3 ms·

I've been trying to reason through the threat model for this and 1Password's newfound cloud storage. This write-up, and any reversing efforts for 1P, only speak

I've been trying to reason through the threat model for this and 1Password's newfound cloud storage. This write-up, and any reversing efforts for 1P, only speak to what goes over the network and how the client stores locally (1P uses b64 in sqlite on the client, for example) but I don't know how anyone could speak to what the breach had access to unless those dumps are made public. One scenario I can imagine is that the API routes merely add authentication over s3:PutObject and the wire serialization is the storage format. But surely if that were true then 1P wouldn't have thrown such a hissy fit over giving up local vaults since their clients already supported multiple cloud backends anyway. Coming back to the linked repo, the files are 4 years old: did LP not change their format at all over 4 years?

r0uv3n 4y ago
You're entirely right of course, the vault data as accessed in the breach need not necessarily be in the same format as what is transmitted to the client. And yes, the whole repository is from 2018, but I checked again today and it seems only 3 additional fields were added. In particular the same fields are unencrypted as before.
- mdaniel 4y ago
  That's stunning to hear, and also speaks to "then they must not have been adding many features" or that file format must be absolutely rockstar. I'll try to make time to study it in order to learn which this is (BTW, you also have duplicate comments: https://news.ycombinator.com/item?id=34110529 https://news.ycombinator.com/item?id=34110529)
  - deleted 4y ago
    [deleted]
  - r0uv3n 4y ago
    The three additional data fields might fulfill some functions related to new features. Additionally, there is a full history of all former passwords which is transmitted in its own request, so in particular this vault format doesn't seem to contain all data LastPass has concerning a particular account (though what is unencrypted within this format is surely also unencrypted on the LastPass servers). I think I'd see no problem if LastPass had a great product and kept it as is for extended periods of time, I don't need new features every few months for a security product. But this should have all been encrypted from the start, and there were discussions about this 4 years ago already https://www.reddit.com/r/AskNetsec/comments/8v7bcc/just_a_reminder_that_lastpass_is_sending_the_url/ https://www.reddit.com/r/AskNetsec/comments/8v7bcc/just_a_re.... This could have been fixed for years, but it's the same even now.
deleted 4y ago
[deleted]
tailspin2019 4y ago
I had to read this a few times to establish that you weren’t confusing LastPass (the topic of TFA) and 1Password. But even then I’m not 100% sure… :)
- mdaniel 4y ago
  Yeah, I knew I was running that risk, but since I (thankfully) don't have a LP account, I don't have the same depth of experience with that ecosystem. However, I think they now have more in common than differ ... err, php and lax security practices aside. When I saw the attacker had exfiltrated the cloud storage, as a 1P member I thought "there but for the grace of God go I" and have been trying to think through the threat model that does apply to me I have better-than-average experience with 1P's opvault format, and have lightly dug into their local cached copy, but realized I can only say so much about their cloud storage situation because the local copy presumably isn't the same as the way they store it --- BTW, if one is into vault storage formats, I have really enjoyed this series that dug into the 1P API and associated (they didn't have to reverse engineer the .opvault format, that was published): https://darthnull.org/series/1password/ https://darthnull.org/series/1password/ and https://github.com/dschuetz/1password#readme https://github.com/dschuetz/1password#readme
  - tailspin2019 4y ago
    Interesting. I too am reconsidering the cloud password storage approach. I much preferred local WiFi sync when it used to be available.

r0uv3n 4y ago

You're entirely right of course, the vault data as accessed in the breach need not necessarily be in the same format as what is transmitted to the client. And yes, the whole repository is from 2018, but I checked again today and it seems only 3 additional fields were added. In particular the same fields are unencrypted as before.

mdaniel 4y ago
That's stunning to hear, and also speaks to "then they must not have been adding many features" or that file format must be absolutely rockstar. I'll try to make time to study it in order to learn which this is (BTW, you also have duplicate comments: https://news.ycombinator.com/item?id=34110529 https://news.ycombinator.com/item?id=34110529)
- deleted 4y ago
  [deleted]
- r0uv3n 4y ago
  The three additional data fields might fulfill some functions related to new features. Additionally, there is a full history of all former passwords which is transmitted in its own request, so in particular this vault format doesn't seem to contain all data LastPass has concerning a particular account (though what is unencrypted within this format is surely also unencrypted on the LastPass servers). I think I'd see no problem if LastPass had a great product and kept it as is for extended periods of time, I don't need new features every few months for a security product. But this should have all been encrypted from the start, and there were discussions about this 4 years ago already https://www.reddit.com/r/AskNetsec/comments/8v7bcc/just_a_reminder_that_lastpass_is_sending_the_url/ https://www.reddit.com/r/AskNetsec/comments/8v7bcc/just_a_re.... This could have been fixed for years, but it's the same even now.

deleted 4y ago

[deleted]

tailspin2019 4y ago

I had to read this a few times to establish that you weren’t confusing LastPass (the topic of TFA) and 1Password. But even then I’m not 100% sure… :)

mdaniel 4y ago
Yeah, I knew I was running that risk, but since I (thankfully) don't have a LP account, I don't have the same depth of experience with that ecosystem. However, I think they now have more in common than differ ... err, php and lax security practices aside. When I saw the attacker had exfiltrated the cloud storage, as a 1P member I thought "there but for the grace of God go I" and have been trying to think through the threat model that does apply to me I have better-than-average experience with 1P's opvault format, and have lightly dug into their local cached copy, but realized I can only say so much about their cloud storage situation because the local copy presumably isn't the same as the way they store it --- BTW, if one is into vault storage formats, I have really enjoyed this series that dug into the 1P API and associated (they didn't have to reverse engineer the .opvault format, that was published): https://darthnull.org/series/1password/ https://darthnull.org/series/1password/ and https://github.com/dschuetz/1password#readme https://github.com/dschuetz/1password#readme
- tailspin2019 4y ago
  Interesting. I too am reconsidering the cloud password storage approach. I much preferred local WiFi sync when it used to be available.