4 ms·
And this is why I'm not happy to see 1password moving to an online only model. If it's only local vaults, I can understand the threat model, I have more control
by sersi 5y ago
And this is why I'm not happy to see 1password moving to an online only model. If it's only local vaults, I can understand the threat model, I have more control over it, as soon as it's in the cloud, it becomes quite a bit harder for me to feel safe.
- manicdee 5y agoOnce it’s in the cloud, it’s already compromised. Best way to keep a secret is don’t share it. Cloud storage is by necessity sharing the secret with the cloud server and everyone with access to it.
- lokedhs 5y agoIn general, I agree with you about avoiding cloud storage, but it's important to remember that the secret is the cleartext data. The encrypted data is not secret, and that's the whole point of encryption. As long as you store the encrypted vault on a cloud service, your secrets are not shared. The problem in this case is that you are running the vendor's code on your local machine to perform the encryption, and that's where the real issue is. You have to trust that that code is completely bug free. This issue is made worse by the fact that things are uploaded to the cloud, but it's not the underlying problem.