12 ms·
Use "App folder" access type instead of "Full Dropbox"
- noja 10y agoWould 1Password on desktop work even with an App folder?
- deleted 10y ago[deleted]
- jhgg 10y agoPerhaps I'm a bit dense here, but in the proposed attack scenario, couldn't the compromised 1Password application just send all passwords to a malicious server when the vault is unlocked - and assuming you have your Dropbox credentials in your 1Password log in and take your files anyways?
- charlieegan3 10y agoI think the files would still be in the Dropbox Trash. But yeah - think the first part could happen.
- level3 10y agoIf you have 2FA enabled on your Dropbox (and probably your email too), then taking just your credentials won't give the attacker access. Also, an attacker logging in to your Dropbox would leave a trace in your activity log.
- millak 10y agoYou could still be compromised in this situation if you use 1Password to store your 2FA codes.
- level3 10y agoSure, there are scenarios where limited permissions won't make a difference, but there are also scenarios where it will make a difference, and that's what matters. Of course, it's up to 1Password to decide whether those scenarios are a high priority or not. edit: 1Password, not Dropbox
- akerl_ 10y agoA compromised 1Password on a Mac could just read the contents of ~/Dropbox and fling it at a remote server, bypassing any Dropbox API perms entirely, even if the user of the system was using non-Dropbox syncing for their 1Password Vault. Not that the problem is localized to 1Password: any non-sandboxed app could do that, given the default system configuration.
- nodamage 10y agoA compromised 1Password application on a Mac can read a lot more than ~/Dropbox. I'm not sure why this problem is specific to Dropbox? Nor why changing the permission would materially change anything? Am I missing something?
- akerl_ 10y agoNope, your understanding is correct. That's why I'm not very concerned about the lack of "App folder" access strategies.
- xg15 10y agoOT: To be honest, that was something that always bugged me about password managers, particularly cloud-based ones. I'm not doubting the added security, but isn't it offset by adding another link in the chain with the power to compromise - and even lock you out if it's the only place you store the passwords - of all your accounts?
- alphabettsy 10y agoThat's the nice thing about being able to export an encrypted 1Password database for backup. They even store periodic backups for you with the Mac client at least.
- chj 10y agoAs a customer of 1Password, I will never move my password files into their cloud.
- atmosx 10y agoEncryption is meant to provide security in a hostile environment (the cloud in this instance). So, as long as you're using proper encryption and long enough pass phrases to make brute-forcing nearly impossible, storing info on the cloud should be okay.
- chj 10y agoWell, I prefer to store the password files on Dropbox because Dropbox guys are unlikely to know how the files are encrypted. That actually makes brute-forcing a little bit more difficult.
- snuxoll 10y agoWhy not? 1Password is built on the assumption that your vault could be copied by an adversary at any time, a 1Password account is even theoretically more secure because in addition to needing your master password they also need your account key which can only be retrieved from an existing device (or your recovery toolkit that you promptly printed and stored in a fire safe, right?).
- jzl 10y agoI'm trying to understand this comment in the post: As it stands now, if you are compromised, whether through a hack, state action, or even a disgruntled employee, you will expose the full contents of tens of thousands of Dropboxes, a monumental security nightmare for your company. Does 1Password have a web-based interface where you authenticate against Dropbox and it stores the credentials server-side? I didn't think it did but I'm not super familiar with 1Password. Otherwise the only attack vector is a compromised 1Password application, right? Not saying that's impossible, but if you are opening scenarios to that line of attack then many more worse things could happen even if the app didn't have outright Dropbox credentials.
- nodamage 10y agoI'm confused too. To my knowledge Dropbox credentials are only ever stored on the client. If the 1Password client is compromised (presumably meaning the installer download is hijacked like what happened to Transmission), your Dropbox files being compromised will be the least of your worries.
- level3 10y agoI agree that a compromised 1Password application poses a much bigger threat than Dropbox access. But instead of a malicious attack, I would argue that it's more important to protect against a bug or faulty code. Based on 1Password's response, it sounds like the app has to locate the password file based on a settings file, which could be a little fragile. A flaw in the code logic could accidentally modify other files unintentionally. As an example, there was once a bug in Steam on Linux that force-deleted root because a path variable wasn't checked to ensure it wasn't empty.
- Terretta 10y agoThe evil 1Password binary can just use your own Dropbox creds you presumably store in 1Password. The app permissions would be security theater.
- alphabettsy 10y agoNo. As you would expect each 1Password client authenticates with Dropbox. There is no server side storage of Dropbox credentials and the ranting user is mostly clueless.
- jbverschoor 10y agoYay, keychain
- res0nat0r 10y agoI feel sorry for companies these days who have to continually respond kindly (for years in this case) to unreasonable customer demands via forums/facebook even when they've clearly stated why things are configured the way they are and changing that will break functionality for tens of thousands of people. Some companies after a while just need to start following the Wendy's Twitter account model where they start just telling folks like it is after they've shown they aren't going to be reasonable.
- stupidcar 10y agoI feel bad for users who have to deal with supposedly-security minded companies who cite weak, historical reasons for not doing the right thing now. Companies who ignore the actual solutions proposed to them, and instead attack a straw-man. Claiming they're being asked to make backwards incompatible changes for all existing users, instead of providing an an opt-in alternative for users who actually care about their security. Companies whose culture is so inept that they blindly commit the most basic of engineering fallacies: Rejecting solutions on the basis of minor flaws, while defending a incumbent solution with massive flaws, simply because it is incumbent.
- eddieroger 10y agoThe users don't have to deal with it. No one forces you to use 1Password. They've been asked and stated their position and don't owe anyone anything else. If the folks in the thread (or here for that matter) don't like the answers, don't use the product. Pretty simple.
- bostand 10y agoAre we allowed to say why we don't like what they are doing? Are we allowed to tell other people why? Then what is the problem??
- eddieroger 10y agoSure, complain away! This is the Internet after all. My problem is the fake pity for users who make the conscious choice to use the problem despite - or regardless of - it's faults. If you don't like how AgileBits handles Dropbox permissions, either don't give it Dropbox permission or don't use 1Password. Complain, sure, but don't pity users for the sake of hyperbole. I read the original post in this thread as genuine pity for AgileBits, which I share - they get to make the application they choose, and users may or may not use it. But hyperbolic pity for the users? That's my problem.
- SarlCagan 10y agohttp://passwordlive.github.io/ http://passwordlive.github.io/
- rolfvandekrol 10y agoThis is a deterministic password manager, which is not a very good idea. https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...
- LinuxFreedom 10y agoDeveloper kids must learn: you save passwords in an online service or dropbox - you will be thrown out of the window by the boss admin. He will have lots of fun massaging your face before. And everybody will spit on your dead body. Finally get it - online password services are for idiots. BTW it is a very good IQ indicator: when you are hiring, just ask them if they have experience with online password services - saves a lot of time! Also look for the megabrains that are posting here how cool they are with using these services.
- minikites 10y agoWhat do you propose instead?
- acdha 10y agoYou appear to enjoy insulting people more than offering solutions or attempting to understand that not everyone has the same goals and resources. That didn't contribute anything of value to the conversation. Here's an exercise to try: write down the threat model for a few different people (average web user, developer on a big team, worker on a political campaign, etc.) and think about the risks and user experience of each proposed solution. Don't forget that the current most common way people are getting breached is from reusing passwords across sites.
- heartbreak 10y agoAnother good IQ indicator is understanding the product you're trashing. I use 1Password to store my password vault file locally on my disk. It's not sent to any cloud service.
- sctb 10y agoPlease comment civilly and substantively on Hacker News or not at all: https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- newscracker 10y ago> The alternative solutions aren't great. $36 a year to store a couple megabytes of data is outlandish. If you'd like to transition us to this from Dropbox, the price must be drastically reduced. I've found AgileBits a bit weird in some of the decisions. It's clear that selling a password manager for $65 is no longer working well for the company, and so the subscriptions were introduced (IIRC, shared vaults exist only in the subscription). But as the OP says in the forum post, the subscription prices are quite high from a value standpoint when people have been using Dropbox or iCloud or something else all along. I've seen that AgileBits is also a bit slow to learn from customer feedback (like the MAS-only fiasco a few years ago). As more and more apps move toward a subscription model than a one-time pay-for-a-major-version model, I foresee more customer backlash on prices. Edit: This backlash against subscription has already happened on the app store for Facetune and Infuse, to name two apps.
- kevinr 10y agoYou can share 1Password vaults with any kind of shared storage: Dropbox, Perforce, NFS, whatever. AFAICT the only thing 1Password.com provides is a nice, in-band UI for doing so.
- halostatue 10y agoIt also provides access controls in a way that other sharing mechanisms do not. Most of these are not available on the Family sharing plan (which I’m using for my family), but the enterprise version is comparable with what LastPass enterprise offers.
- baldfat 10y agolastpass is still $12 and on Android it is AMAZING. I just sign in with my finger and it will fill out all the passwords in apps. I got my first phone with a finger print reader (LG V20) and I was up and running signed in with every account in 1/4 of the time. I still have my bank account memorized but other then that lastpass has been awesome for me for close to 5 years.
- 10y ago
- incunix 10y agoI've had this very same thought, really needs addressing. Not sure why this is such a hard thing to achieve tbh
- clishem 10y agoSo happy I replaced 1Password with a 600 line shell script: https://www.passwordstore.org https://www.passwordstore.org
- AdamN 10y agoIf you're security minded, don't use Dropbox for syncing (or at all - it's kind of a mediocre service these days).
- growse 10y agoAnnoyingly, 1Password don't support syncing opvaults from an arbitrary location on the filesystem to allow you to use Syncthing. It's literally the only reason I still have a dropbox account.
- akerl_ 10y agoI think it does? https://support.1password.com/local-folder/ https://support.1password.com/local-folder/ I use that for one of my laptops that doesn't use dropbox and just set the folder to be the folder of the sync service I'm using on it.
- nucleardog 10y agoIt does... That's how I've been doing my syncing. All my 1Password vaults are kept in my ownCloud account. Even works fine on Android where I use an app called FolderSync to keep my vault synchronized on my phone and have added it to the 1Password Android app.
- neosynthesis 10y agoi was trying this too. I've setup my own cloud and i only wanted local lan sync but i'm not able to sync to my 1password android. may i ask: on the android app, where are you keeping the opvault file? when i pointed the android app folder sync to the opvault folder downloaded to my android phone, it said 'no vault found'. are you using the old keychain file format? thanks kindly
- robocaptain 10y agoJust curious what the general consensus of 1Password is here on HN? I am especially interested to hear from people that are actually using/paying for the cloud hosting (their servers).
- nilved 10y agoTrusting someone else with your passwords is playing with fire.
- karmajunkie 10y agoThe alternative is trusting ME with all those passwords, which is far more dangerous. Because I'm neither going to do a good job of creating passwords, nor of remembering them, so I'm going to end up using the same shitty password on every site I care about.
- nilved 10y agoWell, whose fault is that? I can tell you how to do it right, but it sounds like you're limiting yourself. If you prefer to do it wrong, feel free.
- troydavis 10y agoPer https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf https://1password.com/files/1Password%20for%20Teams%20White%..., using 1Password's own sync service doesn't mean trusting the company with the data. The client encrypts it and the server/sync platform is untrusted. I use 1P for Teams and have a small personal account and have been very happy.
- karmajunkie 10y agoI've been using it for a number of year and love it. Very rarely do i have any complications with it. My biggest complaint is the number of other apps that don't integrate the password manager into their logins so i have to go into 1p separately to get the password—its a minor hassle, but annoying when all you want to do is log into some rarely-used app.
- chuckgreenman 10y agoIf One Password was compromised wouldn't an attacker have your DropBox credentials anyway?
- alphabettsy 10y agoThe point is that it would break features for many users in exchange for security theater. Limiting the access of Dropbox is all well and great except that it breaks sharing, which many people use, in exchange you simply move the files to another folder on the same Dropbox which effectively does nothing. Slightly off topic, but Who stores senstive files unencrypted in Dropbox anyways?
- Pharylon 10y agoI do. I keep my backup 2-factor authentication code for gmail in my Dropbox folder. Access to my Dropbox account would compromise my gmail account (and vice versa, since I keep my backup Dropbox 2-factors in Google Drive). I consider these two accounts my most sensitive/critical accounts for that reason. Could I encrypt the files in Dropbox? Sure. But that would make it more difficult to get to those backup keys (I might be reading them off a text file from the Dropbox app on my phone, for instance). Has this happened often? No. Like, literally once. But it has happened, and I need to be able to recover my backup 2-factor codes.
- x1798DE 10y agoIf they are your most critical accounts, why are you doubling the attack surface by allowing a compromise of either to compromise both?
- danieldk 10y agoI do. I keep my backup 2-factor authentication code for gmail in my Dropbox folder. Why not use a physical 2nd factor such as a U2F key?
- alphabettsy 10y agoThis is the whole purpose of using a password manager. 1Password is capable of providing OTP codes instead of something like Google Auth. Obviously this makes 1Password a single point of failure, but that's true of password managers in general anyways since people usually put all of their sensitive things into them. At least with 1Password you can isolate items into vaults.
- tyfon 10y agoI have been using KeePass for some years. It's open source and works on basically every platforms there is. What is the advantage of 1password compared to the rest of the lot? I keep seeing the name in articles so it must be popular, but I associate it with passwords stored in the cloud which sounds insane to me.
- tomku 10y agoYour association isn't really accurate. 1Password's storage model is basically the same as KeePass, your passwords are stored in encrypted blobs that are not decryptable without your master password, which is never sent over the network even if you use their completely optional cloud storage and web interface. If you don't want to trust them with even your encrypted blobs, it also supports sync via Dropbox or iCloud, or over wifi to your phone/tablet, or just to a plain folder. As far as advantages, I'd say that 1Password is a very slick and well-designed password manager that focuses on covering a particular common case - someone with a Mac, an iPhone/Android device and possibly a Windows PC who wants to sync their passwords between those devices and fill passwords in their browsers. It offers first-party supported browser extensions and handles conflicting sync changes well, which were two major pain points for me when I used KeePass. If you're happy with KeePass, there's not really a compelling reason to switch. If you fit their target audience and want something with better sync/browser integration and/or a better Mac client, I think it's a compelling alternative.
- marklawrutgers 10y agoFor non-enterprise users, Dropbox's encryption is basically meaningless. If you have sensitive information you want to store in Dropbox, Google Cloud, iCloud, etc., I'd recommend using something like Cryptomator: https://cryptomator.org/ https://cryptomator.org/ to encrypt files on the client side before uploading to "the cloud". It's open source for security experts to look through it and free for desktop OSs. I think they just charge something like 5 bucks for the iOS and Android apps. For alternatives to the popular cloud services for the privacy conscious, there's a good list of open source projects and products on https://www.privacytools.io https://www.privacytools.io
- mcgrath_sh 10y agoI second Cryptomator. I used it to make an encrypted "File Cabinet" for important documents that I want on Dropbox. It is so simple, I actually used to it show my mom show to set up an encrypted folder on a flash drive of important information she wanted to store in a safety deposit box.
- nipunn1313 10y agoThis is not an all or nothing issue. For example, if you store sensitive videos, but rely on Dropbox's ability to transcode and preview the video in a web browser, then something like Cryptomater would not make sense. Encrypting on wire/at rest is the best you can do unless you run the transcoding yourself. Dropbox could support both modes, but the company has obviously made a decision to prioritize one over the other (at least for now).
- nipunn1313 10y agoThe oauth tokens are stored on the client. In order to exploit the suggested privilege escalation, you would need to exploit the client to feed you the oauth code. If you are exploiting the 1password client, you can do ANYTHING (including grabbing passwords after you unencrypt, reading filesystem, popping up a PWNED dialog). I don't think this effort should be urgent for 1password. This recommendation doesn't make me feel meaningfully safer (unless 1password has some clever process jailing inside their code to isolate the decryption component from the cloud component)
- nstr10 10y ago+1 for security theater. If 1Pass app is compromised, you're compromised - period. Even with app permissions, does it not still have file system access? I don't see how this change would prevent it from accessing all your Dropbox files anyway. Also, since Dropbox uses an exploit to gain permissions, I'd say we're placing blame in entirely the wrong place here. On the other hand, the 1Pass folks in that thread are giving all the wrong reasons. "We won't do this because it's hard," is very different from, "we won't do this because it offers no benefit in any scenario." Users who are security conscious aren't using Dropbox to sync their password vaults.