5 ms·

Not encrypting the URLs is just such a baffling choice, i honestly don't understand how that ever happened. Also, as far as i can tell with some very basic mat

Not encrypting the URLs is just such a baffling choice, i honestly don't understand how that ever happened. Also, as far as i can tell with some very basic maths based on running hashcat on my 3070, if you have a big long password on your vault, even with very few rounds of pbkdf, your actual passwords should be safe. I think 1Password's use of an extra "secret key" would be a huge save in a situation like this, where every encryption key is automatically very long

roflyear 4y ago
Also you can migrate them to a longer round setting the next time they use that key - or require some users to relog in or something. This seems like business and product getting in the way of good decisions. Again.
bpicolo 4y ago
1Password has had a phenomenal security story. This is Lastpass breach what, like #4?
- gioo 4y ago
  Look at lastpass' wikipedia page, they have been collecting a security incident after another since 2015.
  - ilyt 4y ago
    to be fair they are by far biggest, and for all we know other might had incidents that they just covered up
    - coder543 4y ago
      Citation needed on "biggest". 1Password appears to have comparable revenue to LastPass, but it is hard to pin down clear sources. Since you seem to have sources, it would be nice to see them. Number of users is even harder to pin down since you never know what a company counts as a "user". Someone who forgot to delete their account from years ago could easily be counted if the company is looking to inflate user counts. Even if they were 100x the size of the next competitor, they would not get a free pass for the obvious technical failures of their implementation, which have nothing to do with the number of users. The entire vault should be encrypted, end to end. The number of PBKDF2 "rounds" should automatically have increased, even for old users. These are huge oversights that fundamentally undermine their credibility. As far as coverups at other companies go, that would be some coverup to avoid any whistleblowers leaking things. Unless it was very recent, this is very unlikely. People take cybersecurity seriously, and counting on every employee to participate in a coverup of a serious breach is unlikely to go well.
    - azinman2 4y ago
      1password only somewhat recently began pushing a cloud product. It’s been locally stored for years. Gotta make that monthly revenue somehow…
      - lxgr 4y ago
        I am also annoyed by the switch to a SaaS-model, but I don‘t think this hurt security in any way, and for most people (i.e. those that used to sync their vault via cloud storage) probably improved it quite a bit. If you store the secret key locally and only locally, the threat model should be the same as before.
ziml77 4y ago
That extra key is something I love about 1Password's security. It ensures that even people who pick poor master passwords are well protected. And even though I have a strong master password, the key is a good extra comfort for me.
- FatActor 4y ago
  The secret key bothers me. A lot. Where do you store this mission critical piece of data? This is a value you cannot memorize (unless you are Rain Man) and it can be used to gain access to your account. The whole point of a password manager was to avoid this kind of vulnerability. Gives me the willies. It's basically a return to post-it notes.
  - FatActor 4y ago
    Can't edit so I'll reply to myself. Thanks, folks, I should have jsut RTFA'd I misunderstood secret key as a failsafe, it is not: https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/ I installed both LastPass and 1Password and they make my homegrown key storage system feel so awkward by comparison.
    - FatActor 4y ago
      1pw really doesn't play nice with yubikeys. LP has no issues (i think it doesn't use WebAuth, which 1P does). 1P UI is nicer. LP is a bit clunky. Not being able to add notes/docs to 1P in the extension kinda stinks ... why can't they just open the vault like LP does. They seem to be very similar: they both crap all over login forms! I like the secret key thing now: it basically forces people to have big passwords. But I find it annoying because my passphrase is enormous to begin with, I don't want to have to fuss with managing another key. I think they are neck-and-neck from my security posture view.
  - CharlesW 4y ago
    > Where do you store this mission critical piece of data? Some suggestions: https://blog.1password.com/where-to-store-your-emergency-kit/ https://blog.1password.com/where-to-store-your-emergency-kit...
deleted 4y ago
[deleted]
procinct 4y ago
Admittedly, I’m not very knowledgeable with this type of stuff, but would they have chosen to do this so that the browser extension can still show the user when a login is available without the user having to authenticate (they then authenticate to get the login details)
- nicce 4y ago
  This is likely the reason. Other providers like BitWarden caches the urls for certain time on client side. Even if you lock vault, extension can suggest that here is available login for certain period.
  - lxgr 4y ago
    Locally caching this data seems like a much more reasonable way to implement this and would have completely prevented this data leak without any impact to usability.
gigel82 4y ago
> Not encrypting the URLs is just such a baffling choice, i honestly don't understand how that ever happened. That's obviously a design choice in order to extract data that can be monetized.

roflyear 4y ago

Also you can migrate them to a longer round setting the next time they use that key - or require some users to relog in or something. This seems like business and product getting in the way of good decisions. Again.

bpicolo 4y ago

1Password has had a phenomenal security story. This is Lastpass breach what, like #4?

gioo 4y ago
Look at lastpass' wikipedia page, they have been collecting a security incident after another since 2015.
- ilyt 4y ago
  to be fair they are by far biggest, and for all we know other might had incidents that they just covered up
  - coder543 4y ago
    Citation needed on "biggest". 1Password appears to have comparable revenue to LastPass, but it is hard to pin down clear sources. Since you seem to have sources, it would be nice to see them. Number of users is even harder to pin down since you never know what a company counts as a "user". Someone who forgot to delete their account from years ago could easily be counted if the company is looking to inflate user counts. Even if they were 100x the size of the next competitor, they would not get a free pass for the obvious technical failures of their implementation, which have nothing to do with the number of users. The entire vault should be encrypted, end to end. The number of PBKDF2 "rounds" should automatically have increased, even for old users. These are huge oversights that fundamentally undermine their credibility. As far as coverups at other companies go, that would be some coverup to avoid any whistleblowers leaking things. Unless it was very recent, this is very unlikely. People take cybersecurity seriously, and counting on every employee to participate in a coverup of a serious breach is unlikely to go well.
  - azinman2 4y ago
    1password only somewhat recently began pushing a cloud product. It’s been locally stored for years. Gotta make that monthly revenue somehow…
    - lxgr 4y ago
      I am also annoyed by the switch to a SaaS-model, but I don‘t think this hurt security in any way, and for most people (i.e. those that used to sync their vault via cloud storage) probably improved it quite a bit. If you store the secret key locally and only locally, the threat model should be the same as before.

ziml77 4y ago

That extra key is something I love about 1Password's security. It ensures that even people who pick poor master passwords are well protected. And even though I have a strong master password, the key is a good extra comfort for me.

FatActor 4y ago
The secret key bothers me. A lot. Where do you store this mission critical piece of data? This is a value you cannot memorize (unless you are Rain Man) and it can be used to gain access to your account. The whole point of a password manager was to avoid this kind of vulnerability. Gives me the willies. It's basically a return to post-it notes.
- FatActor 4y ago
  Can't edit so I'll reply to myself. Thanks, folks, I should have jsut RTFA'd I misunderstood secret key as a failsafe, it is not: https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/ I installed both LastPass and 1Password and they make my homegrown key storage system feel so awkward by comparison.
  - FatActor 4y ago
    1pw really doesn't play nice with yubikeys. LP has no issues (i think it doesn't use WebAuth, which 1P does). 1P UI is nicer. LP is a bit clunky. Not being able to add notes/docs to 1P in the extension kinda stinks ... why can't they just open the vault like LP does. They seem to be very similar: they both crap all over login forms! I like the secret key thing now: it basically forces people to have big passwords. But I find it annoying because my passphrase is enormous to begin with, I don't want to have to fuss with managing another key. I think they are neck-and-neck from my security posture view.
- CharlesW 4y ago
  > Where do you store this mission critical piece of data? Some suggestions: https://blog.1password.com/where-to-store-your-emergency-kit/ https://blog.1password.com/where-to-store-your-emergency-kit...

deleted 4y ago

[deleted]

procinct 4y ago

Admittedly, I’m not very knowledgeable with this type of stuff, but would they have chosen to do this so that the browser extension can still show the user when a login is available without the user having to authenticate (they then authenticate to get the login details)

nicce 4y ago
This is likely the reason. Other providers like BitWarden caches the urls for certain time on client side. Even if you lock vault, extension can suggest that here is available login for certain period.
- lxgr 4y ago
  Locally caching this data seems like a much more reasonable way to implement this and would have completely prevented this data leak without any impact to usability.

gigel82 4y ago

> Not encrypting the URLs is just such a baffling choice, i honestly don't understand how that ever happened. That's obviously a design choice in order to extract data that can be monetized.