These days I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who (The dialog 1Password shows is pretty bad) that it would be very easy for something to slip in there.
reply> I’m getting so many 1Password prompts for agents pulling env variables out of it and with very little context of what is being accessed by who
replyThis is a one-sentence horror story. I almost can't believe someone would let this happen, unless the 1Password account is not important (highly unlikely).
Permission fatigue is real.
replyI know it sounds bad, but it’s the reality for most people, just like permission prompts at every corner and after each macOS / app update (“Your screenshot app is watching your screen”, no shit, that’s why I installed it).
replyI have been using Yubikeys for years, according to this guide: https://github.com/drduh/yubikey-guide
replyThe nice thing is that using the private key requires physical touch. That means that AI itself (or a remote attacker, for that matter) can't do things unless I confirm.
if $5.6B is protected by your index finger then you're gonna need kidnap insurance, and a really good pair of gloves.
replyIt's not protected by the index finger at all. There is no fingerprint reader in a Yubikey. The only protection is that it requires physical access and can't be triggered from software.
replyIf you're not buying the biometric ones, sure. Now you don't even need the gloves. Maybe kneecap armor instead.
replySigh. I forgot I posted this in a crypto-related thread.
replyHow would that help when your workstation is compromised? They can just steal your authentication the moment you log in through the password manager
replyIt does help in that the secrets are not in plain-text, readable for any script you run. With 1Password, a process asks for the password and it gets transferred not through the filesystem but through IPC. 1Password shows a dialog: "Do you want iTerm to get your SSH key ABC123?"
replyIn my thinking, this is more secure than plaintext in filesystem
If your system is compromised, it doesn't matter what you are using: the attacker will get the password for whatever secure thing you store your secrets in.
replySure, but is your system compromised because someone left a key in plaintext? Attack surface is finite and can be meaningfully reduced.
replyMy secret is `4`. Is that ok? Do I still need to move it??
replyI use 'Solarwinds123'
reply4 is fine, but only if you’re a certificate authority.
replyas for ssh keys, you can generate your keypair in secure enclave and reuiqre touchId for every new ssh session. The private key never leaves the secure enclave.
replyProbably the better option instead of relying on a password manager.
replyIt is a tradeoff. When using secure enclave, you need a second backup keypair in cold storage that needs to be secured.
replyIsn’t the password manager a prime target too?
replyyou know most password managers have open sockets, or other channels to other local processes to interact with and allow stealing entries?
replyyou know most tools like gcloud, bitwarden, etc store auth keys just in dotfiles too?
Local compromise is KO now, and we can't do shit on platforms like MacOs didn't research Linux recently