1Password asking for permission each time

8.8.0~126.BETA anchors the session to fish, as expected.

@"Marton.Soos_1P" +1 on additional config, we have microservices, so I typically have quite a few shells open at any given time.

also +1 on additional config. It's fine to make a super secure default setting, as long as you let me and my teammates choose to configure it in a slightly less secure, but much more usable way.

Using the SSH agent with GitKraken or VSCode on Windows is currently unusably annoying. Prompts every time it does a pull or fetch. I have tried updating 1Password to the latest beta build and the result is the same.

@voltboyee Which version of git do you have installed? You should have git 2.33 or above for prompting to work well on windows

@barneydesmond @yboulkaid @verboese @hstenzel @addy @Stefan_Schulte In the latest beta, you can now configure the SSH agent authorization model to not prompt for each terminal tab, but only once per application. Let me know if that improves things for you!

@floris_1P what else can you say about this?

Is it once forever, or is it once per configurable period?

At the end of the day, I'm really looking for usage semantics similar to openssh's ssh-agent: if the key is in 1Password and 1Password is unlocked, then I can ssh with public key authentication transparently. I understand the tradeoffs associated with this decision, but if 1Password is unlocked and an attacker has access to my device, they can already steal my key. Why is the model for ssh keys accessed by agent different than the model for secrets accessed by the op command line or the gui?

Thanks, I'm looking forward to trying this enhancement.

@floris_1P thanks for getting back to us. I gave the feature a try by configuring to be as permissive as possible (ask for approval once per new application + remember until 1Password quits), and the experience is much better than before. After having clicked through the prompt a couple times (once per application), I don't get any prompts during my regular workflow.

I would still prefer to have the permission be global for all applications. This would mimic the ssh-agent behavior and be more "transparent", as @hstenzel mentioned.

To me the value provided by the 1Password SSH integration is more about the key storage than about auditing key access. Which is why I would like to have as few prompts as possible.

Yeah - I'm coming from KeepassXC - where the SSH Agent doesn't prompt me at all (which I prefer) as long as the keychain is unlocked.

Given that I have background sync processes, backups, ssh sessions etc etc etc, getting prompted every 5 minutes is a royal pain in the butt.

I have enabled "Remember key approval: until 1Password quits" and "Ask approval for each new: application" and yet it still expires every time, and I have to re-authorize the agent when VSCode runs a background git pull.