3 ms·
I'm trying to understand this comment in the post: As it stands now, if you are compromised, whether through a hack, state action, or even a disgruntled employ
by jzl 10y ago
I'm trying to understand this comment in the post:
As it stands now, if you are compromised, whether through a hack, state action, or even a disgruntled employee, you will expose the full contents of tens of thousands of Dropboxes, a monumental security nightmare for your company.
Does 1Password have a web-based interface where you authenticate against Dropbox and it stores the credentials server-side? I didn't think it did but I'm not super familiar with 1Password.
Otherwise the only attack vector is a compromised 1Password application, right? Not saying that's impossible, but if you are opening scenarios to that line of attack then many more worse things could happen even if the app didn't have outright Dropbox credentials.
- nodamage 10y agoI'm confused too. To my knowledge Dropbox credentials are only ever stored on the client. If the 1Password client is compromised (presumably meaning the installer download is hijacked like what happened to Transmission), your Dropbox files being compromised will be the least of your worries.
- level3 10y agoI agree that a compromised 1Password application poses a much bigger threat than Dropbox access. But instead of a malicious attack, I would argue that it's more important to protect against a bug or faulty code. Based on 1Password's response, it sounds like the app has to locate the password file based on a settings file, which could be a little fragile. A flaw in the code logic could accidentally modify other files unintentionally. As an example, there was once a bug in Steam on Linux that force-deleted root because a path variable wasn't checked to ensure it wasn't empty.
- Terretta 10y agoThe evil 1Password binary can just use your own Dropbox creds you presumably store in 1Password. The app permissions would be security theater.
- alphabettsy 10y agoNo. As you would expect each 1Password client authenticates with Dropbox. There is no server side storage of Dropbox credentials and the ranting user is mostly clueless.