Comment by gregoriol
3 hours ago
If your system is compromised, it doesn't matter what you are using: the attacker will get the password for whatever secure thing you store your secrets in.
3 hours ago
If your system is compromised, it doesn't matter what you are using: the attacker will get the password for whatever secure thing you store your secrets in.
Maybe. Maybe not. It depends on the sophistication of the malware. Generally my impression is that these install-script type attacks cast a wide net. I would hazard a guess that they would not know how to even ask my 1Password for the keys. They are in an account they dont know, in a vault they dont know, and have a name they dont know
Sure, but is your system compromised because someone left a key in plaintext? Attack surface is finite and can be meaningfully reduced.