3 ms·
I had to read this a few times to establish that you weren’t confusing LastPass (the topic of TFA) and 1Password. But even then I’m not 100% sure… :)
by tailspin2019 4y ago
I had to read this a few times to establish that you weren’t confusing LastPass (the topic of TFA) and 1Password.
But even then I’m not 100% sure… :)
- mdaniel 4y agoYeah, I knew I was running that risk, but since I (thankfully) don't have a LP account, I don't have the same depth of experience with that ecosystem. However, I think they now have more in common than differ ... err, php and lax security practices aside. When I saw the attacker had exfiltrated the cloud storage, as a 1P member I thought "there but for the grace of God go I" and have been trying to think through the threat model that does apply to me I have better-than-average experience with 1P's opvault format, and have lightly dug into their local cached copy, but realized I can only say so much about their cloud storage situation because the local copy presumably isn't the same as the way they store it --- BTW, if one is into vault storage formats, I have really enjoyed this series that dug into the 1P API and associated (they didn't have to reverse engineer the .opvault format, that was published): https://darthnull.org/series/1password/ https://darthnull.org/series/1password/ and https://github.com/dschuetz/1password#readme https://github.com/dschuetz/1password#readme
- tailspin2019 4y agoInteresting. I too am reconsidering the cloud password storage approach. I much preferred local WiFi sync when it used to be available.