Hacker News Reader

Comment by terabytest | Hacker News Reader

Could you share a little bit about what you'd want to use this for? (I'm part of the 1Password design team)

SSH keys have both a private and a public file. The private file is multi-line text.

I don't like putting the private key in the notes field, because its name is still "notes" (but I'd prefer the label be the key's file name), it's actually markdown formatted text, not literal text, and what if I still want to write a note, but I've already used the notes field for the key?

HTTPS certificates including multiple certificate chains, and private keys, and those are all multi line files. And each part should go into a separate clearly labeled multi line field. And I don't want to be forced to write a copy of my server's ssh key into a local file on my laptop in order to attach it to a 1Password file field, and remember to delete it quickly before Time Machine backs it up for posterity.

Right now I am forced to concatenate all my certificates and keys into the "notes" field, and write the file name before each part, and put blank lines between each file, which is terribly inconvenient and error prone.

I also put a multi-line list of all the user names and passwords that I set up on a server.

There are millions of other reasons why anyone might want to use a multi line text field beyond ssh keys and certificates, just use your imagination.

My question is why wasn't this obvious feature supported from day 1, like I fully expected it to be with I bought a 1Password license? Why did I have to find that out for myself the hard and disappointing way, because I never noticed a section in the 1Password manual or promotional advertisements about why 1Password made the decision not to support multi line text fields. I'd love to know the reasoning behind that decision.

[Edit in response to "Maybe I don’t understand, but couldn’t you use the notes section? Wrap whatever you need in triple backticks to create a code block?":]

I PAYED for 1Password, and the company I work for standardized on it and requires we use it, so I kind of expect not to have to jump through those kinds of pointless hoops with a commercial product. I should be able to select-all/copy/paste without meticulously selecting just the right text character-by-character. The time I waste doing just that would pay for a yearly subscription to a better product.

Maybe a solution would be to get inspiration from keepass(xc) attachement's feature. It allows you to save abitrary files as attachement to an entry (btw this is how keepassxc does ssh key managment). Other keys/ certs (like HTTPS certs) would be supported such a feature too.

The 'only' downside is the comparatively high increase in database size for the hoster.

1Password already has this…

Judging by both the GP's not having been aware of it, and the process described in a sibling comment [1], I suspect the feature has a discoverability problem.

(Does the same feature exist on mobile? How are file attachments represented on mobile?)

[1] https://news.ycombinator.com/item?id=30365088

The feature exists on mobile, there's a "Related items" section that has a list of file names with a ">" caret next to each one. If you tap on an entry it opens in a new page where you can tap "View document" to see its contents. You can also see when it was created and updated, share it, add tags to it, add it your favorites, and more.

It works perfectly fine, with no missing features. I use it to store private keys and recovery codes, mainly.

I don’t know your workflow or demands so maybe this is simplistic. But you can just drop any file over a 1Password entry and it gets attached to that entry.

So, if you have a .crt, .pfx, .txt or whatever, just attach it to the entry.

Thank you for the feedback!

We spoke about it internally many times in the past but couldn't get the solution implemented because there was always something in the way. After reading your comments and I talked to the team and we just merged a change that should appear in the nightly build and make the handling of the multi-line fields better. Having a single core in 1Password 8 makes things so much easier when it comes to implementing changes across all platforms.

Also, there is a new SSH Key item type that might help in this particular case.

-- Roustem 1Password Founder

Amazing, I wanted this too. Thank you.

1Password has literally blown me away every second that I've used it. And the ability to sync MFA between all your devices was the push that I needed to start using MFA.

I do have a feature request though - any chance we could lock our 1Password wallet using 2FA with SMS (like Office365 or banks) rather than a device authentication key? Main concern is that personal devices are breaking all the time ... SMS is "strong enough" and yet pretty much the only second factor that is convenient to recover in the event of a disaster.

SMS is not strong enough, especially for protecting ALL of your 2FA codes + passwords. SIM swapping attacks frequently occur, and it doesn't even have to be with your carrier.

Just wanted to add that the nightly build 80600030 is now available. Would love if you could give it a try and see if the newly added textfields are working better for you?

Thank you so much! Works as expected, with a small caveat: note that only newly created text fields support multiline; text fields which have already been created with an older build than 80600030 seem to remain single line.

Yes, it was the simplest change we could make. Hopefully it makes things better without breaking anything else

Thank you, I really appreciate that, and it will save me and others a lot of time and effort! Spectacular turn-around. I'm looking forward to upgrading to 1Password 8. Please also put some love into the 1Password CLI utility "op" too, so it's safe and useful for unattended scripts.

Oh, if you are using CLI then you will love the new integration we are building in 1Password 8: https://developer.1password.com/docs/cli/use-biometric-unloc...

If you're in here collecting feedback, I would second this request for the same reasons (keys, certs, other structured text I wish I could just copy/paste easily from the UI).

Been a happy paying customer since 1Password v4, but I agree this seems like an easy win.

Personally, mainly for OTP recovery codes.

I use it for this as well.

P.S: I'm not one to write "me too" comments, but there's no upvote count visibility for users. And since a designer working at 1p has eyes on the thread, it might make sense to add "me too" comments?

+1 as well. Not a lot of usage, but sometimes you want to add multiline notes (there’s a notes field, I know, every others field type can be added).

I’ll add a “me too” comment as well as add that I’d expect to be able to have what is essentially a multi line password field where the contents are obscured.

Or a special feature to transform a set of OTP recovery codes into separate password fields so I can easily copy just one and then remove it without having to edit a multiline field to remove the one I just used.

This.

He already said. Private keys, certs, etc.

Same for things like recovery codes / recovery phrases, although I'm not sure how highly i'd rate a security posture of keeping a password, a 2fa code generator, and recovery codes all in the same entry in a password manager.

Private keys and certs are multi-line. Just tested the secure note and ssh key entry types.

I know HN probably isn't representative of the population, but I imagine we skew heavily on the technical side of this and I would echo OP's suggestion. It would be very helpful for many developer and potentially other use cases as others have made a case for.

If they are targeting enterprise users you’d think they already know how it would be helpful.

It would be nice if 1Password understood private key + certificate pair, how it is used often for TLS connections.

Also for storing backup keys.

Thanks for replying! As long as I have your ear, I've got another question about the 1Password command line tool, "op":

https://1password.com/downloads/command-line/

I am trying it out, and hope it will be as useful for cases like using the Google Cloud CLI's secrets command to retrieve secrets in automated scripts, like "gcloud secrets versions access latest --secret=wildcard_foo_com_pem".

https://support.1password.com/command-line-getting-started/

I've followed the installation and authentication instructions, and ran "op signin my.1password.com foo@bar.com", entered my account's secret key, my account's password, then it prompted for "Enter your six-digit authentication code:". But I didn't receive any text messages with authentication codes on my phone.

So now I am stuck. I don't have 2FA set up on my 1password account, apparently. Do I need to do that in order to use "op", and how do I do that?

More importantly, when I write a script that authenticates using the "op" command line utility, how can it accomplish the two-factor authentication step without me being present behind the keyboard and entering a response manually? And is there a better way to write a script that authenticates somehow without using my literal secret key and password and 2fa code?

This seems to be an open issue since at least March 2019. Has it been fixed yet, or is a fix planned? Should I just give up trying to use "op" to write automated unattended scripts, the way I use "gcloud secrets"?

https://1password.community/discussion/97138/cli-always-requ...

>CLI always requires authentication code

>I am using the op CLI and I also have two-factor authentication enabled. Every time I authenticate to op, it asks for the authentication code. This gets annoying quickly and does not help in my quest to automate CLI signin.

>$ op signin YYY

>Enter the password for XXX at YYY.1password.com:

>Enter your six-digit authentication code:

>Is there a way to convince op that it is running on the same host similar to the way the 1password application and browser extensions do?

>Reply:

>@razorsedge unfortunately the CLI has something of an "incomplete" implementation of 2FA, only in that it does not persist the 2FA secret after the first authentication. All the other apps persist this secret, allowing them to do 2FA "silently" in the background, but that has not yet been implemented on the CLI. It's something we look to do in the future, but I can't give a timeline on when it will be available.

>[...]

https://github.com/dcreemer/1pass/issues/17

>Support TFA for 1password accounts #17

>I have TFA enabled for my 1password account. Unfortunately, 1pass can't handle this and instead of letting me input the token, the TFA prompt instantly returns and fails.

>signing in to xxx.1password.com alpipego@xxx.com

>Enter your six-digit authentication code: [LOG] 2019/03/17 12:53:25 (ERROR) Incorrect One-Time Password length. Expected 6.

>1pass failed to signin to xxx.1password.com

>It'd be great if TFA support could be added.

Thank you, Don!

Did you have a chance to look at CLI 2.0 and 1Password 8 integration: https://developer.1password.com/docs/cli/use-biometric-unloc...

Reply on news.ycombinator.com