3 ms·
Do you know what the basis of that opinion was? As an outsider, how do I know that 1Password is managing its own security better than LastPass has?
by nequo 4y ago
Do you know what the basis of that opinion was? As an outsider, how do I know that 1Password is managing its own security better than LastPass has?
- mdaniel 4y agoI'll copy my reply to a similar "but how do outsiders know they're not cheating us?" comment: They do what any reasonable security company does, and call in vendors who have negative incentive to lie: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ I was especially impressed by the Cure53 ones, where they were provided access to the source code: https://bucket.agilebits.com/security/Cure53-1PW18-report.pdf https://bucket.agilebits.com/security/Cure53-1PW18-report.pd...
- tptacek 4y agoIt would be weird for a security assessment not to include source code access.
- dfdz 4y agoOne key feature of 1Password is the use of a secret key in addition to a master password. See page 10 [1] which explains how the secret key provides extra entropy (which makes it much harder to brute force a user who choses a weak password). Also see Story 1 on page 11 [1]. [1] https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p...