3 ms·
I use 1password and I trust them way more than I trust myself, and think they are at least on par with competitors so I'm not trying to knock them in any way. T
by version_five 4y ago
I use 1password and I trust them way more than I trust myself, and think they are at least on par with competitors so I'm not trying to knock them in any way. That said, I think the problem with these breaches is the "unknown unknowns". If you've thought of the conditions they lead to a breach, I'd expect you to have addressed them as a professional password storage company. But there can always be failure modes they weren't considered. Maybe it's good to reassure customers that they are still safe. I think it's still a little smug.
It reminds me of companies that didn't do layoffs explaining why they didn't have to do layoffs. Most don't plan to, but someday you may have to, and it's how you act when something bad does happen that's more important than how you act when everything is ok
- TillE 4y agoThis isn't speculation about how a breach might happen, it's what an attacker can do with the encrypted data afterwards. This is well understood basic cryptography. It does take them a while to get to the point, which is that they use a "secret key" in addition to a password to derive an encryption key. It's a smart design.
- zeroonetwothree 4y agoI didn't really read the details of the secret key, but what happens if you lose your device that was storing it?