7 ms·
1Password addresses this and a lot more in https://support.1password.com/1password-security/ https://support.1password.com/1password-security/ . An excerpt: >
by troydavis 5y ago
1Password addresses this and a lot more in https://support.1password.com/1password-security/ https://support.1password.com/1password-security/ . An excerpt:
> Your account password is never stored alongside your 1Password data or transmitted over the network.
If you want a lot more detail, pages 10-11 of https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p... are good places to start.
- josephcsible 5y ago> Your account password is never stored alongside your 1Password data or transmitted over the network. Sure, the legitimate client doesn't do that. But unless you do a full audit of 1Password's JavaScript every time you visit it to log in, an attacker who breaches their servers could switch out the legitimate client for an identical-looking malicious one that does do that.
- troydavis 5y agoThat’s a big reason why 1Password recommends using native clients, not the Web interface. Page 68 of https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p... covers that in detail, but the gist is “Use (code-signed) native clients as much as possible.”
- josephcsible 5y agoYes, using a native client would help, since now the server that would need to be compromised is 1Password's build-box, and it'd be much more difficult to get away with targeting only a few specific users with a modified client. What would help a lot more is if the clients were all fully open source with a 100% reproducible build process.