5 ms·

Can't trust passwords being stored in the cloud.

jupp0r 9y ago
May I ask what your gripes with the cloud are, especially in situations where you encrypt the data to be stored and the cloud provider has no knowledge of the encryption keys?
- ryanmccullagh 9y ago
  Does the cloud provider have knowledge of the encryption keys? Do you generate the key in the provider's application, or is it import? Do they send the key to their servers? Can you verify all of this?
  - benchaney 9y ago
    The encryption keys are supposed to be generated client side. Obviously you can’t verify this since 1password is closed source, but if your threat model involves the client misbehaving, then you should be using any proprietary password manager. Cloud vs not Cloud is irrelevant.
  - roustem 9y ago
    There is no way we would want to know your keys. There are several million 1Password accounts and 1Password a huge attack target. All keys are generated on the client side and encrypted with a PBKDF2-hardened combination of Master Password + Secret Key. Details are here: https://1password.com/security/ https://1password.com/security/ Whitepaper (PDF): https://1password.com/teams/white-paper/ https://1password.com/teams/white-paper/
dbg31415 9y ago
Which is a fine mentality for personal passwords -- at least I get where the distrust comes from. But for an enterprise team (or just a team), you need to be able to share passwords with various team members. Without a system, you're left with each of those people having to use their own (often insecure) personal methodology. Without a password manager, people resort to very simple passwords, or reusing passwords across multiple systems, or writing passwords down on PostIt notes next to their monitors. Without the convenience of a cloud-based system, you don't have an easy way to back up your passwords -- what happens if someone gets hit by a bus? And you can't easily have someone run compliance to verify when the last time was you updated your password, or how complex your passwords are -- at least not without showing them the raw passwords in all systems. I get paranoia... but any team that runs a password manager service consistently for all users will be much more secure than any team that doesn't. * Most Private And Secure Password Managers - Secured.fyi - Alpha || https://secured.fyi/password.html https://secured.fyi/password.html * Best Password Manager 2018 - Lastpass vs. Dashlane vs. 1Password || https://www.tomsguide.com/us/best-password-managers,review-3785.html https://www.tomsguide.com/us/best-password-managers,review-3...
- woolvalley 9y ago
  It's pretty much the old on-prem vs off-prem argument, and for some people & organizations, on-prem is non-negotiable.
  - bwoodruff 9y ago
    I don’t anticipate on-prem being available for individuals; there is simply too much infrastructure required. But for businesses this may be possible in the future. Please reach out to our business team at `business@1password.com` if you are interested. - Ben, AgileBits
- dingaling 9y ago
  > Without the convenience of a cloud-based system There is a wide spectrum between password-on-PostIt and cloud-based third-party service. A password-manager accessing a version-controlled master file on the LAN, for example. Which can not only be firewalled nice and tight but is also resilient to xloud-provider going out of business or changing their ToS.
Analemma_ 9y ago
1Password has a whitepaper and explanation of their system end-to-end where they state very unequivocally that they don't have the key and only store/sync your encrypted blob. They could be lying about that, but they are an established business with literally everything to lose if they are caught making such a bone-headed mistake.
- my_ghola 9y ago
  Can you really trust the company? What about each and every one of the employees that touch the code? Can you trust their Government not to have asked them for a backdoor? I don't think I can trust a password manager that isn't open source. Cloud or not.
  - ubernostrum 9y ago
    Can you trust your hosting company? Can you trust the manufacturer of your personal devices? Sooner or later you're trusting somebody, unless you literally smelted your own machine starting from ore and a bucket of sand, and then wrote every line of code for it, including the compiler, yourself. Maybe you should inventory all the entities you're trusting already.
    - woolvalley 9y ago
      Local vaults is completely client side encrypted, so you didn't have to trust dropbox or iCloud if you used that to sync. The only major vuln are the updates, and that would have to be a backdoor delivered to everyone, otherwise the mismatched hashes would be noticeable. The surface area is smaller with the client side encrypted version.
      - rimliu 9y ago
        Do you trust your client? Oh, you compiled it yourself. Do you trust your compiler? And so on and so forth.
      - bwoodruff 9y ago

May I ask what your gripes with the cloud are, especially in situations where you encrypt the data to be stored and the cloud provider has no knowledge of the encryption keys?

ryanmccullagh 9y ago
Does the cloud provider have knowledge of the encryption keys? Do you generate the key in the provider's application, or is it import? Do they send the key to their servers? Can you verify all of this?
- benchaney 9y ago
  The encryption keys are supposed to be generated client side. Obviously you can’t verify this since 1password is closed source, but if your threat model involves the client misbehaving, then you should be using any proprietary password manager. Cloud vs not Cloud is irrelevant.
- roustem 9y ago
  There is no way we would want to know your keys. There are several million 1Password accounts and 1Password a huge attack target. All keys are generated on the client side and encrypted with a PBKDF2-hardened combination of Master Password + Secret Key. Details are here: https://1password.com/security/ https://1password.com/security/ Whitepaper (PDF): https://1password.com/teams/white-paper/ https://1password.com/teams/white-paper/

dbg31415 9y ago

Which is a fine mentality for personal passwords -- at least I get where the distrust comes from. But for an enterprise team (or just a team), you need to be able to share passwords with various team members. Without a system, you're left with each of those people having to use their own (often insecure) personal methodology. Without a password manager, people resort to very simple passwords, or reusing passwords across multiple systems, or writing passwords down on PostIt notes next to their monitors. Without the convenience of a cloud-based system, you don't have an easy way to back up your passwords -- what happens if someone gets hit by a bus? And you can't easily have someone run compliance to verify when the last time was you updated your password, or how complex your passwords are -- at least not without showing them the raw passwords in all systems. I get paranoia... but any team that runs a password manager service consistently for all users will be much more secure than any team that doesn't. * Most Private And Secure Password Managers - Secured.fyi - Alpha || https://secured.fyi/password.html https://secured.fyi/password.html * Best Password Manager 2018 - Lastpass vs. Dashlane vs. 1Password || https://www.tomsguide.com/us/best-password-managers,review-3785.html https://www.tomsguide.com/us/best-password-managers,review-3...

woolvalley 9y ago
It's pretty much the old on-prem vs off-prem argument, and for some people & organizations, on-prem is non-negotiable.
- bwoodruff 9y ago
  I don’t anticipate on-prem being available for individuals; there is simply too much infrastructure required. But for businesses this may be possible in the future. Please reach out to our business team at `business@1password.com` if you are interested. - Ben, AgileBits
dingaling 9y ago
> Without the convenience of a cloud-based system There is a wide spectrum between password-on-PostIt and cloud-based third-party service. A password-manager accessing a version-controlled master file on the LAN, for example. Which can not only be firewalled nice and tight but is also resilient to xloud-provider going out of business or changing their ToS.

Analemma_ 9y ago

1Password has a whitepaper and explanation of their system end-to-end where they state very unequivocally that they don't have the key and only store/sync your encrypted blob. They could be lying about that, but they are an established business with literally everything to lose if they are caught making such a bone-headed mistake.

my_ghola 9y ago
Can you really trust the company? What about each and every one of the employees that touch the code? Can you trust their Government not to have asked them for a backdoor? I don't think I can trust a password manager that isn't open source. Cloud or not.
- ubernostrum 9y ago
  Can you trust your hosting company? Can you trust the manufacturer of your personal devices? Sooner or later you're trusting somebody, unless you literally smelted your own machine starting from ore and a bucket of sand, and then wrote every line of code for it, including the compiler, yourself. Maybe you should inventory all the entities you're trusting already.
  - woolvalley 9y ago
    Local vaults is completely client side encrypted, so you didn't have to trust dropbox or iCloud if you used that to sync. The only major vuln are the updates, and that would have to be a backdoor delivered to everyone, otherwise the mismatched hashes would be noticeable. The surface area is smaller with the client side encrypted version.
    - rimliu 9y ago
      Do you trust your client? Oh, you compiled it yourself. Do you trust your compiler? And so on and so forth.
    - bwoodruff 9y ago