3 ms·

My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary

My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities? And why would I replace the openssh agent with 1password agent? They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard? (the above logic is why I don't make any serious money)

turboponyy 5y ago
cat key | xclip -selection clipboard # is even easier after you alias the second part (edit: or whatever the Wayland equivalent for xclip is)
- zaik 5y ago
  wl-copy < key
tzs 5y ago
EDIT: Never mind. I misread and thought he was talking about password managers in general, not specifically for public keys. > They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard? In the case of browsers cat and copy/paste is often more risky than having code such as a password manager fill the fields. Password managers are less likely to be fooled by sites using tricks with their names to pose as other sites. If you are sufficiently careful to be sure you will not be tricked by phishing attempts then cat and copy/paste should be fine.
- detaro 5y ago
  ... for public keys?
bvm 5y ago
> that has had multiple recent serious vulnerabilities? has it? could you detail them, i'm OOTL.
- sbarre 5y ago
  Yeah I'm also curious about this rather bold yet detail-free statement.. https://www.cvedetails.com/vulnerability-list/vendor_id-12550/product_id-23779/Agilebits-1password.html https://www.cvedetails.com/vulnerability-list/vendor_id-1255... I see only one CVE from 2018. But I am not an expert in these circles, so would also love to know more.
maccard 5y ago
> Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities? Can you share some info on those serious vulnerabilities? > They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard? So they don't offer any additional functionality except for the functionality that you don't think is worth it?
AndyMcConachie 5y ago
I have no idea why you're getting downvoted. I don't use 1password for anything and I don't recommend anyone use it for anything. I will never use a 3rd party service to manage my passwords or key phrases. And why in God's name are people generating SSH keys in the browser? The thought of using it for SSH or GitHub just sounds insane to me. And as you say it doesn't even really offer any benefit over cutting and pasting from the CLI.
- maccard 5y ago
  They're being downvoted for making unsubstantiated claims about security vulnerabilities, and for not understanding the benefits of avoiding copy+pasting. > And as you say it doesn't even really offer any benefit over cutting and pasting from the CLI. It saves you from the fact that every application on your system, and some browser extensions can read your clipboard silently with no way for you to know. It saves you from phishing attacks from gіthub.com (note the i is a cyrillic i), it saves you from misconfigured permissions on your ssh folder, and from any "nosey" pip/npm install scripts that you might run on your development machine. It also means you don't lose your ssh keys in the case of data failure.

turboponyy 5y ago

cat key | xclip -selection clipboard # is even easier after you alias the second part (edit: or whatever the Wayland equivalent for xclip is)

zaik 5y ago
wl-copy < key

tzs 5y ago

EDIT: Never mind. I misread and thought he was talking about password managers in general, not specifically for public keys. > They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard? In the case of browsers cat and copy/paste is often more risky than having code such as a password manager fill the fields. Password managers are less likely to be fooled by sites using tricks with their names to pose as other sites. If you are sufficiently careful to be sure you will not be tricked by phishing attempts then cat and copy/paste should be fine.

detaro 5y ago
... for public keys?

bvm 5y ago

> that has had multiple recent serious vulnerabilities? has it? could you detail them, i'm OOTL.

sbarre 5y ago
Yeah I'm also curious about this rather bold yet detail-free statement.. https://www.cvedetails.com/vulnerability-list/vendor_id-12550/product_id-23779/Agilebits-1password.html https://www.cvedetails.com/vulnerability-list/vendor_id-1255... I see only one CVE from 2018. But I am not an expert in these circles, so would also love to know more.

maccard 5y ago

> Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities? Can you share some info on those serious vulnerabilities? > They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard? So they don't offer any additional functionality except for the functionality that you don't think is worth it?

AndyMcConachie 5y ago

I have no idea why you're getting downvoted. I don't use 1password for anything and I don't recommend anyone use it for anything. I will never use a 3rd party service to manage my passwords or key phrases. And why in God's name are people generating SSH keys in the browser? The thought of using it for SSH or GitHub just sounds insane to me. And as you say it doesn't even really offer any benefit over cutting and pasting from the CLI.

maccard 5y ago
They're being downvoted for making unsubstantiated claims about security vulnerabilities, and for not understanding the benefits of avoiding copy+pasting. > And as you say it doesn't even really offer any benefit over cutting and pasting from the CLI. It saves you from the fact that every application on your system, and some browser extensions can read your clipboard silently with no way for you to know. It saves you from phishing attacks from gіthub.com (note the i is a cyrillic i), it saves you from misconfigured permissions on your ssh folder, and from any "nosey" pip/npm install scripts that you might run on your development machine. It also means you don't lose your ssh keys in the case of data failure.