alt Hacker NewsThis thing apparently has an integration with 1Password. Am I hopelessly out of touch in this brave new AI world, or is giving an LLM access to your password manager the mother of all bad ideas?
Replies
1Password has had vaults for a very long time now. You can also key API credentials specifically to a vault. I've been letting agents access _their own_ vault for awhile.
Yeah I certainly wouldn't give it access to that tbh
better than .envs and plaintext, which was largely the case so far
I have a custom wrapper for 1PW that lets an agent browse and request credentials, then I can provide it a lease to access those for a certain amount of time. Super nice and I hope they build that in to 1PW itself.
Oh I absolutely LOVE letting claude code manage passwords via 1password! I have the CLI installed, I have whatever 1password calls a subdirectory/permission group, and I have some ssh keys and other passwords that I would have otherwise stored in an `.env` file of some kind. The biggest difference is I'm able to update the permission group and have all of my agents get the new permissions without manually updating them all.
It also feels safer? But I'm not sure if that's truly the case.
If done correctly, the agent will only be able to request that passwords be filled, but the secrets will only be handled by the password manager and browser extension, which will be able to set some security boundaries and make checks on which domains are allowed.
If your issue is allowing agents to use your credentials and take actions on your behalf, then that is a separate question.