3 ms·
A compromised 1Password on a Mac could just read the contents of ~/Dropbox and fling it at a remote server, bypassing any Dropbox API perms entirely, even if th
by akerl_ 10y ago
A compromised 1Password on a Mac could just read the contents of ~/Dropbox and fling it at a remote server, bypassing any Dropbox API perms entirely, even if the user of the system was using non-Dropbox syncing for their 1Password Vault.
Not that the problem is localized to 1Password: any non-sandboxed app could do that, given the default system configuration.
- nodamage 10y agoA compromised 1Password application on a Mac can read a lot more than ~/Dropbox. I'm not sure why this problem is specific to Dropbox? Nor why changing the permission would materially change anything? Am I missing something?
- akerl_ 10y agoNope, your understanding is correct. That's why I'm not very concerned about the lack of "App folder" access strategies.