Comment by thecopy
4 hours ago
It does help in that the secrets are not in plain-text, readable for any script you run. With 1Password, a process asks for the password and it gets transferred not through the filesystem but through IPC. 1Password shows a dialog: "Do you want iTerm to get your SSH key ABC123?"
In my thinking, this is more secure than plaintext in filesystem
If your system is compromised, it doesn't matter what you are using: the attacker will get the password for whatever secure thing you store your secrets in.
Maybe. Maybe not. It depends on the sophistication of the malware. Generally my impression is that these install-script type attacks cast a wide net. I would hazard a guess that they would not know how to even ask my 1Password for the keys. They are in an account they dont know, in a vault they dont know, and have a name they dont know
Sure, but is your system compromised because someone left a key in plaintext? Attack surface is finite and can be meaningfully reduced.