36 ms·

1Password Secrets Automation

374 points by srijan4 6y ago

patwolf 6y ago
This looks interesting. We use 1Password, and I always thought it would be useful to programmatically pull values out and use in our cloud infrastructure. Currently we end up using the secret managers available in AWS or GCP, which seems pretty half baked. In GCP, for example, secrets are stored at a project level. It's not unusual to have certain secrets that are needed by more than one project, which means they get duplicated. The granularity also prevents me from controlling which secrets are visible to a given user. I'd love to have one centralized source of truth for all infrastructure secrets.
- nops 6y ago
  https://www.vaultproject.io/ https://www.vaultproject.io/
- outworlder 6y ago
  This is why we use Vault. Until recently, there was no good option to host it, so you had to manage it. It's good to have independent competition in this space.
  - Kudos 6y ago
    They're not competing with Vault,they see this as an alternative for simpler use cases where Vault is overkill, or a complimentary product otherwise.
    - whazor 6y ago
      Also it would be cool to unlock the vault via 1password.
  - stimur 6y ago
    [I work for 1Password] 1Password is not competing with Vault. In fact we have very good relationships and mutual respect with HashiCorp on many levels. Also Secret automation integrates (acts as a provider) with HC Vault[1] 1. https://github.com/1Password/vault-plugin-secrets-onepassword https://github.com/1Password/vault-plugin-secrets-onepasswor...
- gingerlime 6y ago
  plugging envwarden[0] which is just a tiny open source wrapper around the Bitwarden CLI to let you manage your server secrets inside your password manager. [0] https://github.com/envwarden/envwarden https://github.com/envwarden/envwarden
- hn_throwaway_99 6y ago
  > The granularity also prevents me from controlling which secrets are visible to a given user. What do you mean by this? Each secret has a "Permissions" tab which allows you to grant access to individual IAM users.
  - patwolf 6y ago
    You're correct. Not sure if I overlooked it or at some iteration of usage it wasn't there.
- zomglings 6y ago
  My team uses 1Password to share account credentials, etc. When we need to deploy secrets into production, we use AWS Systems Manager Parameter Store. The name is quite a mouthful, but we have found the service to be awesome. We have a small Python script that loads a script with environment variable definitions from the Parameter Store and we use that as an EnvFile for our systemd services.
- sroussey 6y ago
  We reverse engineered it so we can pull stuff ourselves. BTW: don’t forget to empty trust in 1P. Noticed the API giving back a lot more stuff than expected and that is why.
- directionless 6y ago
  For AWS and GCP you can setup cross-project permissions. I've run a single project of secrets, which grants specific access to various service accounts
microdrum 6y ago
Hah. With the gimmicks, tricks, and dark patterns this company has pulled with consumer, what are the chances professionals would trust them with something like this?
- alpha_squared 6y ago
  I'm a subscriber, but unfamiliar with what you're referencing. Do you mind sharing?
- wskinner 6y ago
  Care to elaborate?
- jagger27 6y ago
  I thought AgileBits was pretty well respected around here. What dark patterns are you referring to?
  - dastx 6y ago
    I'm assuming he's referring to their beginnings of being a mostly local password manager (iirc they also had a one-off lifetime purchase), to forcing people to migrate to their cloud only infrastructure with a relatively high subscription price. I'd never heard of 1Password before they were fully SaaS, but as I understand it, some of the original users were pretty upset with this move. Either way, I used to be a 1Password customer, and their product, at least on the Mac, was the most polished password manager.
    - wferrell 6y ago
      What did you switch to if you stopped using 1Password?
      - dastx 6y ago
        Bitwarden. One of the big reasons for doing so was because when I left my company, they took my Mac away from me, so I invested in a new laptop, for me there was no way I was going for Windows or Mac. So Linux it is. 1Password at the time had extremely poor support for Linux - no desktop client, their 1PasswordX was missing a lot of features and was super slow too. I switched to Bitwarden because it's open source, and because they have a good enough Linux client. Their browser extension and desktop client doesn't come close to what 1Password provided on Mac, but it does the job. Bitwarden isn't without its issues, but at $10 a year, and its open source nature, it's worth every penny and then some.
bsamuels 6y ago
Here's to hoping there's finally a Hashicorp Vault competitor. It's shocking that the only mature option for runtime secret delivery is Vault after all these years. Some companies have created 'competitors', but they aren't even remotely mature (google secrets manager, aws secret manager, etc)
- w0m 6y ago
  I've had good luck with Azure KeyVault.
  - brianhorakh 6y ago
    Ditto. The managed service provider VS user assigned rbac was confusing at first, but now I am happy that I took the time to understand it. Also the azure clouds handling of vaulted passwords in log files from services like Logic apps) is absolutely bad ass.
    - haswell 6y ago
      > Also the azure clouds handling of vaulted passwords in log files from services like Logic apps) is absolutely bad ass. This is particularly interesting to me. Is there a good doc page or blog post that you're aware of that covers these capabilities? I'm curious and would love to learn more.
  - trevorishere 6y ago
    KeyVault is ideal when combined with Managed Identities. I would not leverage any service that required a connection string to access a secret.
- DangitBobby 6y ago
  What are your criticisms of Google secrets manager? It works well for me, but it's the only one I've used so I don't know much about the competition.
  - bsamuels 6y ago
thehermit 6y ago
I've been deep in the k8s on raspberry pi's world recently and ran across someone who was doing this with Bitwarden for their personal setup. I use 1password as my password manager of choice and was immediately trying to find ways to do something similar using the 1password CLI, so this is very convenient timing.
Dedime 6y ago
Why would anyone trust their passwords with closed source software, when there's alternatives out there that are?
- Item_Boring 6y ago
  Because it works seamlessly on all of my devices and has done so for years. Never encountered any issues and syncing happens within seconds.
  - Dedime 6y ago
    I've been quite happy with KeePassXC / KeePass2Android and syncing via Google Drive.
    - naosouumapessoa 6y ago
      Not sure about Android but, for iOS users, it makes no sense trusting open source software. So, even if you choose strongbox or keepassium as they’re open source you’re still trusting some dude as you have no option to verify that the iOS build is the same as the build on github. This is why I prefer to give my password to a company like Bitwarden and 1Password. At least, they have less incentive to be malicious than random dude on the store.
      - anmipo 6y ago
        Bitwarden used to be a "random dude" project for quite a while...
        nopato 6y ago
        Yeah and I’ve never used it while it was a random dude project. You need enough street cred if you want me to trust my whole life in your hands.
        anmipo 6y ago
xoa 6y ago
While this looks interesting, I'll admit I feel like there's been a bit of drift from their bread and butter over the years since they launched their cloud thing and started pushing hard towards a subscription model. I chose them long ago specifically over options like LastPass because I liked having a rich application without internet dependency and their attention to detail and features there, but it's been a while since it feels like it got major new improvements vs the site. For example, while macOS and Windows have supported smart cards and security tokens like YubiKeys forever now, and I use them to login, unlock, authorize sudo/SSH, etc every day, 1Password still has no support. There are things that can now only be done through the web interface, like finer grained control over permissions for shared vaults, and some of those are also nastily locked away behind more expensive subscriptions. I think everything should be manageable through the application, without ever visiting the site. Duplicate items across vaults remain completely manually managed, when automating stuff like that is kind of the purpose of a password manager. Etc. Heck, even within their own subscription service I think they're missing a trick by not having more powerful/flexible organization(including families) and inter-organizational capabilities. I still think 1Password is the best option for most people. I specifically want my non-technical family and friends to use password managers too as long as its necessary, and having some multiperson capability is also key to that. I can't say though that I feel like the move to subs has been a huge win in terms of development. Granted, I'm a little down on the whole field which colors things a bit. Ultimately underlying my feelings is a touch of bitterness that their entire industry even exists. Passwords and password managers are mostly recreating public key auth really, really badly and it stinks. Passwords and other symmetric tokens by definition should never be shared. A website being hacked should never affect me in the slightest, in the same way that me getting hacked doesn't somehow suddenly mean attackers now own Debian/Apple/FreeBSD/Microsoft. Everywhere should just have public keys. We've had the tech for decades and sufficient crypto speed on client systems since at least AES-NI. What's been missing has been glue and effort. It's frustrating every time a hack happens. We shouldn't have to care! Sigh.
- fastball 6y ago
  Very much agree. My pet peeve at the moment is this[1], where they removed a feature I very much like (TouchID in the standalone browser extension) and still have yet to replace that functionality despite many promises that it is just around the corner. It was removed in August 2020. Definitely feel like they've lost sight of why people chose them in the first place, and stuff like this is certainly not helping assuage my concerns. [1] https://1password.community/discussion/115228/temporarily-removing-desktop-app-integration/p1 https://1password.community/discussion/115228/temporarily-re...
bredren 6y ago
Strange to see this. The product is a mess on MacOs right now. Support can’t decide which extension to recommend. Their messaging has been inconsistent, saying the browser will integrate with the native client. But then also that the browser only version is the future of the product. This says nothing of the performance and UI problems the product has faced. Recently it was so bad the company was telling people to use the beta version. I bought the legacy versions and switched to subscription last year.
- SirensOfTitan 6y ago
  If I were unfamiliar with 1Password, I'd imagine the product is an absolute dumpster fire from your post. In reality, the macOS and iOS clients work fine. I have a dozen friends and family members using the product with no complains on those platforms. I surely haven't seen any performance or UI problems that aren't worse on different services. Sure, there is some current confusion between the use of the 1Password X and classical browser extensions, but it's hardly "a mess."
  - bredren 6y ago
    The iOS app is stable and fine. The MacOS native / extension interaction and choice is a mess. From a UX perspective, the single most important thing the product can do is interact with the browser effectively. Embedded in this "feature" is that the product is stable, and responsive in behavior. If you go to the chrome web store, 1password extension page and sort by recently updated, you'll see review after review of 1-3 star, carefully explained problems with this product. https://chrome.google.com/webstore/detail/1password-%E2%80%93-password-mana/aeblfdkhhhdcdjpifhhbdiojplfjncoa https://chrome.google.com/webstore/detail/1password-%E2%80%9... Regarding inconsistent messaging, their support is promising they're working on native app integration but there is no timeline for this. That's why this news is kind of a bummer. The product that I'm subscribed to is competing with this new product for resources.
    - jackweirdy 6y ago
      There’s also 2 native apps - if you install from the App Store, you don’t get all the same OTP features as an install from the website download
ShakataGaNai 6y ago
This is very cool. I spent about 20 minutes playing with it and was successful in setting it up and getting some janky python code to work with it. The fact that it's a local sync daemon with local API, is super smart. No worries about cloud outages. Is Hashicorp vault "better"? Probably. However for groups that don't have the time and resources for Vault, this is a great first step. Much better than what most do which is no proper secret storage.
- jpgoldberg 6y ago
  Another reason for the local hosting is so that we (I work for 1Password) are never in a position to acquire secrets can be used to decrypt your data.
  - ShakataGaNai 6y ago
    Fair point, I hadn't thought of that. Makes perfect sense and gives me the warm security fuzzies.
dividedbyzero 6y ago
Neat, seems it's available to people with a Family subscription, too.
- bwoodruff 6y ago
  Yes indeed it is. :) - Ben, 1Password
Dowwie 6y ago
Is anyone familiar with the secure introduction workflow using Hashicorp Vault? An orchestrator gets no more than a one-time use "cubbyhole" introduction token for a service that it is initializing. The initializing service uses the intro token to get actual credentials and secrets from the Vault. The orchestrator never touches any secrets: no secrets need to be passed as env variables anymore. With this setup, the person/service that seeds secrets into the Vault and the introduced system that uses the secrets are the only two that may ever touch them. Not sure how well this is actually documented but I gleamed enough from docs and a tech talk to figure the workflow out. It's pretty intuitive once you dig in.
- madjam002 6y ago
  Is this the same as seal wrapping that you are referring to? Honestly Vault is one of the best pieces of software that I have the joy of using, I use it on many projects small to large.
  - Dowwie 6y ago
    Yes, precisely. Wrapped tokens and cubbyholes. Vault is great. They put a ton of effort into it.
azinman2 6y ago
I was hoping this was a way to automate changing my passwords. That’s something no password manager does, Anna would be great if I could rotate my hundreds of passwords on a regular basis.
- haswell 6y ago
  LastPass has been auto-changing passwords for quite awhile now [0]. I am a 1Password user, but I've considered making the switch to LastPass for this feature alone. - [0] http://blog.lastpass.com/2014/12/introducing-auto-password-changing-with/ http://blog.lastpass.com/2014/12/introducing-auto-password-c...
  - azinman2 6y ago
    Wow that's amazing. I had no idea that existed anywhere, let alone for years now! Thanks for pointing that out... I wonder how many sites now actively support that, how it works with 2FA, etc. I have hundreds of passwords, many not from big shops. Hopefully 'it just works' with these.
- rcaught 6y ago
  It goes against most service's TOS.
macrael 6y ago
1Password is great software. I think I've finally switched over to their more all-encompassing extension on Safari and I love it. Glad to see them doing more, I am happy every time I use their software.
8fingerlouie 6y ago
I purchased my first 1Password license when it was version 3, and have faithfully upgraded to every standalone version ever since. These days I’m not so sure I will be upgrading again (and I’m not sure there will be more stand alone versions). The latest version is a mess on Big Sur, with unlock fields obscuring input fields, conflicting with Apples iCloud Keychain, and just not working like I expect it to. Furthermore, stand-alone versions are buried deeper and deeper behind a cloud service subscription that brings me absolutely no value over what i already have, and adds the uncertainty of having to synchronize my most secret secrets to a cloud service. While I can certainly forgive software errors, this has been going on for so long that I’m beginning to suspect it’s either a strangler pattern to get people to switch to the cloud solution, or it’s death by a thousand cuts. In any case, I’ve begun evaluating alternatives. Bitwarden looks promising (though nowhere as polished), is open source, and allows me to synchronize to a service on my LAN. Password-store uses gpg and git that also allows me to synchronize locally (though it leaks website names without the vault extension which is not supported on iOS). Finally I’m evaluating Yubico authenticator for 2FA codes and just using iCloud Keychain for the rest.
- JimBlackwood 6y ago
  Just out of curiosity, as someone who selfhosts Bitwarden, how is 1Password so much more polished? I’ve never used 1Pass. Just, I’m always amazed by how well Bitwarden works and how there’s not really features I’m lacking.
  - hirvi74 6y ago
    As someone who switched form 1Password to Bitwarden a year or so ago, there are a few features I miss: 1. The ability to customize keybindings. 2. If try to autofill a form field, and BW is locked, then nothing happens. The same task in 1P will actually prompt me to unlock 1P, then I am able to autofill the field. 3. If create an account for a site not saved in BW, and BW is locked, then I am not prompted to save the login. However, 1P will prompt to unlock itself so that I may save the login. Also, the prompt for saving logins rarely works for me using BW, but worked rather well for me using 1P. 4. BW is not as keen as 1P for auto-filling various form fields 5. I like storing software licenses, wi-fi passwords, bank accounts, etc. in 1P vs. secure notes in BW. 6. I am not a fan of BW's folders for organizing logins. 7. BW relies too heavily on mouse usage for my liking. I felt that 1P had much better keyboard navigation. There are probably other things I am missing, but with all that being said, I still have not left BW to return to 1P nor do I plan to anytime soon. Though, I will admit I miss many features from 1P still.
cheerupplease 6y ago
I’ve never commented on a HN post, but finally you’ve all got to me. Why are people mostly commenting moaning about something completely different to what the article is about? Fine, I get it, you don’t like 1Password’s tactics regarding subscription models. But this is about infrastructure secret management. It’s the same with Google Cloud announcements “hOw LoNg UnTiL tHeY dEprEcAtE iT???” ... boooooooring
- jpeeler 6y ago
  I've found that HN often chats about something only tangentially related to the article. And I think it's actually part of the culture here. But I agree that when you are passionate about a given topic it is a bit of a letdown when the comments are not directly about the article. Note that we've both commented on something different from the article in this case.
  - cheerupplease 6y ago
    Yes, the irony wasn’t lost on me haha! I do like using 1Password, it does make life a bit easier, and I’m grateful for its existence. I think this is an interesting offering and will take it for a spin soon!
- ggm 6y ago
  Good comment. I disliked the 1P subscription model and moved to paying bitwarden for personal use but I use 1P for work and its a perfectly cromulent functional system, and works well. Secrets management for network systems has been an issue since before kerberos. Having different models, isolating secrets from the repo and deployment codebase into a 3rd party module is one of the rational choices. I would want to understand a secure secret import and export model, much as for an HSM you want to know how to move shrouded keys (if its not in FIPS mode i guess)
  - cheerupplease 6y ago
    Thanks! It seems I started using 1Password after its model changed, so I’ve never had to really think about it, but I can appreciate the frustration. I’m happy to just have another offering in the world of secrets management
spondyl 6y ago
The article is a little light on details but this seems like a cool addition to 1Password. The op cli is alright but having to re-unlock it every 30 minutes (plus I'm shell dumb so my session is nuked every new tab I open) means there's quite a lot of friction compared to the desktop version where I just double tap the side button on my Apple watch I wonder if this could be a potential alternative in some roundabout way --- Somewhat unrelated rant I like 1Password and after having tried a whirlwind of password managers, it's still the most seamless (plus having templates for things like cards, licenses and so on is useful) I don't even mind paying the relatively small subscription fee. That said, in the same sense that you generally know you've resigned months before you write the letter, I still remember there was a forum thread where one of the employees was seemingly user hostile. On second thought, I don't even remember what it was about but I remember the feeling of slight frustration. Not in the entitled sense but the sense that there didn't feel like an attempt to understand the concern from the other side. Very vague but does anyone perhaps know what this event was again? I want to say, something about supporting local vaults? I dunno, that isn't even something I was concerned about.
- alvarlagerlof 6y ago
  Probably about them not supporting personal hosting as well anymore. I get that customers got angry, but as someone who started using their product after that, with their hosting, they have been nothing but nice and receptive to feedback.
CGamesPlay 6y ago
The documentation is very sparse. I have a few questions. - Why does the integration require two servers with exposed ports? The REST API documentation doesn't say which service I need to connect to for the resources, so I assume the answer is the API server, so what does the other server listen for? - How do I request a TOTP? In particular, am I correct in my assumption that the implementation is simply providing you with the TOTP seed values, rather than a TOTP? - Is there any audit logging whatsoever?
- bwoodruff 6y ago
  Hello! > - Why does the integration require two servers with exposed ports? The REST API documentation doesn't say which service I need to connect to for the resources, so I assume the answer is the API server, so what does the other server listen for? The server you'd interact with is the API server. The other server is responsible for syncing. The fact that there are two was a design decision. > - How do I request a TOTP? In particular, am I correct in my assumption that the implementation is simply providing you with the TOTP seed values, rather than a TOTP? I don't believe we can provide the current OTP value as it stands. This is something I'd be happy to suggest to the team that we look at for a future iteration. > - Is there any audit logging whatsoever? Yes! You can either audit from the container directly, or through the item usage report in the 1Password.com web app. If you need further assistance please feel free to reach out to us. We'd be happy to help. https://support.1password.com/contact/ https://support.1password.com/contact/ - Ben, 1Password
  - CGamesPlay 6y ago
    Thanks for the reply! You didn't quite completely answer my first question. Why does the "sync" server have an exposed port? I'm going based on the docker-compose.yml you provide.
    - bwoodruff 6y ago
      That is a documentation clarification that should be made. That exposed port in the docker-compose is only there so someone running a health check from the host could see it. The docker-compose should be updated to remove the port exposure. Thanks for bringing that up!
fukmbas 6y ago
Anyone using a password manager tied to cloud deserves to be compromised lol. KeePass for the win
sam0x17 6y ago
Ruby support for 1Password Secrets please <3
fatiherikli 6y ago
Amazing product really works amazing great this is my password can I login to all the websites? Yes I can.
gogopuppygogo 6y ago
Maybe first it’s time to add a generate secure password button to the iOS app?
hacker_newz 6y ago
Unless it's possible to run this on premise I don't see how this could compete with Hashicorp Vault.
- bwoodruff 6y ago
  https://news.ycombinator.com/item?id=26799528 https://news.ycombinator.com/item?id=26799528 may help clarify. Also this component can run on premise - Ben, 1Password
mysql 6y ago
This feature seems really great, I have been waiting for a long time for them to fix filtering on hostname and port for OSX. This is really annoying for local development with docker. https://1password.community/discussion/99568/add-port-number-to-url-filter-for-available-logins https://1password.community/discussion/99568/add-port-number...

374 points by srijan4 6y ago

This looks interesting. We use 1Password, and I always thought it would be useful to programmatically pull values out and use in our cloud infrastructure. Currently we end up using the secret managers available in AWS or GCP, which seems pretty half baked. In GCP, for example, secrets are stored at a project level. It's not unusual to have certain secrets that are needed by more than one project, which means they get duplicated. The granularity also prevents me from controlling which secrets are visible to a given user. I'd love to have one centralized source of truth for all infrastructure secrets.

nops 6y ago
https://www.vaultproject.io/ https://www.vaultproject.io/
outworlder 6y ago
This is why we use Vault. Until recently, there was no good option to host it, so you had to manage it. It's good to have independent competition in this space.
- Kudos 6y ago
  They're not competing with Vault,they see this as an alternative for simpler use cases where Vault is overkill, or a complimentary product otherwise.
  - whazor 6y ago
    Also it would be cool to unlock the vault via 1password.
- stimur 6y ago
  [I work for 1Password] 1Password is not competing with Vault. In fact we have very good relationships and mutual respect with HashiCorp on many levels. Also Secret automation integrates (acts as a provider) with HC Vault[1] 1. https://github.com/1Password/vault-plugin-secrets-onepassword https://github.com/1Password/vault-plugin-secrets-onepasswor...
gingerlime 6y ago
plugging envwarden[0] which is just a tiny open source wrapper around the Bitwarden CLI to let you manage your server secrets inside your password manager. [0] https://github.com/envwarden/envwarden https://github.com/envwarden/envwarden
hn_throwaway_99 6y ago
> The granularity also prevents me from controlling which secrets are visible to a given user. What do you mean by this? Each secret has a "Permissions" tab which allows you to grant access to individual IAM users.
- patwolf 6y ago
  You're correct. Not sure if I overlooked it or at some iteration of usage it wasn't there.
zomglings 6y ago
My team uses 1Password to share account credentials, etc. When we need to deploy secrets into production, we use AWS Systems Manager Parameter Store. The name is quite a mouthful, but we have found the service to be awesome. We have a small Python script that loads a script with environment variable definitions from the Parameter Store and we use that as an EnvFile for our systemd services.
sroussey 6y ago
We reverse engineered it so we can pull stuff ourselves. BTW: don’t forget to empty trust in 1P. Noticed the API giving back a lot more stuff than expected and that is why.
directionless 6y ago
For AWS and GCP you can setup cross-project permissions. I've run a single project of secrets, which grants specific access to various service accounts

microdrum 6y ago

Hah. With the gimmicks, tricks, and dark patterns this company has pulled with consumer, what are the chances professionals would trust them with something like this?

alpha_squared 6y ago
I'm a subscriber, but unfamiliar with what you're referencing. Do you mind sharing?
wskinner 6y ago
Care to elaborate?
jagger27 6y ago
I thought AgileBits was pretty well respected around here. What dark patterns are you referring to?
- dastx 6y ago
  I'm assuming he's referring to their beginnings of being a mostly local password manager (iirc they also had a one-off lifetime purchase), to forcing people to migrate to their cloud only infrastructure with a relatively high subscription price. I'd never heard of 1Password before they were fully SaaS, but as I understand it, some of the original users were pretty upset with this move. Either way, I used to be a 1Password customer, and their product, at least on the Mac, was the most polished password manager.
  - wferrell 6y ago
    What did you switch to if you stopped using 1Password?
    - dastx 6y ago
      Bitwarden. One of the big reasons for doing so was because when I left my company, they took my Mac away from me, so I invested in a new laptop, for me there was no way I was going for Windows or Mac. So Linux it is. 1Password at the time had extremely poor support for Linux - no desktop client, their 1PasswordX was missing a lot of features and was super slow too. I switched to Bitwarden because it's open source, and because they have a good enough Linux client. Their browser extension and desktop client doesn't come close to what 1Password provided on Mac, but it does the job. Bitwarden isn't without its issues, but at $10 a year, and its open source nature, it's worth every penny and then some.

bsamuels 6y ago

Here's to hoping there's finally a Hashicorp Vault competitor. It's shocking that the only mature option for runtime secret delivery is Vault after all these years. Some companies have created 'competitors', but they aren't even remotely mature (google secrets manager, aws secret manager, etc)

w0m 6y ago
I've had good luck with Azure KeyVault.
- brianhorakh 6y ago
  Ditto. The managed service provider VS user assigned rbac was confusing at first, but now I am happy that I took the time to understand it. Also the azure clouds handling of vaulted passwords in log files from services like Logic apps) is absolutely bad ass.
  - haswell 6y ago
    > Also the azure clouds handling of vaulted passwords in log files from services like Logic apps) is absolutely bad ass. This is particularly interesting to me. Is there a good doc page or blog post that you're aware of that covers these capabilities? I'm curious and would love to learn more.
- trevorishere 6y ago
  KeyVault is ideal when combined with Managed Identities. I would not leverage any service that required a connection string to access a secret.
DangitBobby 6y ago
What are your criticisms of Google secrets manager? It works well for me, but it's the only one I've used so I don't know much about the competition.
- bsamuels 6y ago

thehermit 6y ago

I've been deep in the k8s on raspberry pi's world recently and ran across someone who was doing this with Bitwarden for their personal setup. I use 1password as my password manager of choice and was immediately trying to find ways to do something similar using the 1password CLI, so this is very convenient timing.

Dedime 6y ago

Why would anyone trust their passwords with closed source software, when there's alternatives out there that are?

Item_Boring 6y ago
Because it works seamlessly on all of my devices and has done so for years. Never encountered any issues and syncing happens within seconds.
- Dedime 6y ago
  I've been quite happy with KeePassXC / KeePass2Android and syncing via Google Drive.
  - naosouumapessoa 6y ago
    Not sure about Android but, for iOS users, it makes no sense trusting open source software. So, even if you choose strongbox or keepassium as they’re open source you’re still trusting some dude as you have no option to verify that the iOS build is the same as the build on github. This is why I prefer to give my password to a company like Bitwarden and 1Password. At least, they have less incentive to be malicious than random dude on the store.
    - anmipo 6y ago
      Bitwarden used to be a "random dude" project for quite a while...
      - nopato 6y ago
        Yeah and I’ve never used it while it was a random dude project. You need enough street cred if you want me to trust my whole life in your hands.
        anmipo 6y ago

xoa 6y ago

While this looks interesting, I'll admit I feel like there's been a bit of drift from their bread and butter over the years since they launched their cloud thing and started pushing hard towards a subscription model. I chose them long ago specifically over options like LastPass because I liked having a rich application without internet dependency and their attention to detail and features there, but it's been a while since it feels like it got major new improvements vs the site. For example, while macOS and Windows have supported smart cards and security tokens like YubiKeys forever now, and I use them to login, unlock, authorize sudo/SSH, etc every day, 1Password still has no support. There are things that can now only be done through the web interface, like finer grained control over permissions for shared vaults, and some of those are also nastily locked away behind more expensive subscriptions. I think everything should be manageable through the application, without ever visiting the site. Duplicate items across vaults remain completely manually managed, when automating stuff like that is kind of the purpose of a password manager. Etc. Heck, even within their own subscription service I think they're missing a trick by not having more powerful/flexible organization(including families) and inter-organizational capabilities. I still think 1Password is the best option for most people. I specifically want my non-technical family and friends to use password managers too as long as its necessary, and having some multiperson capability is also key to that. I can't say though that I feel like the move to subs has been a huge win in terms of development. Granted, I'm a little down on the whole field which colors things a bit. Ultimately underlying my feelings is a touch of bitterness that their entire industry even exists. Passwords and password managers are mostly recreating public key auth really, really badly and it stinks. Passwords and other symmetric tokens by definition should never be shared. A website being hacked should never affect me in the slightest, in the same way that me getting hacked doesn't somehow suddenly mean attackers now own Debian/Apple/FreeBSD/Microsoft. Everywhere should just have public keys. We've had the tech for decades and sufficient crypto speed on client systems since at least AES-NI. What's been missing has been glue and effort. It's frustrating every time a hack happens. We shouldn't have to care! Sigh.

fastball 6y ago
Very much agree. My pet peeve at the moment is this[1], where they removed a feature I very much like (TouchID in the standalone browser extension) and still have yet to replace that functionality despite many promises that it is just around the corner. It was removed in August 2020. Definitely feel like they've lost sight of why people chose them in the first place, and stuff like this is certainly not helping assuage my concerns. [1] https://1password.community/discussion/115228/temporarily-removing-desktop-app-integration/p1 https://1password.community/discussion/115228/temporarily-re...

bredren 6y ago

Strange to see this. The product is a mess on MacOs right now. Support can’t decide which extension to recommend. Their messaging has been inconsistent, saying the browser will integrate with the native client. But then also that the browser only version is the future of the product. This says nothing of the performance and UI problems the product has faced. Recently it was so bad the company was telling people to use the beta version. I bought the legacy versions and switched to subscription last year.

SirensOfTitan 6y ago
If I were unfamiliar with 1Password, I'd imagine the product is an absolute dumpster fire from your post. In reality, the macOS and iOS clients work fine. I have a dozen friends and family members using the product with no complains on those platforms. I surely haven't seen any performance or UI problems that aren't worse on different services. Sure, there is some current confusion between the use of the 1Password X and classical browser extensions, but it's hardly "a mess."
- bredren 6y ago
  The iOS app is stable and fine. The MacOS native / extension interaction and choice is a mess. From a UX perspective, the single most important thing the product can do is interact with the browser effectively. Embedded in this "feature" is that the product is stable, and responsive in behavior. If you go to the chrome web store, 1password extension page and sort by recently updated, you'll see review after review of 1-3 star, carefully explained problems with this product. https://chrome.google.com/webstore/detail/1password-%E2%80%93-password-mana/aeblfdkhhhdcdjpifhhbdiojplfjncoa https://chrome.google.com/webstore/detail/1password-%E2%80%9... Regarding inconsistent messaging, their support is promising they're working on native app integration but there is no timeline for this. That's why this news is kind of a bummer. The product that I'm subscribed to is competing with this new product for resources.
  - jackweirdy 6y ago
    There’s also 2 native apps - if you install from the App Store, you don’t get all the same OTP features as an install from the website download

ShakataGaNai 6y ago

This is very cool. I spent about 20 minutes playing with it and was successful in setting it up and getting some janky python code to work with it. The fact that it's a local sync daemon with local API, is super smart. No worries about cloud outages. Is Hashicorp vault "better"? Probably. However for groups that don't have the time and resources for Vault, this is a great first step. Much better than what most do which is no proper secret storage.

jpgoldberg 6y ago
Another reason for the local hosting is so that we (I work for 1Password) are never in a position to acquire secrets can be used to decrypt your data.
- ShakataGaNai 6y ago
  Fair point, I hadn't thought of that. Makes perfect sense and gives me the warm security fuzzies.

dividedbyzero 6y ago

Neat, seems it's available to people with a Family subscription, too.

bwoodruff 6y ago
Yes indeed it is. :) - Ben, 1Password

Dowwie 6y ago

Is anyone familiar with the secure introduction workflow using Hashicorp Vault? An orchestrator gets no more than a one-time use "cubbyhole" introduction token for a service that it is initializing. The initializing service uses the intro token to get actual credentials and secrets from the Vault. The orchestrator never touches any secrets: no secrets need to be passed as env variables anymore. With this setup, the person/service that seeds secrets into the Vault and the introduced system that uses the secrets are the only two that may ever touch them. Not sure how well this is actually documented but I gleamed enough from docs and a tech talk to figure the workflow out. It's pretty intuitive once you dig in.

madjam002 6y ago
Is this the same as seal wrapping that you are referring to? Honestly Vault is one of the best pieces of software that I have the joy of using, I use it on many projects small to large.
- Dowwie 6y ago
  Yes, precisely. Wrapped tokens and cubbyholes. Vault is great. They put a ton of effort into it.

azinman2 6y ago

I was hoping this was a way to automate changing my passwords. That’s something no password manager does, Anna would be great if I could rotate my hundreds of passwords on a regular basis.

haswell 6y ago
LastPass has been auto-changing passwords for quite awhile now [0]. I am a 1Password user, but I've considered making the switch to LastPass for this feature alone. - [0] http://blog.lastpass.com/2014/12/introducing-auto-password-changing-with/ http://blog.lastpass.com/2014/12/introducing-auto-password-c...
- azinman2 6y ago
  Wow that's amazing. I had no idea that existed anywhere, let alone for years now! Thanks for pointing that out... I wonder how many sites now actively support that, how it works with 2FA, etc. I have hundreds of passwords, many not from big shops. Hopefully 'it just works' with these.
rcaught 6y ago
It goes against most service's TOS.

macrael 6y ago

1Password is great software. I think I've finally switched over to their more all-encompassing extension on Safari and I love it. Glad to see them doing more, I am happy every time I use their software.

8fingerlouie 6y ago

I purchased my first 1Password license when it was version 3, and have faithfully upgraded to every standalone version ever since. These days I’m not so sure I will be upgrading again (and I’m not sure there will be more stand alone versions). The latest version is a mess on Big Sur, with unlock fields obscuring input fields, conflicting with Apples iCloud Keychain, and just not working like I expect it to. Furthermore, stand-alone versions are buried deeper and deeper behind a cloud service subscription that brings me absolutely no value over what i already have, and adds the uncertainty of having to synchronize my most secret secrets to a cloud service. While I can certainly forgive software errors, this has been going on for so long that I’m beginning to suspect it’s either a strangler pattern to get people to switch to the cloud solution, or it’s death by a thousand cuts. In any case, I’ve begun evaluating alternatives. Bitwarden looks promising (though nowhere as polished), is open source, and allows me to synchronize to a service on my LAN. Password-store uses gpg and git that also allows me to synchronize locally (though it leaks website names without the vault extension which is not supported on iOS). Finally I’m evaluating Yubico authenticator for 2FA codes and just using iCloud Keychain for the rest.

JimBlackwood 6y ago
Just out of curiosity, as someone who selfhosts Bitwarden, how is 1Password so much more polished? I’ve never used 1Pass. Just, I’m always amazed by how well Bitwarden works and how there’s not really features I’m lacking.
- hirvi74 6y ago
  As someone who switched form 1Password to Bitwarden a year or so ago, there are a few features I miss: 1. The ability to customize keybindings. 2. If try to autofill a form field, and BW is locked, then nothing happens. The same task in 1P will actually prompt me to unlock 1P, then I am able to autofill the field. 3. If create an account for a site not saved in BW, and BW is locked, then I am not prompted to save the login. However, 1P will prompt to unlock itself so that I may save the login. Also, the prompt for saving logins rarely works for me using BW, but worked rather well for me using 1P. 4. BW is not as keen as 1P for auto-filling various form fields 5. I like storing software licenses, wi-fi passwords, bank accounts, etc. in 1P vs. secure notes in BW. 6. I am not a fan of BW's folders for organizing logins. 7. BW relies too heavily on mouse usage for my liking. I felt that 1P had much better keyboard navigation. There are probably other things I am missing, but with all that being said, I still have not left BW to return to 1P nor do I plan to anytime soon. Though, I will admit I miss many features from 1P still.

cheerupplease 6y ago

I’ve never commented on a HN post, but finally you’ve all got to me. Why are people mostly commenting moaning about something completely different to what the article is about? Fine, I get it, you don’t like 1Password’s tactics regarding subscription models. But this is about infrastructure secret management. It’s the same with Google Cloud announcements “hOw LoNg UnTiL tHeY dEprEcAtE iT???” ... boooooooring

jpeeler 6y ago
I've found that HN often chats about something only tangentially related to the article. And I think it's actually part of the culture here. But I agree that when you are passionate about a given topic it is a bit of a letdown when the comments are not directly about the article. Note that we've both commented on something different from the article in this case.
- cheerupplease 6y ago
  Yes, the irony wasn’t lost on me haha! I do like using 1Password, it does make life a bit easier, and I’m grateful for its existence. I think this is an interesting offering and will take it for a spin soon!
ggm 6y ago
Good comment. I disliked the 1P subscription model and moved to paying bitwarden for personal use but I use 1P for work and its a perfectly cromulent functional system, and works well. Secrets management for network systems has been an issue since before kerberos. Having different models, isolating secrets from the repo and deployment codebase into a 3rd party module is one of the rational choices. I would want to understand a secure secret import and export model, much as for an HSM you want to know how to move shrouded keys (if its not in FIPS mode i guess)
- cheerupplease 6y ago
  Thanks! It seems I started using 1Password after its model changed, so I’ve never had to really think about it, but I can appreciate the frustration. I’m happy to just have another offering in the world of secrets management

spondyl 6y ago

The article is a little light on details but this seems like a cool addition to 1Password. The op cli is alright but having to re-unlock it every 30 minutes (plus I'm shell dumb so my session is nuked every new tab I open) means there's quite a lot of friction compared to the desktop version where I just double tap the side button on my Apple watch I wonder if this could be a potential alternative in some roundabout way --- Somewhat unrelated rant I like 1Password and after having tried a whirlwind of password managers, it's still the most seamless (plus having templates for things like cards, licenses and so on is useful) I don't even mind paying the relatively small subscription fee. That said, in the same sense that you generally know you've resigned months before you write the letter, I still remember there was a forum thread where one of the employees was seemingly user hostile. On second thought, I don't even remember what it was about but I remember the feeling of slight frustration. Not in the entitled sense but the sense that there didn't feel like an attempt to understand the concern from the other side. Very vague but does anyone perhaps know what this event was again? I want to say, something about supporting local vaults? I dunno, that isn't even something I was concerned about.

alvarlagerlof 6y ago
Probably about them not supporting personal hosting as well anymore. I get that customers got angry, but as someone who started using their product after that, with their hosting, they have been nothing but nice and receptive to feedback.

CGamesPlay 6y ago

The documentation is very sparse. I have a few questions. - Why does the integration require two servers with exposed ports? The REST API documentation doesn't say which service I need to connect to for the resources, so I assume the answer is the API server, so what does the other server listen for? - How do I request a TOTP? In particular, am I correct in my assumption that the implementation is simply providing you with the TOTP seed values, rather than a TOTP? - Is there any audit logging whatsoever?

bwoodruff 6y ago
Hello! > - Why does the integration require two servers with exposed ports? The REST API documentation doesn't say which service I need to connect to for the resources, so I assume the answer is the API server, so what does the other server listen for? The server you'd interact with is the API server. The other server is responsible for syncing. The fact that there are two was a design decision. > - How do I request a TOTP? In particular, am I correct in my assumption that the implementation is simply providing you with the TOTP seed values, rather than a TOTP? I don't believe we can provide the current OTP value as it stands. This is something I'd be happy to suggest to the team that we look at for a future iteration. > - Is there any audit logging whatsoever? Yes! You can either audit from the container directly, or through the item usage report in the 1Password.com web app. If you need further assistance please feel free to reach out to us. We'd be happy to help. https://support.1password.com/contact/ https://support.1password.com/contact/ - Ben, 1Password
- CGamesPlay 6y ago
  Thanks for the reply! You didn't quite completely answer my first question. Why does the "sync" server have an exposed port? I'm going based on the docker-compose.yml you provide.
  - bwoodruff 6y ago
    That is a documentation clarification that should be made. That exposed port in the docker-compose is only there so someone running a health check from the host could see it. The docker-compose should be updated to remove the port exposure. Thanks for bringing that up!

fukmbas 6y ago

Anyone using a password manager tied to cloud deserves to be compromised lol. KeePass for the win

sam0x17 6y ago

Ruby support for 1Password Secrets please <3

fatiherikli 6y ago

Amazing product really works amazing great this is my password can I login to all the websites? Yes I can.

gogopuppygogo 6y ago

Maybe first it’s time to add a generate secure password button to the iOS app?

hacker_newz 6y ago

Unless it's possible to run this on premise I don't see how this could compete with Hashicorp Vault.

bwoodruff 6y ago
https://news.ycombinator.com/item?id=26799528 https://news.ycombinator.com/item?id=26799528 may help clarify. Also this component can run on premise - Ben, 1Password

mysql 6y ago

This feature seems really great, I have been waiting for a long time for them to fix filtering on hostname and port for OSX. This is really annoying for local development with docker. https://1password.community/discussion/99568/add-port-number-to-url-filter-for-available-logins https://1password.community/discussion/99568/add-port-number...