4 ms·

I'm a 1Password user, and have synced my vault between devices through both Dropbox and iCloud at various points. I can't help but feel like either there's some

I'm a 1Password user, and have synced my vault between devices through both Dropbox and iCloud at various points. I can't help but feel like either there's something I'm missing or something everyone else is missing, which statistically means that it's most likely me. But: When I sync with iCloud, Apple can't read my vault--even though it's on their servers, it's strongly encrypted with my passphrase, and the encryption/decryption happens on my devices. When I sync with Dropbox, Dropbox can't read my vault--even though it's on their servers, it's strongly encrypted with my passphrase, and the encryption/decryption happens on my devices. When I sync with AgileBit's own cloud... doesn't the sentence go exactly the same way? Quoting from their own current web page: "Every time you use 1Password, your data is encrypted before a single byte ever leaves your devices." So even if the vault is on AgileBits' own servers, isn't it _no more and no less secure_ than the third-party syncing solutions they offer? Maybe that's not the case, and things actually function differently--but I haven't seen anyone describe why that would be the case. Again, maybe I'm just missing it. But I keep missing it. And it's not in Tim Bray's article, either. He's fine with putting it on somebody else's server if that server is run by Dropbox, but not if it's run by the company that he's trusting to encrypt it against people hacking Dropbox? How is this is materially different than using iCloud, Dropbox, or any other solution that puts a copy of my vault on someone else's servers for syncing purposes? If the real argument is that there should always be a way to use a password manager with _no_ cloud-based syncing solution, I'm on board with that; it'd be a requirement for some businesses. But that doesn't seem to be the argument that's being made. And if the real argument is that you don't like subscription pricing models, that's fine. I don't like them, either. But that's not an argument about security--it's an argument about pricing models.

canes123456 9y ago
I think there are two concerns: 1. Accessing 1password.com's from a browser is less secure than using an app. You can choose never to log in but it makes it harder to recommend 1Password to journalists, political dissenters, etc. The most paranoid people need a local vault option. 2. The 1password.com can change to work differently from Dropbox at any time. 1Password for teams already allows recovery without your master password. They can add this to the normal subscription at any time.
- yborg 9y ago
  The other major concern would be that you are moving your trust in the security of your data from very large companies that have staff in place to maintain such security as well as an established track record of offering service in the wild to a much smaller company with much less of a track record.
  - fcarraldo 9y ago
    I understand this argument for iCloud, but Dropbox does not have a history of strong security [0] [1] [2]. This doesn't mean that AgileBits is more trustworthy, but it makes sense that they'd prefer to build their own cloud service over relying on Dropbox for the security of their customers' data. [0] https://www.washingtonpost.com/news/the-switch/wp/2016/09/07/hacked-dropbox-data-of-68-million-users-is-now-or-sale-on-the-dark-web/ https://www.washingtonpost.com/news/the-switch/wp/2016/09/07... [1] https://venturebeat.com/2012/08/01/dropbox-has-become-problem- https://venturebeat.com/2012/08/01/dropbox-has-become-proble... child-of-cloud-security/ [2] https://venturebeat.com/2011/06/21/dropbox-files-left-unprotected-for-four-hours-due-to-software-bug/ https://venturebeat.com/2011/06/21/dropbox-files-left-unprot...
Groxx 9y ago
It's more that in-browser JS changes all the time and is basically never audited, nor can it be pinned and prevented from changing. It'd be downright trivial and unnoticeable to change it to capture your password rather than to behave as advertised. Compare that with the app. Sure it has an updater, but you can use it offline. Don't trust it in day-to-day affairs? Block network access. You can reliably not trust it, and trust that it hasn't exposed your password behind your back (minus on-disk, but that's a risk either way, and it's more audit-able / third parties can build against the format to verify it independently).
- yladiz 9y ago
  Playing devil's advocate: if you can trust that 1Password is doing everything they can to protect you, the user (using HTTPS, resource integrity) while using the browser app, then are you worried that 1Password may act maliciously? I see this argument all the time but I don't buy it because why on Earth would 1Password do such a thing, if their entire model is based on the customer trusting them handling their data?
  - mvid 9y ago
    They can be compelled by an outside force to do so. Or their business model may change
    - Groxx 9y ago
      "Compelled by an outside force" is the main fear for many people. Because it happens all the time, and some of those instances also have an NSL / gag order so they're unable to talk about it until years after the fact (if ever). Or they just threaten violence. Threat models aren't the same person-to-person - this probably won't happen to you (the grandparent), but embedded journalists / people trying to overthrow a corrupt regime depend on this stuff to literally keep them alive. Another fairly common possibility, and one that affects damn near everybody: they can get hacked and have their source code modified. This happens with some regularity, and it can affect apps too: https://www.macrumors.com/2017/05/07/handbrake-app-security-warning-servers-hacked/ https://www.macrumors.com/2017/05/07/handbrake-app-security-... but in a browser this happens silently and unpreventably. Apps don't (usually) update invisibly just because you launched them.
draw_down 9y ago
Apple and Dropbox don't have a webface that can be used to access your 1Password vaults from a browser.
andrewaylett 9y ago
When I store my password DB in Dropbox, Dropbox treats it like any other file: it's completely agnostic to the content. But the sync component of an online password manager knows what it's storing, and the storage and access are provided by the same people. It's true that you still have to trust the software vendor with your data -- that they won't just send themselves your secrets in the clear -- but I think the secrets are safer if the software isn't supposed to send _anything_ to the vendor than if you have to rely on what it does send being properly secured.

canes123456 9y ago

I think there are two concerns: 1. Accessing 1password.com's from a browser is less secure than using an app. You can choose never to log in but it makes it harder to recommend 1Password to journalists, political dissenters, etc. The most paranoid people need a local vault option. 2. The 1password.com can change to work differently from Dropbox at any time. 1Password for teams already allows recovery without your master password. They can add this to the normal subscription at any time.

yborg 9y ago
The other major concern would be that you are moving your trust in the security of your data from very large companies that have staff in place to maintain such security as well as an established track record of offering service in the wild to a much smaller company with much less of a track record.
- fcarraldo 9y ago
  I understand this argument for iCloud, but Dropbox does not have a history of strong security [0] [1] [2]. This doesn't mean that AgileBits is more trustworthy, but it makes sense that they'd prefer to build their own cloud service over relying on Dropbox for the security of their customers' data. [0] https://www.washingtonpost.com/news/the-switch/wp/2016/09/07/hacked-dropbox-data-of-68-million-users-is-now-or-sale-on-the-dark-web/ https://www.washingtonpost.com/news/the-switch/wp/2016/09/07... [1] https://venturebeat.com/2012/08/01/dropbox-has-become-problem- https://venturebeat.com/2012/08/01/dropbox-has-become-proble... child-of-cloud-security/ [2] https://venturebeat.com/2011/06/21/dropbox-files-left-unprotected-for-four-hours-due-to-software-bug/ https://venturebeat.com/2011/06/21/dropbox-files-left-unprot...

Groxx 9y ago

It's more that in-browser JS changes all the time and is basically never audited, nor can it be pinned and prevented from changing. It'd be downright trivial and unnoticeable to change it to capture your password rather than to behave as advertised. Compare that with the app. Sure it has an updater, but you can use it offline. Don't trust it in day-to-day affairs? Block network access. You can reliably not trust it, and trust that it hasn't exposed your password behind your back (minus on-disk, but that's a risk either way, and it's more audit-able / third parties can build against the format to verify it independently).

yladiz 9y ago
Playing devil's advocate: if you can trust that 1Password is doing everything they can to protect you, the user (using HTTPS, resource integrity) while using the browser app, then are you worried that 1Password may act maliciously? I see this argument all the time but I don't buy it because why on Earth would 1Password do such a thing, if their entire model is based on the customer trusting them handling their data?
- mvid 9y ago
  They can be compelled by an outside force to do so. Or their business model may change
  - Groxx 9y ago
    "Compelled by an outside force" is the main fear for many people. Because it happens all the time, and some of those instances also have an NSL / gag order so they're unable to talk about it until years after the fact (if ever). Or they just threaten violence. Threat models aren't the same person-to-person - this probably won't happen to you (the grandparent), but embedded journalists / people trying to overthrow a corrupt regime depend on this stuff to literally keep them alive. Another fairly common possibility, and one that affects damn near everybody: they can get hacked and have their source code modified. This happens with some regularity, and it can affect apps too: https://www.macrumors.com/2017/05/07/handbrake-app-security-warning-servers-hacked/ https://www.macrumors.com/2017/05/07/handbrake-app-security-... but in a browser this happens silently and unpreventably. Apps don't (usually) update invisibly just because you launched them.

draw_down 9y ago

Apple and Dropbox don't have a webface that can be used to access your 1Password vaults from a browser.

andrewaylett 9y ago

When I store my password DB in Dropbox, Dropbox treats it like any other file: it's completely agnostic to the content. But the sync component of an online password manager knows what it's storing, and the storage and access are provided by the same people. It's true that you still have to trust the software vendor with your data -- that they won't just send themselves your secrets in the clear -- but I think the secrets are safer if the software isn't supposed to send _anything_ to the vendor than if you have to rely on what it does send being properly secured.