1Password for SSH changed the way I work
Tags: security, webdev, programming, productivity
Published: 2022-05-09 17:12:06

[1Password for SSH](https://blog.1password.com/1password-ssh-agent/) was shared with the world last month. I have been using it since it was available for internal beta. I knew it would improve my endpoint security. I didn’t expect it to change ~~the way I generated, stored and used SSH keys~~ the way I work.

Let me take a step back.

The first time I used SSH, I connected my college’s [global lab linux server](https://www.csee.umbc.edu/courses/undergraduate/341/fall04/hood/notes/ssh/) with [PuTTY](https://www.putty.org/). I used a username and password to authenticate and never really appreciated [the magic that made it all work](https://datatracker.ietf.org/doc/html/rfc4253). It was a step away from the familiar world of FTP and RDP.

SSH later became an integral part of my developer experience when my job switched from [Subversion](https://subversion.apache.org/) to [Git](https://lwn.net/Articles/165127/). I was a Jr. Developer at the time and struggled to generate an SSH key. Another developer on the team generated an RSA key pair for me and shared it on a thumb drive. It was some years later before I realized [this was less than ideal](https://www.freebsd.org/news/2012-compromise/).

Eventually, I fell into a routine. I would get a new laptop, generate a private key – sometimes I would even use a passphrase – and upload the new key to all the services I used (GitHub, VPS, etc.). I used the one-key-per-device pattern and repeated the process for my phone and other devices. Occasionally, I’d pull a device from cold storage for something I forgot about.

The problem was that each SSH key represented one of my devices; it had no purpose attached to it. I used the same keys for work, open source contributions, file servers and a lot more. When I unlocked a key for one use, I unlocked it for all uses.

_1Password for SSH has entered the chat_

The [1Password SSH Agent](https://developer.1password.com/docs/ssh/) has a stricter authorization model than the OpenSSH Agent[1] defaults[2]. Instead of a key either being available or unavailable, a key has an authorized session. An authorized session consists of the key pair and either a terminal session or application. I wanted to be able to deliberately authorize a set of actions for my current context (e.g., work or open source).

Thus, a new way of working.

I generated a new key pair for each of my use cases. [1Password in the browser](https://support.1password.com/getting-started-browser/) made this really easy by autofilling the new key in the GitHub and Gitlab public key forms. Now, when it’s time to get to work, I open my terminal and run a git fetch. 1Password prompts for my fingerprint and I approve the usage of my Work SSH key.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8vwhpcdsxzbf3cgnbt7y.png)

I’m not prompted again while actively using my laptop. When it’s time to switch to an [open source project](https://github.com/neon-bindings/neon), I’m seamlessly prompted for my GitHub key.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tmo7e9ygcnwdw34vwhf0.png)

A little later, when I need to update my blog, I pop open a new terminal tab and start an SSH session. I forward my SSH Agent with `ssh -A` so that I can perform a `git pull` while I’m there[3]. When I’m done, I `exit` the terminal session, deauthorizing it from the 1Password SSH Agent.

Now, generating SSH keys is no longer part of my new device flow! All of my SSH keys are saved in 1Password and synchronized across my devices.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0elf7hbrtnzccybiuhwd.png)

I’m really excited for Git’s recent addition of [commit signing with SSH keys](https://github.com/git/git/blob/master/Documentation/RelNotes/2.34.0.txt). It already [works with 1Password SSH](https://git-scm.com/docs/git-config#Documentation/git-config.txt-gpgformat) and I can’t wait for [GitHub](https://github.com/github/feedback/discussions/7744) and [Gitlab](https://gitlab.com/gitlab-org/gitlab/-/issues/343879) to support verification!

---

[1] [SSH agent restriction](https://www.openssh.com/agent-restrict.html) looks really cool! ↩︎

[2] Similar functionality is available with `ssh-add -c`. ↩︎

[3] Eventually I’ll get around setting up a [GitHub Action](https://docs.github.com/en/actions). At least, that’s what I tell myself. ↩︎

This [post originally](https://blog.1password.com/1password-ssh-changed-how-i-work/) written by K.J. Valincik, Senior Staff Developer at 1Password.