5 ms·

Does this mean that all crypto in 1Password X is now implemented in Javascript?

fcarraldo 9y ago
I'm worried about this too. The entire reason I migrated to 1Password over Lastpass is that I don't trust Lastpass' extension. There are too many edge cases, too much fuzziness around "offline usage", and too much reliance on the browser. 1Password's extension acting as an anchor for 1Password Mini, which runs as a separate application on my desktop outside of the browser ecosystem, is a major draw. I don't see how this is better in any way. What's the point?
- roustem 9y ago
  1Password X is a pure Chrome extension and does not rely on the native app. This has its benefits and obvious drawbacks. Some of the benefits: * Simpler installation * Support for multiple users on the same computer with Chrome user profiles * Support for Chrome OS
  - fcarraldo 9y ago
    Is this an option for Chrome/Linux/ChromeOS users to provide a more streamlined first-use experience? The "a look at the future" and "this is just the beginning" wording in the announcement blog post implies that this is the direction that 1Password is taking as a product, and Chrome support is just the beginning. As a user who prefers a native implementation, uses local vaults, and uses Firefox, none of these advantages matter much. If it's not "for me", that's totally cool. If this new experience will replace the existing one, 1Password is no longer the solution for me.
    - AGKyle 9y ago
      I think the easiest way to look at this is as you said, another option for users. Some enterprises don't allow their users to install applications, but do allow extensions, so this opens up that possibility. It also brought 1Password support to two new platforms: Linux and Chrome OS. As for this being the future. Imagine a world where from a design perspective this sets the tone. Thus, the beginning of the future. It's a first version that has to compare itself against versions that have existed for years. Of course it can't fully replace what we have. It may for some though, I won't discount that at all. For starters, there's no way to do Touch ID in the browser. There's no support for local vaults. There's only Chrome support, nothing for Safari or Firefox. There's a lot missing here. But in terms of the future, this sets the visual design up for how you'll start seeing future updates on the other side of the extension fence. So, lets go with "this isn't for you" :) In fact, I doubt in a lot of ways that this is for people on Hacker News. A smaller number will probably find it useful though. Kyle AgileBits
      - fcarraldo 9y ago
        Thanks for the response. I appreciate the clarification on this being the beginning of the visual design for the future. As long as _solely_ browser extensions are not the future of 1Password, then it will continue to be my password manager of choice.
roustem 9y ago
It is implemented with WebCrypto APIs. The performance would be abysmal in pure JavaScript.
ecesena 9y ago
Does this scare you? I'm asking honestly, I'm currently building a password manager in react native, and thus the core crypto is all js, relying on crypto-js. Would this be a deal-breaker for you?
- doomrobo 9y ago
  I don't think I know enough to feel a particular way about it. All I know is that some people I respect seem to dislike it[0][1], so I've just defaulted to avoiding it where I can. [0] https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b... [1] https://tonyarcieri.com/whats-wrong-with-webcrypto https://tonyarcieri.com/whats-wrong-with-webcrypto
  - roustem 9y ago
    The biggest concern with WebCrypto (with the JavaScript code using WebCrypto) is the fact that you have to trust the delivery mechanism. If there is a problem with TLS then there is a potential for a MITM attack that could modify the JavaScript code. Another potential issue is phishing. It is easier to create a fake web app compared to a fake native app.

I'm worried about this too. The entire reason I migrated to 1Password over Lastpass is that I don't trust Lastpass' extension. There are too many edge cases, too much fuzziness around "offline usage", and too much reliance on the browser. 1Password's extension acting as an anchor for 1Password Mini, which runs as a separate application on my desktop outside of the browser ecosystem, is a major draw. I don't see how this is better in any way. What's the point?

roustem 9y ago
1Password X is a pure Chrome extension and does not rely on the native app. This has its benefits and obvious drawbacks. Some of the benefits: * Simpler installation * Support for multiple users on the same computer with Chrome user profiles * Support for Chrome OS
- fcarraldo 9y ago
  Is this an option for Chrome/Linux/ChromeOS users to provide a more streamlined first-use experience? The "a look at the future" and "this is just the beginning" wording in the announcement blog post implies that this is the direction that 1Password is taking as a product, and Chrome support is just the beginning. As a user who prefers a native implementation, uses local vaults, and uses Firefox, none of these advantages matter much. If it's not "for me", that's totally cool. If this new experience will replace the existing one, 1Password is no longer the solution for me.
  - AGKyle 9y ago
    I think the easiest way to look at this is as you said, another option for users. Some enterprises don't allow their users to install applications, but do allow extensions, so this opens up that possibility. It also brought 1Password support to two new platforms: Linux and Chrome OS. As for this being the future. Imagine a world where from a design perspective this sets the tone. Thus, the beginning of the future. It's a first version that has to compare itself against versions that have existed for years. Of course it can't fully replace what we have. It may for some though, I won't discount that at all. For starters, there's no way to do Touch ID in the browser. There's no support for local vaults. There's only Chrome support, nothing for Safari or Firefox. There's a lot missing here. But in terms of the future, this sets the visual design up for how you'll start seeing future updates on the other side of the extension fence. So, lets go with "this isn't for you" :) In fact, I doubt in a lot of ways that this is for people on Hacker News. A smaller number will probably find it useful though. Kyle AgileBits
    - fcarraldo 9y ago
      Thanks for the response. I appreciate the clarification on this being the beginning of the visual design for the future. As long as _solely_ browser extensions are not the future of 1Password, then it will continue to be my password manager of choice.

roustem 9y ago

It is implemented with WebCrypto APIs. The performance would be abysmal in pure JavaScript.

ecesena 9y ago

Does this scare you? I'm asking honestly, I'm currently building a password manager in react native, and thus the core crypto is all js, relying on crypto-js. Would this be a deal-breaker for you?

doomrobo 9y ago
I don't think I know enough to feel a particular way about it. All I know is that some people I respect seem to dislike it[0][1], so I've just defaulted to avoiding it where I can. [0] https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b... [1] https://tonyarcieri.com/whats-wrong-with-webcrypto https://tonyarcieri.com/whats-wrong-with-webcrypto
- roustem 9y ago
  The biggest concern with WebCrypto (with the JavaScript code using WebCrypto) is the fact that you have to trust the delivery mechanism. If there is a problem with TLS then there is a potential for a MITM attack that could modify the JavaScript code. Another potential issue is phishing. It is easier to create a fake web app compared to a fake native app.