta)

#91

Post by majkinetor »

judge2020 wrote: post #79
kitsunesoba wrote: post #69

Since krypto.co use case of SSH key handling fell to the wayside, I recently switched my keys over to Secretive[0], which stores keys in your Mac’s Secure Enclave or YubiKey and the case of the former, uses Touch ID to authorize use of your key. It’s very simple and works very well. Better than krypt.co did for me, actually — krypt.co would occasionally randomly break, but Secretive has been rock solid. Every time so…

Krypt pretty much works all the time for me, with the main reason I still use it being that WSL can't use the host OS's ssh-agent for logging in without aliasing ssh to ssh.exe. That and the Windows ssh agent itself can't use native Windows Hello APIs[0] to have an experience similar to secretive on Mac where the keys never leave the device and are protected by the secure processor in the device. 0: https://github.co…

Semi related, PRemoteM will maybe have in future Windows Hello:

https://github.com/VShawn/PRemoteM/issues/181

Re: 1Password for SSH and Git (Beta)

#92

Post by culturestate »

chiefalchemist wrote: post #87
cpach wrote: post #78

Earlier quoted context omitted.

To each their own.

Not really. What is the case for not using well vetted best practices and replacing those with an unvetted proprietary solution? What problems does 1PW solve that necessitates taking on such risk? We're not talking about social media PWs. ssh keys are not something to add risk to, eh.

> We're not talking about social media PWs. ssh keys are not something to add risk to, eh.

I mean, 1Password already stores my credentials for the AWS console, Cloudflare, Netlify, GitHub, et al. I’m not sure adding my commit keys to that pile is dramatically increasing my exposure.

Re: 1Password for SSH and Git (Beta)

#93

Post by aniforprez »

gspr wrote: post #42
snide wrote: post #17

Earlier quoted context omitted.

I don't get the hate on Electron. Is it often bloated? Yes, sure. Has it allowed some of these excellent third party apps to make the move to Linux? Absolutely. I've been utterly surprised and excited by how much better 1Password has gotten over the last two years on Linux. We're seeing real parity with the OSX side of the house. Would I love native apps? Again, sure. But I really don't care. It runs pretty fast on m…

Because the idea of shipping a goddamn browser for each and every little GUI app is revolting and disturbing. What other crazy decisions have these people made?!

I seriously don't understand making blanket statements like this

All this fearmongering made me properly look at and note the memory usage of the native windows app and then the electron app after I upgraded. The new app uses a whopping 50MB more when the desktop app is open and uses 10MB less when it's not

People keep ranting and raving about this with no context and zero research. I'm sick of this especially on HN

Re: 1Password for SSH and Git (Beta)

#94

Post by YPPH »

TehCorwiz wrote: post #82
sbarre wrote: post #65

Earlier quoted context omitted.

The data that 1Password stores on their end is encrypted with your personal passphrase. So they can't see it even if they want to. Unless their local client was compromised (not impossible - but if your local is compromised you're in trouble regardless), even if someone hacked them and stole their data, they would not have your clear-text info. It's everyone's choice to make but I am personally OK with this security/…

> The data that 1Password stores on their end is encrypted with your personal passphrase. For now. What happens when they eat enough of the market and displace enough other tools that the government says "Ok, now MitM the encryption." All they would need to do is push an update and re-encrypt the first time you unlock it. Now, this has always been true, but it's not on your servers and source repos yet, right now it'…

>And I copy and paste from my pw manager into my terminal when required

I hope no other apps are watching your clipboard.

Re: 1Password for SSH and Git (Beta)

#95

Post by yabones »

emptybottle wrote: post #81
yabones wrote: post #15

Ah neat, the app exposes an ssh agent socket: export SSH_AUTH_SOCK=~/.1password/agent.sock So you would essentially replace Keychain, Gnome-keyring, or the vanilla SSH-agent with 1password. Very nice solution.

What is the benefit over ssh-agent?

Other commenters have mentioned sync, which is absolutely nice, but one other advantage is shared keys.

Obviously it's not ideal to share SSH keys, but lots of teams will share the default EC2 keypair for example. This makes it much easier to pop that key into 1Pass, share it with the team, and easily get everyone into the box.

And, frankly, 1Password gui is much more user-friendly than other SSH agents. Personally, I'll stick with the tried and true OpenSSH agent, but I know many will be attracted by this feature.

Re: 1Password for SSH and Git (Beta)

#96

Post by kvnnews »

eloisius wrote: post #11
tiernano wrote: post #2

hmmm.... this could make me move from LastPass to 1Password... after krypt.co got bought by Akamai and discontinued work on their developer stuff, i have been looking for a better way of managing SSH keys... this might be it...

If you're considering a migration anyway, I recommend you give KeePassXC a try before paying for 1Password. It also serves as an SSH agent. I haven't upgraded 1Password since they became a subscription model, so I'm not sure how it stands now, but KeePassXC was an upgrade for me. The browser integration is more configurable and I have fewer instances of not being able to use the auto-sign in with certain sites. Stron…

I would second this. Keepass also has an ssh key agent plug-in which works great. I’d say it’s even better than the putty key agent since you are notified when keys are used.

Re: 1Password for SSH and Git (Beta)

#97

Post by Method5440 »

raverbashing wrote: post #45
irl_ wrote: post #22

It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone. This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single…

Whenever I hear "oh but this 2FA is vulnerable to phishing" then why did security people annoy everybody and pushed for it before considering this factor? I'm happy to use only a password for some sensitive things, because I can remember it. Of course security is a spectrum and 2fa does help for a lot of stuff. Especially against websites that don't know how to hash your passwords properly (usually the ones from wher…

I was going to comment something similar - I think the messaging around this needs to be more clear. It feels like I’ve been seeing serious security folk push the unqualified use of password managers for years now. Better hope granny never needs to use SSH.

Re: 1Password for SSH and Git (Beta)

#98

Post by Androider »

emptybottle wrote: post #81
yabones wrote: post #15

Ah neat, the app exposes an ssh agent socket: export SSH_AUTH_SOCK=~/.1password/agent.sock So you would essentially replace Keychain, Gnome-keyring, or the vanilla SSH-agent with 1password. Very nice solution.

What is the benefit over ssh-agent?

Where is the ssh-agent reading your private key from? If from ~/.ssh/, you're just one "npm install" away from the key being exfiltrated by a compromised package. If the private key is on your Yubikey, you're already good. The 1password agent will provide a good hardwareless method of keeping your private keys off the local filesystem, and it'll sync between your devices too.

Re: 1Password for SSH and Git (Beta)

#99

Post by rcarmo »

I'd rather use Secretive (https://github.com/maxgoedjen/secretive), to be honest.

I've stopped using 1Password everywhere I can due to their product "focus", and am working my way through a set of alternatives (currently using Secrets on the Mac and looking at the KeePass ecosystem, which keeps improving monthly):

https://taoofmac.com/space/apps/1password

Edit: It's been fun watching this get upvoted and downvoted in successive waves - for those who are curious, I suggest you check previous posts on 1Password and see if you can spot patterns in their advocates, since they were publicly called out on this a few times already (especially on Twitter).

Re: 1Password for SSH and Git (Beta)

#100

Post by electroly »

irl_ wrote: post #22

It looks like 2fa is not required for 1password, and also that even if you did enable 2fa you can only use TOTP. Both TOTP and passwords are vulnerable to phishing as there's no cryptographic protocol going on there, you are just typing in the numbers from your phone. This seems like an excellent way to ensure that you reduce the security of your SSH login to either having a single-factor (password) or at best single…

We use Duo Push with 1Password. It supports lots of 2FA types.
Post reply on HN