2 ms·

Neither are 1password’s if you don’t use their sync service. And honestly your passwords aren’t on their servers. An encrypted blob is. Encrypted with a passw

• bad_user 9y ago
  The problem is that same password is required in the web interface for administrative settings. And a web interface can always be compromised, as it can always inject some extra JS code in one of your sessions, without you having any way to verify that the JS blob you got served is the same you got the last time or that it’s the same blob that all the other users are getting. This is actually an important attack vector and AgileBits themselves admitted the possibility. Imagine that a compromised HTTPS root certificate can open the door to a huge man-in-the-middle attack, which is totally within the reach of governments or of well funded crime syndicates. Also the cloud sync is no longer optional. The standalone version is no longer available anywhere on their website and Google doesn’t help either. At this point the standalone version is still available only for those in the know, being on life support probably to not piss old timers off. At least they are thinking about us, I’ll grant them that.
  • wool_gather 9y ago
    This is a fair point, but it's worth noting that the password you memorize and enter is only a part of the encryption key. There's another component -- I think they call it the "master key" -- which is generated locally when you set up your database and must be transferred out-of-band to other devices. It doesn't go over a network, not even a local one. So losing control of your password via the web interface still does not constitute a complete breach.