2 ms·
Since, once unlocked, 1password as of version 7 stores everything de-crypted in memory, ANY attack on a host with an unlocked 1password keychain which can exfil
by foobiekr 7y ago
Since, once unlocked, 1password as of version 7 stores everything de-crypted in memory, ANY attack on a host with an unlocked 1password keychain which can exfiltrate memory across processes can steal everything.
It's pretty obvious why this changed, however, it is a major increase in exposure and a terrible change overall. It is discussed in [1] and mostly the answers aren't very satisfying as demonstrated in [2].
[1] https://discussions.agilebits.com/discussion/101560/secure-memory-management-in-1password-7-for-windows https://discussions.agilebits.com/discussion/101560/secure-m...
[2] https://discussions.agilebits.com/discussion/101551/article-just-published-in-washington-post-is-saying-1password-and-others-have-security-flaws/p6 https://discussions.agilebits.com/discussion/101551/article-...