I refuse to use op cli because of the absolutely bunkers security model that’s a wontfix:
replyhttps://news.ycombinator.com/item?id=45478553
https://codeberg.org/manchicken/1password-cli-vuln-disclosur...
Risk of exposing a single credential is nothing compared to the risk of exposing everything through op cli’s expected behavior. Has there been any improvement on this?
I read up and that vuln and it’s not the behavior I see. Any read operation to any key in any vault requires auth. Even if the vault is “open” it still asks me every time.
replyThis is false, I just ran my own thorough reproduction script on macOS with latest 1Password app and op cli. Approve a prompt once in a shell session, and all subsequent read attempts of any other secret in that vault from the same shell session (including from subprocesses) don’t result in additional prompts within the time threshold. It’s not at all granular.
replyI think I remember a Bitwarden CLI supply chain vulnerability a few months ago?
replyreply
deleted
replyThis seems like a gh issue as well as Claude abusing it. Why should I be able to get the token for GitHub through this call without further authorization?
reply