18 ms·

I don't get why people are making out this isn't a big issue - people would assume whatever is saved in the 'vault' is completely encrypted. You'd never encryp

by vuchr 11y ago

I don't get why people are making out this isn't a big issue - people would assume whatever is saved in the 'vault' is completely encrypted. You'd never encrypt a password but leave all the filenames/directories viewable without the password... (I've noticed this before when grep-ing for a domain, and it came up with stuff from my 1Password vaults, but couldn't work out a better solution so still stick with 1password ). Its a shame, because 1password is great in almost all other aspects.

SloopJon 11y ago
WinZip made a similar choice with its encrypted archives: you could see the list of directories and files before supplying a password. I would prefer that my account info be encrypted, but I can't use the new OPVault format, because it requires 1Password 5, which isn't supported on OS X 10.9.
- lqdc13 11y ago
  I think it is just how the .zip format works, not just the WinZip program. It's very easy to get around that though by double zipping.
  - icebraining 11y ago
    PKWARE added filename encryption to the spec in version 6.2, but WinZip never added support for that feature.
  - SloopJon 11y ago
    WinZip encryption is an extension to the Zip format that they defined: http://www.winzip.com/win/en/aes_info.htm http://www.winzip.com/win/en/aes_info.htm
- kelleyk 11y ago
  This is actually not the whole story. WinZip archives can be encrypted like you describe, but they can also be created with both the data and the list of contents encrypted.
DavideNL 11y ago
i agree. In my opinion, when they came up with the new data format (OPVault), they should have made some kind of in-app notification/workflow to let people automatically convert to this new format. Nobody reads all release notes, it's impossible. If you're not a computer nerd, you're using the old format forever. I've also complained about this on their blog at the time. By the way, the fact that not "everything" is encrypted is - sadly - also stated on their website: https://support.1password.com/opvault-design/ https://support.1password.com/opvault-design/ > The Agile Keychain kept some information (most notably Location and Title) unencrypted so that these could be used to search for or identify a particular item, while the more sensitive content could remain encrypted. With the Agile Keychain format, the browser extensions could identify and list potential matches for a website without having to be “unlocked”. With the OPVault format, we have moved away from that. The user must unlock the data with their Master Password before they can see a list of Logins.
rrego 11y ago
>You'd never encrypt a password but leave all the filenames/directories viewable without the password... I'm still not convinced that it isn't acceptable to leave your filenames/usernames still visible without the password for ANY password manager. The first point is a valid concern, but minor. His second point is really only relevant to this 1password service. Reason I ask is because I use pass + remote git server. Pass doesn't encrypt the filenames so the files are easily searchable. Are there any risks to this method?
- FatalBaboon 11y ago
  I have the same setup (pass [0] + private git repository via Gitlab). Password-wise it is as safe as my ssh key + gpp key, so pretty strong. Metadata wise it is as safe as my ssh key + gitlab account (still pretty strong), or my linux session (WEAK). Then again the same goes for any password utility I guess, since you can view passwords stored in browsers in clear text anyway. [0]: http://www.passwordstore.org/ http://www.passwordstore.org/
  - icebraining 11y ago
    They're not exactly in clear text: Chrome and IE encrypt them with the Windows session key (meaning only software running as the same user can decrypt them); Firefox on the other hand encrypts them with 3DES-CBC using a master password, if you set one, which is supposedly secure even against software running as the same user.

by vuchr 11y ago

SloopJon 11y ago

WinZip made a similar choice with its encrypted archives: you could see the list of directories and files before supplying a password. I would prefer that my account info be encrypted, but I can't use the new OPVault format, because it requires 1Password 5, which isn't supported on OS X 10.9.

lqdc13 11y ago
I think it is just how the .zip format works, not just the WinZip program. It's very easy to get around that though by double zipping.
- icebraining 11y ago
  PKWARE added filename encryption to the spec in version 6.2, but WinZip never added support for that feature.
- SloopJon 11y ago
  WinZip encryption is an extension to the Zip format that they defined: http://www.winzip.com/win/en/aes_info.htm http://www.winzip.com/win/en/aes_info.htm
kelleyk 11y ago
This is actually not the whole story. WinZip archives can be encrypted like you describe, but they can also be created with both the data and the list of contents encrypted.

DavideNL 11y ago

i agree. In my opinion, when they came up with the new data format (OPVault), they should have made some kind of in-app notification/workflow to let people automatically convert to this new format. Nobody reads all release notes, it's impossible. If you're not a computer nerd, you're using the old format forever. I've also complained about this on their blog at the time. By the way, the fact that not "everything" is encrypted is - sadly - also stated on their website: https://support.1password.com/opvault-design/ https://support.1password.com/opvault-design/ > The Agile Keychain kept some information (most notably Location and Title) unencrypted so that these could be used to search for or identify a particular item, while the more sensitive content could remain encrypted. With the Agile Keychain format, the browser extensions could identify and list potential matches for a website without having to be “unlocked”. With the OPVault format, we have moved away from that. The user must unlock the data with their Master Password before they can see a list of Logins.

rrego 11y ago

>You'd never encrypt a password but leave all the filenames/directories viewable without the password... I'm still not convinced that it isn't acceptable to leave your filenames/usernames still visible without the password for ANY password manager. The first point is a valid concern, but minor. His second point is really only relevant to this 1password service. Reason I ask is because I use pass + remote git server. Pass doesn't encrypt the filenames so the files are easily searchable. Are there any risks to this method?

FatalBaboon 11y ago
I have the same setup (pass [0] + private git repository via Gitlab). Password-wise it is as safe as my ssh key + gpp key, so pretty strong. Metadata wise it is as safe as my ssh key + gitlab account (still pretty strong), or my linux session (WEAK). Then again the same goes for any password utility I guess, since you can view passwords stored in browsers in clear text anyway. [0]: http://www.passwordstore.org/ http://www.passwordstore.org/
- icebraining 11y ago
  They're not exactly in clear text: Chrome and IE encrypt them with the Windows session key (meaning only software running as the same user can decrypt them); Firefox on the other hand encrypts them with 3DES-CBC using a master password, if you set one, which is supposedly secure even against software running as the same user.