Hacker News Reader

Comment by trabant00 | Hacker News Reader

My SSH key and passphrase are the holy of holies security wise. It's such a simple, mature, battle tested, open solution. Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities?

And why would I replace the openssh agent with 1password agent?

They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard?

(the above logic is why I don't make any serious money)

View on HN

> that has had multiple recent serious vulnerabilities?

has it? could you detail them, i'm OOTL.

Yeah I'm also curious about this rather bold yet detail-free statement..

https://www.cvedetails.com/vulnerability-list/vendor_id-1255...

I see only one CVE from 2018. But I am not an expert in these circles, so would also love to know more.

EDIT: Never mind. I misread and thought he was talking about password managers in general, not specifically for public keys.

> They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard?

In the case of browsers cat and copy/paste is often more risky than having code such as a password manager fill the fields. Password managers are less likely to be fooled by sites using tricks with their names to pose as other sites.

If you are sufficiently careful to be sure you will not be tricked by phishing attempts then cat and copy/paste should be fine.

... for public keys?

> Why would I put that in a proprietary opaque solution that has had multiple recent serious vulnerabilities?

Can you share some info on those serious vulnerabilities?

> They don't even offer additional functionality over the open tools. "Autofill public keys in your browser for Git and other cloud platforms" - really? cat and copy - paste is now too hard?

So they don't offer any additional functionality except for the functionality that you don't think is worth it?

cat key | xclip -selection clipboard # is even easier after you alias the second part (edit: or whatever the Wayland equivalent for xclip is)

wl-copy < key

I have no idea why you're getting downvoted. I don't use 1password for anything and I don't recommend anyone use it for anything.

I will never use a 3rd party service to manage my passwords or key phrases. And why in God's name are people generating SSH keys in the browser?

The thought of using it for SSH or GitHub just sounds insane to me. And as you say it doesn't even really offer any benefit over cutting and pasting from the CLI.

They're being downvoted for making unsubstantiated claims about security vulnerabilities, and for not understanding the benefits of avoiding copy+pasting.

> And as you say it doesn't even really offer any benefit over cutting and pasting from the CLI.

It saves you from the fact that every application on your system, and some browser extensions can read your clipboard silently with no way for you to know. It saves you from phishing attacks from gіthub.com (note the i is a cyrillic i), it saves you from misconfigured permissions on your ssh folder, and from any "nosey" pip/npm install scripts that you might run on your development machine. It also means you don't lose your ssh keys in the case of data failure.

Reply on news.ycombinator.com