3 ms·

A situation where the remote datastore is compromised and now with it, all of my passwords. Or if I was to buy into 1Password's worldview, all of my credit car

A situation where the remote datastore is compromised and now with it, all of my passwords. Or if I was to buy into 1Password's worldview, all of my credit cards, bank accounts, ID cards, everything I want to keep a secure digital copy of, is at risk. Having a sense of control is a huge part of the way we think. Despite the greater risk of death in a car compared to an aeroplane, there's less concerns about car travel because there's a sense of control. Similarly, having the data under my control may be less secure, but that's still within my control rather than dependent on someone else doing the right thing.

AGKyle 7y ago
I think you may want to take a closer look at how 1Password works. I'll give a quick rundown here, but our security white paper goes into much greater detail: https://1pw.ca/whitepaper https://1pw.ca/whitepaper Your data is encrypted locally on your devices, it is never available in a decrypted form on any of our servers. A compromise of our servers would result in the attacker getting gibberish (encrypted data). To decrypt that data the attacker will need both your Master Password and your Secret Key. A Secret Key is a 128-bit key generated locally on your device, your Master Password is a passphrase set by you. These two keys are combined and, to simplify greatly, used to decrypt your data. The only way an attacker is going to acquire your Master Password and Secret Key are from your devices. Those are the only places those keys really exist. Guessing both the Secret Key and a strong Master Password are effectively going to cost such a significant amount of money, or due to time and processing constraints, be infeasible. An attack would have to be highly targeted. In other words, you would have to be a specific target to make any attack be worthwhile. If you believe you are likely to be the target of such a very specific attack you probably have a team of security personnel working for you who could better advise you than I could. I'd really suggest looking into how we do things. The only feasible attack on your data would be through your devices, and any other password manager that stores data locally on your devices will be impacted the same exact way in this case. Hope that helps but if you have questions please let me know and I'll do my best to help get you answers. Kyle 1Password Security Team Edit: apparently markdown isn't a thing here.
- vc8f6vVV 7y ago
  While what you are saying seems technically sound it implies that you do everything right when generating Secret Key. Let's imagine you have a bug and it fills Secret Key with zeros (or some fixed sequence) and it becomes known after quite some time, and in between your server is compromised. How much easier it makes for an attacker to decrypt data en masse? I would assume some people may not like that such attack vector even exists.
  - AGKyle 7y ago
    We can talk all day about bugs and mistakes. They're a fact of life and we are human. It's also important to remember that your Master Password still plays a role and YOU provide that. If you use a weak Master Password, and we somehow introduced a bug that set the Secret Key to 0's, then your Master Password would be the only thing protecting you. In an ideal world you'd continue to use a strong Master Password. Kyle 1Password Security Team
- YawningAngel 7y ago
  Replying to this as I can't reply to the other child comment: The secret key is emailed given to you when you enroll and is used, frequently, every time you enroll a new device. 1Password would have to screw up catastrophically to just not use it. Obviously they _could_ screw up catastrophically, but if you don't trust them to operate their service with a basic level of competence you probably shouldn't be using them as a password manager to begin with.
  - vc8f6vVV 7y ago
    The comment above says Secret Key is generated on my device, how can it be emailed anywhere? I don't quite understand how one can enroll other devices with local Secret Key, so I assume Secret Key has to leave my device and travel over the wire. Which raises even more questions, but even if it's not the way it's generated makes a big difference.
    - AGKyle 7y ago

AGKyle 7y ago

I think you may want to take a closer look at how 1Password works. I'll give a quick rundown here, but our security white paper goes into much greater detail: https://1pw.ca/whitepaper https://1pw.ca/whitepaper Your data is encrypted locally on your devices, it is never available in a decrypted form on any of our servers. A compromise of our servers would result in the attacker getting gibberish (encrypted data). To decrypt that data the attacker will need both your Master Password and your Secret Key. A Secret Key is a 128-bit key generated locally on your device, your Master Password is a passphrase set by you. These two keys are combined and, to simplify greatly, used to decrypt your data. The only way an attacker is going to acquire your Master Password and Secret Key are from your devices. Those are the only places those keys really exist. Guessing both the Secret Key and a strong Master Password are effectively going to cost such a significant amount of money, or due to time and processing constraints, be infeasible. An attack would have to be highly targeted. In other words, you would have to be a specific target to make any attack be worthwhile. If you believe you are likely to be the target of such a very specific attack you probably have a team of security personnel working for you who could better advise you than I could. I'd really suggest looking into how we do things. The only feasible attack on your data would be through your devices, and any other password manager that stores data locally on your devices will be impacted the same exact way in this case. Hope that helps but if you have questions please let me know and I'll do my best to help get you answers. Kyle 1Password Security Team Edit: apparently markdown isn't a thing here.

vc8f6vVV 7y ago
While what you are saying seems technically sound it implies that you do everything right when generating Secret Key. Let's imagine you have a bug and it fills Secret Key with zeros (or some fixed sequence) and it becomes known after quite some time, and in between your server is compromised. How much easier it makes for an attacker to decrypt data en masse? I would assume some people may not like that such attack vector even exists.
- AGKyle 7y ago
  We can talk all day about bugs and mistakes. They're a fact of life and we are human. It's also important to remember that your Master Password still plays a role and YOU provide that. If you use a weak Master Password, and we somehow introduced a bug that set the Secret Key to 0's, then your Master Password would be the only thing protecting you. In an ideal world you'd continue to use a strong Master Password. Kyle 1Password Security Team
YawningAngel 7y ago
Replying to this as I can't reply to the other child comment: The secret key is emailed given to you when you enroll and is used, frequently, every time you enroll a new device. 1Password would have to screw up catastrophically to just not use it. Obviously they _could_ screw up catastrophically, but if you don't trust them to operate their service with a basic level of competence you probably shouldn't be using them as a password manager to begin with.
- vc8f6vVV 7y ago
  The comment above says Secret Key is generated on my device, how can it be emailed anywhere? I don't quite understand how one can enroll other devices with local Secret Key, so I assume Secret Key has to leave my device and travel over the wire. Which raises even more questions, but even if it's not the way it's generated makes a big difference.
  - AGKyle 7y ago