We designed the 1Password SSH agent with the belief that: The 1Password SSH agent and its integration fix those problems, but it means that some of us old-timers need to adjust how we think about SSH keys. But certain security practices - and unintended consequences - followed, and they’ve been problematic since. This all made sense at the time SSH was invented. A key pair didn’t so much belong to a person, but a user logged on to a particular host. SSH key management tools and conventions grew out of that environment. Some of us old-timers need to adjust how we think about SSH keys. SSH private keys were associated not just with individuals, but individual accounts on particular hosts.

The short version is that SSH was originally a drop-in replacement for rsh (remote shell) and rlogin, which were centered around one machine trusting another machine, or one account on a machine trusting an account on another machine. Today, I’ll discuss a re-evaluation of the security properties and habits some of us old-timers may have regarding SSH keys, and which of those habits are outdated. The 1Password SSH agent is a big step toward aligning practices with the modern world.Įarlier this year, we introduced the 1Password SSH agent as part of our commitment to bring developers the kinds of things developers want to see. SSH key management practices reflect the environment in which they were first introduced.

1password help