5 ms·

I'm also a 1password customer and curious how the attack vector of spoofing the 1password input icon can harm the user. They might be able to get your master p

I'm also a 1password customer and curious how the attack vector of spoofing the 1password input icon can harm the user. They might be able to get your master password, but that doesn't mean they gain access to anything. Also, I never use that icon and exclusively use the shortcut. I'm curious if that can be spoofed somehow. But again, they can only get your master password. In the case of 1password, I'm pretty sure they would need direct access to the computer to gain access to your vault.

chrisweekly 5y ago
"they might be able to get your master password, but that doesn't mean they gain access to anything" I can't be the only one who finds that to be small comfort; isn't it sensible to respond, "if my 1Pwd master pwd is stolen, I must treat the vault as if it had been exposed"?
- lazide 5y ago
  With the current well designed systems, it isn’t the case however. That password is important (one of several factors), but you can’t get access with only that information. It is also something that is easy to change with no retroactive access abilities.
- a10c 5y ago
  Not really. At least not in the 1Password case. Having access to the 1Passswrd Master Password and your entire encrypted vault still doesn't get the attacker what they need. To decrypt your vault, you also need to know the 128 bit secret key which is also used in the encryption strategy that is stored offline (e.g. on a piece of paper in your safe or via another already authenticated device) https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
  - miked85 5y ago
    This is not true for the standalone version of 1Password.
    - a10c 5y ago
      The article is about Cloud-based Password Managers.
    - movedx 5y ago
      It’s 100% true of the standalone version of 1Password because there is only one version of 1Password - the standalone version. Everything else interacts with it. Your secret key is still required to decrypt passwords via the desktop application (which is the only version - everything else interacts with this.)
      - a10c 5y ago
        I believe he was referring to the old 1Password that let you handle the storage of your encrypted vault (which doesn't incorporate the secret key encryption approach)
        miked85 5y ago
        Yes, I was - and it still exists and gets updates. 1Password goes out of their way to not promote it though.
        movedx 5y ago
        And rightly so.
        miked85 5y ago
        It has nothing to do with security - they want to move everyone to a subscription model for reoccurring revenue. I can't blame them for that, but it isn't necessarily the best for customers.
        movedx 5y ago
        But that’s why you have choices - you’re not going to agree with or want what everyone is offering you. And like wise, that’s why businesses decide what choices to offer you - they’re not going to be able to serve every need. In this case it is about security, I believe. Primarily because of the additional secret material needed to encrypt the vault, but also because I trust them to store that vault securely for me versus my self. I’m lazy. I’m forgetful. They’re not. It’s literally they’re business and they’re getting better at it daily (one would hope at least.)
rudnikpolska 5y ago
I 2 use 1password. I think it’s reliable enough

chrisweekly 5y ago

"they might be able to get your master password, but that doesn't mean they gain access to anything" I can't be the only one who finds that to be small comfort; isn't it sensible to respond, "if my 1Pwd master pwd is stolen, I must treat the vault as if it had been exposed"?

lazide 5y ago
With the current well designed systems, it isn’t the case however. That password is important (one of several factors), but you can’t get access with only that information. It is also something that is easy to change with no retroactive access abilities.
a10c 5y ago
Not really. At least not in the 1Password case. Having access to the 1Passswrd Master Password and your entire encrypted vault still doesn't get the attacker what they need. To decrypt your vault, you also need to know the 128 bit secret key which is also used in the encryption strategy that is stored offline (e.g. on a piece of paper in your safe or via another already authenticated device) https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
- miked85 5y ago
  This is not true for the standalone version of 1Password.
  - a10c 5y ago
    The article is about Cloud-based Password Managers.
  - movedx 5y ago
    It’s 100% true of the standalone version of 1Password because there is only one version of 1Password - the standalone version. Everything else interacts with it. Your secret key is still required to decrypt passwords via the desktop application (which is the only version - everything else interacts with this.)
    - a10c 5y ago
      I believe he was referring to the old 1Password that let you handle the storage of your encrypted vault (which doesn't incorporate the secret key encryption approach)
      - miked85 5y ago
        Yes, I was - and it still exists and gets updates. 1Password goes out of their way to not promote it though.
        movedx 5y ago
        And rightly so.
        miked85 5y ago
        It has nothing to do with security - they want to move everyone to a subscription model for reoccurring revenue. I can't blame them for that, but it isn't necessarily the best for customers.
        movedx 5y ago
        But that’s why you have choices - you’re not going to agree with or want what everyone is offering you. And like wise, that’s why businesses decide what choices to offer you - they’re not going to be able to serve every need. In this case it is about security, I believe. Primarily because of the additional secret material needed to encrypt the vault, but also because I trust them to store that vault securely for me versus my self. I’m lazy. I’m forgetful. They’re not. It’s literally they’re business and they’re getting better at it daily (one would hope at least.)

rudnikpolska 5y ago

I 2 use 1password. I think it’s reliable enough