4 ms·
Does the cloud provider have knowledge of the encryption keys? Do you generate the key in the provider's application, or is it import? Do they send the key to t
by ryanmccullagh 9y ago
Does the cloud provider have knowledge of the encryption keys? Do you generate the key in the provider's application, or is it import? Do they send the key to their servers? Can you verify all of this?
- benchaney 9y agoThe encryption keys are supposed to be generated client side. Obviously you can’t verify this since 1password is closed source, but if your threat model involves the client misbehaving, then you should be using any proprietary password manager. Cloud vs not Cloud is irrelevant.
- roustem 9y agoThere is no way we would want to know your keys. There are several million 1Password accounts and 1Password a huge attack target. All keys are generated on the client side and encrypted with a PBKDF2-hardened combination of Master Password + Secret Key. Details are here: https://1password.com/security/ https://1password.com/security/ Whitepaper (PDF): https://1password.com/teams/white-paper/ https://1password.com/teams/white-paper/