4 ms·
Perhaps I'm a bit dense here, but in the proposed attack scenario, couldn't the compromised 1Password application just send all passwords to a malicious server
by jhgg 10y ago
Perhaps I'm a bit dense here, but in the proposed attack scenario, couldn't the compromised 1Password application just send all passwords to a malicious server when the vault is unlocked - and assuming you have your Dropbox credentials in your 1Password log in and take your files anyways?
- charlieegan3 10y agoI think the files would still be in the Dropbox Trash. But yeah - think the first part could happen.
- level3 10y agoIf you have 2FA enabled on your Dropbox (and probably your email too), then taking just your credentials won't give the attacker access. Also, an attacker logging in to your Dropbox would leave a trace in your activity log.
- millak 10y agoYou could still be compromised in this situation if you use 1Password to store your 2FA codes.
- level3 10y agoSure, there are scenarios where limited permissions won't make a difference, but there are also scenarios where it will make a difference, and that's what matters. Of course, it's up to 1Password to decide whether those scenarios are a high priority or not. edit: 1Password, not Dropbox
- akerl_ 10y agoA compromised 1Password on a Mac could just read the contents of ~/Dropbox and fling it at a remote server, bypassing any Dropbox API perms entirely, even if the user of the system was using non-Dropbox syncing for their 1Password Vault. Not that the problem is localized to 1Password: any non-sandboxed app could do that, given the default system configuration.
- nodamage 10y agoA compromised 1Password application on a Mac can read a lot more than ~/Dropbox. I'm not sure why this problem is specific to Dropbox? Nor why changing the permission would materially change anything? Am I missing something?
- akerl_ 10y agoNope, your understanding is correct. That's why I'm not very concerned about the lack of "App folder" access strategies.
- xg15 10y agoOT: To be honest, that was something that always bugged me about password managers, particularly cloud-based ones. I'm not doubting the added security, but isn't it offset by adding another link in the chain with the power to compromise - and even lock you out if it's the only place you store the passwords - of all your accounts?
- alphabettsy 10y agoThat's the nice thing about being able to export an encrypted 1Password database for backup. They even store periodic backups for you with the Mac client at least.