Hacker News Reader

Comment by roarcher | Hacker News Reader

This thing apparently has an integration with 1Password. Am I hopelessly out of touch in this brave new AI world, or is giving an LLM access to your password manager the mother of all bad ideas?

View on HN

If done correctly, the agent will only be able to request that passwords be filled, but the secrets will only be handled by the password manager and browser extension, which will be able to set some security boundaries and make checks on which domains are allowed.

If your issue is allowing agents to use your credentials and take actions on your behalf, then that is a separate question.

What prevent the agent from setting up a keylogger on background so that in the future it can quickly retrieve password for you ?

What prevents an agent from using your credit card to hire a hit squat to abduct your children?

The prompt. That prompt has to come from somewhere.

How do you make sure your agent will align with the implication in your prompt. Even OAI agent will hack the shit out of HG if the prompt is not clear enough.

"If done correctly" is load-bearing in Claudespeak.

1Password has had vaults for a very long time now. You can also key API credentials specifically to a vault. I've been letting agents access _their own_ vault for awhile.

better than .envs and plaintext, which was largely the case so far

I have a custom wrapper for 1PW that lets an agent browse and request credentials, then I can provide it a lease to access those for a certain amount of time. Super nice and I hope they build that in to 1PW itself.

Cant you do exactly this with the CLI?

No, not as far as I can figure. Sure, Claude can access secrets with the CLI but it's not very granular usually it's just asking for access to all secrets

Ah, that's fair. I setup a dedicated vault for my Claude Code and only gave it access to the secrets I'd probably otherwise have in a `.env`.

Just an idea, is it possible to automatically rotate secrets immediately after they're used or are these things like passwords to online platforms that need to go through a reset flow.

I do this too and have a wrapper around tool calls which masks the password on tool call output, and unmasks on input. So the LLM just sees a temp credential

Yeah I certainly wouldn't give it access to that tbh

I think a better way would be to use something like secret-tool on a fully local setup. I'd still be wary of granting fully autonomous access to the system even with that setup (it would be better to have some set of passwords that are "in scope" for certain actions,where all others require a manual check and override).

It is. That whole concept of always-on agents, as currently implemented by Meta, OpenAI, Anthropic is a security and privacy nightmare

Oh I absolutely LOVE letting claude code manage passwords via 1password! I have the CLI installed, I have whatever 1password calls a subdirectory/permission group, and I have some ssh keys and other passwords that I would have otherwise stored in an `.env` file of some kind. The biggest difference is I'm able to update the permission group and have all of my agents get the new permissions without manually updating them all.

It also feels safer? But I'm not sure if that's truly the case.

Reply on news.ycombinator.com