8 ms·

Ah neat, the app exposes an ssh agent socket: export SSH_AUTH_SOCK=~/.1password/agent.sock So you would essentially replace Keychain, Gnome-keyring, or th

Ah neat, the app exposes an ssh agent socket: export SSH_AUTH_SOCK=~/.1password/agent.sock So you would essentially replace Keychain, Gnome-keyring, or the vanilla SSH-agent with 1password. Very nice solution.

api 5y ago
Doesn't this give 1Password root on the universe? That's a general theme I see with all this SSO stuff. You have a few companies with root on the universe. Am I weird that this concerns me?
- otabdeveloper4 5y ago
  No, you're not.
- sbarre 5y ago
  The data that 1Password stores on their end is encrypted with your personal passphrase. So they can't see it even if they want to. Unless their local client was compromised (not impossible - but if your local is compromised you're in trouble regardless), even if someone hacked them and stole their data, they would not have your clear-text info. It's everyone's choice to make but I am personally OK with this security/convenience trade-off.. It's "good enough" for me - mostly because I trust them to know how to do this better than I could - if it means I can manage all my passwords in one place and access them from any device. 1Password also has useful (to me) quality-of-life features like integration with HaveIBeenPwned, it can also show you re-used passwords, and if you store credit cards or other info, it will also tell you when they're about to expire etc.. Plus you can store any arbitrary metadata with any record, so I even use it to store non-sensitive, but still private, info associated with logins, docs, ID, etc..
  - api 5y ago
    I am more concerned with the long term social and political implications of giving a small number of corporations elevated privileges (or the ability to obtain them easily) on everything in the world. If the NSA asked for escrow or root everywhere people would freak out, yet central SSO mostly accomplishes the same thing and people are running toward it because convenience. Of course the same is true for surveillance. Private adtech does things with surveillance that would give people a heart attack if the NSA did it, and unlike the NSA they don't even pretend to be accountable to anyone we can elect. (It's the same because governments can compel corporations under their jurisdiction and there isn't a ton a company can do about it.) While some may find this debatable, I happen to think we just had a rather incompetent but still very concerning fascist coup attempt in the USA. Historically civilizations lose their collective minds periodically. Given that computing infrastructure is becoming the basis for virtually all communication and much of life, is it wise to centralize access control like this? I feel like younger people of virtually all political stripes are just blithely unconcerned with this and assume "it can't happen here" or "that's something that happened back in the early 20th century but not anymore, we have totally solved stable government." I think that's incredibly naive.
    - anxrn 5y ago
      I'd suggest taking another look at how 1Password (or any other secrets management tool) deals with secret data. "the ability to obtain them easily" is not the case.
      - lazide 5y ago
        All of these managers that allow automatic updates or run off some cloud loaded executable (which is all of them essentially) can re-encrypt all your data to another arbitrary key on next unlock with some code changes. Those code changes could be pushed/loaded for specific customers only pretty easily. It’s not ‘all my passwords stored in their database unencrypted’ easy to compromise, but it’s also not protection against a motivated agency with jurisdiction said service has to respect, and it’s also not solid protection against any state level actor if they really care/want to spend resources targeting someone. That said, it’s all about threat assessment and trade offs. Especially for a business, what are the consequences if the NSA does x, or China does y? For 99% of businesses? Nothing except some irritation if you find out. Same as with most things. If someone is an activist going after those agencies/gov’ts? Probably quite severe consequences. If I remember correctly, some of the fallout from the Chinese gov’t hacking Gmail was folks being ‘disappeared’, extended families being held hostage in China, etc.
  - TehCorwiz 5y ago
    > The data that 1Password stores on their end is encrypted with your personal passphrase. For now. What happens when they eat enough of the market and displace enough other tools that the government says "Ok, now MitM the encryption." All they would need to do is push an update and re-encrypt the first time you unlock it. Now, this has always been true, but it's not on your servers and source repos yet, right now it's sandboxed. How about internet outages? Service outages? Sure, local cache, but that cache expires. I love PW managers, even cloud ones, but I wouldn't tie on directly to my local login and auth infrastructure to the exclusion of other local options. I have autofill turned off because it can fill into nefarious forms if you're not careful. And I copy and paste from my pw manager into my terminal when required, because again I don't want it automatically being helpful when I want to be careful.
    - electroly 5y ago
      Note that, to my knowledge, 1Password's local cache never expires, not even after you've been removed from the 1Password account on the cloud side.
    - YPPH 5y ago
      >And I copy and paste from my pw manager into my terminal when required I hope no other apps are watching your clipboard.
      - tclancy 5y ago
        At least on the Mac, it seems to use the secure clipboard so it’s not in view of other apps, but I may be wrong.
    - sbarre 5y ago
      > What happens when they eat enough of the market and displace enough other tools that the government says "Ok, now MitM the encryption." I'll take that risk, given probability over possibility. But thank you for pointing out at least one scenario I hadn't thought of! > How about internet outages? Service outages? Sure, local cache, but that cache expires. Local cache doesn't expire, also the probability of me being offline for so long that this becomes a problem is close enough to zero for my comfort. That said, I am guessing you might be responsible for some kind of critical (even just to you) infrastructure so we probably have different variables in our "is this for me" math..
- teeray 5y ago
  The intention of the user is to give them encrypted blobs of credentials that are useless to them. Those blobs are only decrypted locally. That distinguishes password managers from traditional SSO solutions where credentials are sent to a centralized system that grants authorization.
Saint_Genet 5y ago
Not really into replacing vetted, well tested open source software with a proprietary app with cloud storage.
- cpach 5y ago
  To each their own.
  - chiefalchemist 5y ago
    Not really. What is the case for not using well vetted best practices and replacing those with an unvetted proprietary solution? What problems does 1PW solve that necessitates taking on such risk? We're not talking about social media PWs. ssh keys are not something to add risk to, eh.
    - culturestate 5y ago
      > We're not talking about social media PWs. ssh keys are not something to add risk to, eh. I mean, 1Password already stores my credentials for the AWS console, Cloudflare, Netlify, GitHub, et al. I’m not sure adding my commit keys to that pile is dramatically increasing my exposure.
      - deleted 5y ago
        [deleted]
    - nijave 5y ago
      1Password is used at a lot of medium-small businesses where employees have shared credentials (usually these smaller businesses don't have built-out identity management systems to cover everything with SSO). A place I worked before would store SSH keys for build machine base images (AWS AMIs) in 1Password. It wasn't worth the trouble trying to setup SSO since the machines rarely needed accessed and only by a handful of people to troubleshoot/manage them. It's also common to share credentials when you're working with small SaaS that don't support multiple users or SSO. In addition, sometimes business integrations will have fixed credentials (like the SSH key to upload reports to a business partners SFTP server). People still need access to the keys for troubleshooting and debugging.
emptybottle 5y ago
What is the benefit over ssh-agent?
- MatthiasPortzel 5y ago
  The cloud syncing, I suppose. If you migrate devices frequently and have more than a single ssh key, it might make sense to log into 1Password instead of trying to securely copy your private key from one device to another. It does seem like a weirdly specific use-case. I wonder if they're trying to instead target people who need to use ssh keys but aren't comfortable generating or managing them on the command line. With Github requiring SSH keys for command-line pushes, this is probably a growing demographic.
  - soheil 5y ago
    But don't you restore a backup from iCloud whenever you get a new laptop anyway? And by device I don't think you mean an iPhone.
- noselasd 5y ago
  access to your ssh keys on any machine
- yabones 5y ago
  Other commenters have mentioned sync, which is absolutely nice, but one other advantage is shared keys. Obviously it's not ideal to share SSH keys, but lots of teams will share the default EC2 keypair for example. This makes it much easier to pop that key into 1Pass, share it with the team, and easily get everyone into the box. And, frankly, 1Password gui is much more user-friendly than other SSH agents. Personally, I'll stick with the tried and true OpenSSH agent, but I know many will be attracted by this feature.
  - AlexandrB 5y ago
    > Other commenters have mentioned sync Isn't this an anti-feature? The ability to revoke an SSH key specific to a stolen laptop from a server or your Github account seems like a benefit. Using the same SSH key on every machine is a downgrade. On the other hand, the ability to manage access to shared keys is really nice.
WhyNotHugo 5y ago
I wonder why they picker $HOME instead of the obvious choice like $XDG_RUNTIME_DIR. It's not like I'll ever need to manually interact with the socket, so keeping it out of the way would seem logical.

api 5y ago

Doesn't this give 1Password root on the universe? That's a general theme I see with all this SSO stuff. You have a few companies with root on the universe. Am I weird that this concerns me?

otabdeveloper4 5y ago
No, you're not.
sbarre 5y ago
The data that 1Password stores on their end is encrypted with your personal passphrase. So they can't see it even if they want to. Unless their local client was compromised (not impossible - but if your local is compromised you're in trouble regardless), even if someone hacked them and stole their data, they would not have your clear-text info. It's everyone's choice to make but I am personally OK with this security/convenience trade-off.. It's "good enough" for me - mostly because I trust them to know how to do this better than I could - if it means I can manage all my passwords in one place and access them from any device. 1Password also has useful (to me) quality-of-life features like integration with HaveIBeenPwned, it can also show you re-used passwords, and if you store credit cards or other info, it will also tell you when they're about to expire etc.. Plus you can store any arbitrary metadata with any record, so I even use it to store non-sensitive, but still private, info associated with logins, docs, ID, etc..
- api 5y ago
  I am more concerned with the long term social and political implications of giving a small number of corporations elevated privileges (or the ability to obtain them easily) on everything in the world. If the NSA asked for escrow or root everywhere people would freak out, yet central SSO mostly accomplishes the same thing and people are running toward it because convenience. Of course the same is true for surveillance. Private adtech does things with surveillance that would give people a heart attack if the NSA did it, and unlike the NSA they don't even pretend to be accountable to anyone we can elect. (It's the same because governments can compel corporations under their jurisdiction and there isn't a ton a company can do about it.) While some may find this debatable, I happen to think we just had a rather incompetent but still very concerning fascist coup attempt in the USA. Historically civilizations lose their collective minds periodically. Given that computing infrastructure is becoming the basis for virtually all communication and much of life, is it wise to centralize access control like this? I feel like younger people of virtually all political stripes are just blithely unconcerned with this and assume "it can't happen here" or "that's something that happened back in the early 20th century but not anymore, we have totally solved stable government." I think that's incredibly naive.
  - anxrn 5y ago
    I'd suggest taking another look at how 1Password (or any other secrets management tool) deals with secret data. "the ability to obtain them easily" is not the case.
    - lazide 5y ago
      All of these managers that allow automatic updates or run off some cloud loaded executable (which is all of them essentially) can re-encrypt all your data to another arbitrary key on next unlock with some code changes. Those code changes could be pushed/loaded for specific customers only pretty easily. It’s not ‘all my passwords stored in their database unencrypted’ easy to compromise, but it’s also not protection against a motivated agency with jurisdiction said service has to respect, and it’s also not solid protection against any state level actor if they really care/want to spend resources targeting someone. That said, it’s all about threat assessment and trade offs. Especially for a business, what are the consequences if the NSA does x, or China does y? For 99% of businesses? Nothing except some irritation if you find out. Same as with most things. If someone is an activist going after those agencies/gov’ts? Probably quite severe consequences. If I remember correctly, some of the fallout from the Chinese gov’t hacking Gmail was folks being ‘disappeared’, extended families being held hostage in China, etc.
- TehCorwiz 5y ago
  > The data that 1Password stores on their end is encrypted with your personal passphrase. For now. What happens when they eat enough of the market and displace enough other tools that the government says "Ok, now MitM the encryption." All they would need to do is push an update and re-encrypt the first time you unlock it. Now, this has always been true, but it's not on your servers and source repos yet, right now it's sandboxed. How about internet outages? Service outages? Sure, local cache, but that cache expires. I love PW managers, even cloud ones, but I wouldn't tie on directly to my local login and auth infrastructure to the exclusion of other local options. I have autofill turned off because it can fill into nefarious forms if you're not careful. And I copy and paste from my pw manager into my terminal when required, because again I don't want it automatically being helpful when I want to be careful.
  - electroly 5y ago
    Note that, to my knowledge, 1Password's local cache never expires, not even after you've been removed from the 1Password account on the cloud side.
  - YPPH 5y ago
    >And I copy and paste from my pw manager into my terminal when required I hope no other apps are watching your clipboard.
    - tclancy 5y ago
      At least on the Mac, it seems to use the secure clipboard so it’s not in view of other apps, but I may be wrong.
  - sbarre 5y ago
    > What happens when they eat enough of the market and displace enough other tools that the government says "Ok, now MitM the encryption." I'll take that risk, given probability over possibility. But thank you for pointing out at least one scenario I hadn't thought of! > How about internet outages? Service outages? Sure, local cache, but that cache expires. Local cache doesn't expire, also the probability of me being offline for so long that this becomes a problem is close enough to zero for my comfort. That said, I am guessing you might be responsible for some kind of critical (even just to you) infrastructure so we probably have different variables in our "is this for me" math..
teeray 5y ago
The intention of the user is to give them encrypted blobs of credentials that are useless to them. Those blobs are only decrypted locally. That distinguishes password managers from traditional SSO solutions where credentials are sent to a centralized system that grants authorization.

Saint_Genet 5y ago

Not really into replacing vetted, well tested open source software with a proprietary app with cloud storage.

cpach 5y ago
To each their own.
- chiefalchemist 5y ago
  Not really. What is the case for not using well vetted best practices and replacing those with an unvetted proprietary solution? What problems does 1PW solve that necessitates taking on such risk? We're not talking about social media PWs. ssh keys are not something to add risk to, eh.
  - culturestate 5y ago
    > We're not talking about social media PWs. ssh keys are not something to add risk to, eh. I mean, 1Password already stores my credentials for the AWS console, Cloudflare, Netlify, GitHub, et al. I’m not sure adding my commit keys to that pile is dramatically increasing my exposure.
    - deleted 5y ago
      [deleted]
  - nijave 5y ago
    1Password is used at a lot of medium-small businesses where employees have shared credentials (usually these smaller businesses don't have built-out identity management systems to cover everything with SSO). A place I worked before would store SSH keys for build machine base images (AWS AMIs) in 1Password. It wasn't worth the trouble trying to setup SSO since the machines rarely needed accessed and only by a handful of people to troubleshoot/manage them. It's also common to share credentials when you're working with small SaaS that don't support multiple users or SSO. In addition, sometimes business integrations will have fixed credentials (like the SSH key to upload reports to a business partners SFTP server). People still need access to the keys for troubleshooting and debugging.

emptybottle 5y ago

What is the benefit over ssh-agent?

MatthiasPortzel 5y ago
The cloud syncing, I suppose. If you migrate devices frequently and have more than a single ssh key, it might make sense to log into 1Password instead of trying to securely copy your private key from one device to another. It does seem like a weirdly specific use-case. I wonder if they're trying to instead target people who need to use ssh keys but aren't comfortable generating or managing them on the command line. With Github requiring SSH keys for command-line pushes, this is probably a growing demographic.
- soheil 5y ago
  But don't you restore a backup from iCloud whenever you get a new laptop anyway? And by device I don't think you mean an iPhone.
noselasd 5y ago
access to your ssh keys on any machine
yabones 5y ago
Other commenters have mentioned sync, which is absolutely nice, but one other advantage is shared keys. Obviously it's not ideal to share SSH keys, but lots of teams will share the default EC2 keypair for example. This makes it much easier to pop that key into 1Pass, share it with the team, and easily get everyone into the box. And, frankly, 1Password gui is much more user-friendly than other SSH agents. Personally, I'll stick with the tried and true OpenSSH agent, but I know many will be attracted by this feature.
- AlexandrB 5y ago
  > Other commenters have mentioned sync Isn't this an anti-feature? The ability to revoke an SSH key specific to a stolen laptop from a server or your Github account seems like a benefit. Using the same SSH key on every machine is a downgrade. On the other hand, the ability to manage access to shared keys is really nice.

WhyNotHugo 5y ago

I wonder why they picker $HOME instead of the obvious choice like $XDG_RUNTIME_DIR. It's not like I'll ever need to manually interact with the socket, so keeping it out of the way would seem logical.