6 ms·

There is a white paper on 1passwords design: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1pa

There is a white paper on 1passwords design: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p... They also regularly have audits and pen tests, with the reports pushed publicly: https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ Finally, it's been built by people who are respected in the security industry.

FatActor 4y ago
Thank you for the link. > It's also been built by people who are respected in the security industry. This means almost nothing. It is an appeal to authority. Experts can still miss things. Yes, it is better than experts saying a product stinks, but still is not trustworthy without open source. Maybe I'm making my own fallacy here, I'm just trying out a position.
- beckingz 4y ago
  Most people don't read open source and instead trust that the experts will catch any issues....
  - FatActor 4y ago
    It's turtles all the way down. Would you rather NOT have the option for other experts to see the code?
    - danShumway 4y ago
      Of course not, I'd rather the code be Open and audited. Being Open Source is in some ways a multiplier on security because it allows more expert review. But the expert review is the important part; if security-critical code is Open Source but hasn't been looked at by anyone other than the main developers, the Open Source part is a multiplier on zero. It's a little bit more complicated than that, and there are a lot other factors at play as well even outside of security. We're not really getting into stuff like future-proofing and what happens if 1Password gets a lot worse in the future. It's complicated. But the gist is that while it would be a lot better if 1Password was Open Source, it's still in its current state probably got more eyes on it than some Open Source security projects do.
    - JamesBarney 4y ago
      When the tool is opened sourced honest and rogue security experts are going to go through it. Now how much value is the first adding versus the second removing is the case. And based on incentives for each, an honest security research maybe getting a small bug bounty, and a rogue one potentially gaining access to 10's of thousands of accounts I think it might be a net negative overall.
  - function_seven 4y ago
    Even so, the number of experts looking at the code will increase if it's open, right? I know the concept of "many eyes makes all bugs shallow" isn't the panacea we once thought it was; that still there can be bugs lurking in widely-read sources. But it must be smaller than the number of bugs that exist in code read by a smaller group.
- Espressosaurus 4y ago
  An appeal to authority is not a logical fallacy if the person in question is actually an authority in the domain.
  - fatbird 4y ago
    I wish more people would remember this.
    - butthisiswrong 4y ago
      But its incorrect, its literally the logical fallacy, argument from authority, if the person us not an authority then it cannot by definition be argument by authority. Experts must prove their views with evidence and not rely upon their reputation, that is the meaning of the fallacy. No wonder so many people cant reason well.
      - fatbird 4y ago
        An argument from authority is not a fallacy in and of itself. An appeal to false authority is always a fallacy, such as considering an authority's opinion on a topic on which they're not authoritative. If the participants in a debate agree that an authority is legitimate, then an unchallenged appeal to their authority is not fallacious. If an authority's opinion is contradicted by undisputed evidence, then an appeal to their authority is fallacious. The whole point of the distinction is to admit authority as a valid source of information, in the absence of direct evidence, because we can't possibly reason from direct evidence in every single case.
  - ValentineC 4y ago
    > if the person in question is actually an authority in the domain I haven't seen a name mentioned in much of the discussion here. Who are we talking about from this list, and what else have they done? https://1password.com/company/ https://1password.com/company/
  - thefaux 4y ago
    The truth of a statement is what matters, not who uttered it.
- burkaman 4y ago
  Appeal to authority is not a fallacy, it's basically a necessity to function in the world.
  - FatActor 4y ago
    https://www.grammarly.com/blog/appeal-to-authority-fallacy/ https://www.grammarly.com/blog/appeal-to-authority-fallacy/
    - inthepipe 4y ago
      > When you need to support a claim, it can be tempting to support it with a statement from an authority figure. But if done improperly, this could be a logical fallacy—the appeal to authority fallacy. The key words are: “if done improperly, this could be…” The article goes on the give non-fallacious examples of an appeal to authority. The quality of an implantation will be correlated to experience, so this is an example of a non-fallacious appeal to authority.
    - burkaman 4y ago
      > if done improperly, this could be a logical fallacy Maybe I'm wrong but doesn't this put it in a totally different category than other fallacies? Circular arguments, for example. All circular arguments are wrong. If you identify a circular argument you don't even have to fully understand what is being said, you can immediately conclude "this is a bad argument". But appeal to authority isn't like that. "I'm not going to drive through the mountains today because the roads are iced over, and I know that because the highway department said so." That's an appeal to authority, and it isn't proof, but it's a good argument and there's no need to drive out yourself and confirm that the roads are dangerous. Identifying an appeal to authority is not enough to discard an argument, you need to evaluate the authority. When you see a circular argument you don't have to measure the diameter of the circle or something. So I don't think appealing the Grammarly was a fallacy, but in this case I think they're wrong.
      - FatActor 4y ago
        That's a good clarification. Thanks for the example. Hmm... perhaps my concern is that expert opinions matter way more than non-experts, but we still can't blindly trust them. ...and I'm sure you're not saying to take everything they say as word of truth. I withdraw my argument on the grounds it is poorly constructed.
- inthepipe 4y ago
  Just curious: Imagine two people took the 1Password white paper and created two separate implementations. The only information you have on the two implementations is the background of the people who implemented them. One is a first year CS student; the other is a seasoned security researcher with multiple published vulnerability discoveries. Which would you choose and why?
EMIRELADERO 4y ago
Still doesn't explain why it's all not at least source-available. I'm not going to complain if they don't use open-source licenses such as MIT or (A)GPL, but straight up not making the source code publicly readable at all is a big strike against it.
- dagi3d 4y ago
  Making it opensource is no guarantee at all(if there could be any), for instance it could be more dangerous: anyone could spot a security hole and take advantage of it without reporting it, there is no guarantee there would be a responsible disclosure.
  - EMIRELADERO 4y ago
    Are you vouching for security through obscurity?
    - dagi3d 4y ago
      When systems and code are audited and pentested by third parties, I don't see any benefit of actually making anything public.
- samwillis 4y ago
  There is good insight into this from this comment from them in 2014: https://1password.community/discussion/comment/114870/#Comment_114870 https://1password.community/discussion/comment/114870/#Comme...
  - EMIRELADERO 4y ago
    That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible.
joshe 4y ago
Which people? I've been very reluctant to use their cloud solution as I trust Dropbox more for security. So I still fight 1password to keep the vault stored in Dropbox. I figure there are maybe 4 organizations who are active enough to prevent a full download of all their user's data. Google, Dropbox, Amazon, and Facebook. (Maybe Apple, but they seem lethargic.) Because they store all the passwords to all of our services they are a huge target.
- irrational 4y ago
  My company forced us to use Box and actively blocks Dropbox on all work computers. They did an audit and didn’t like what they saw in Dropbox.
- soraminazuki 4y ago
  You trust Dropbox? The company that infamously invited to their board a former government official responsible for authorizing warrantless mass surveillance?
- dijit 4y ago
  i think “trusting dropbox more” is not what i would necessarily expect. nonetheless i think the provider of my password manager should not themselves host my password vault. If anyone from 1password is reading this: I trust you, but you make it hard to do so if you cannot be flexible about not hosting everything. fd: I use 1password at home and for work.
  - manmal 4y ago
    How would you run a shared vault for work on a „dumb“ file hosting service? With the ability to add/remove team members, recover vaults in case of password loss etc? What about the fact that master passwords can be brute forced if they are weak, just as LP customers are now affected?
    - dijit 4y ago
      I mean, crypographically we’ve had solutions to those exact problems for 30 years. PGP might not be very usable but it also had mechanisms to do this. if you are scared of people copying the vault before they lose access to the storage: you’ll be very sad to know that this is already possible with the SaaS solutions. if you're worried about people breaking the vault if they have access: then its even more of a reason to control the access.
alecco 4y ago
> Finally, it's been built by people who are respected in the security industry. Source for this? To me, the celebrity endorsement makes me doubt it's a serious business.

FatActor 4y ago

Thank you for the link. > It's also been built by people who are respected in the security industry. This means almost nothing. It is an appeal to authority. Experts can still miss things. Yes, it is better than experts saying a product stinks, but still is not trustworthy without open source. Maybe I'm making my own fallacy here, I'm just trying out a position.

beckingz 4y ago
Most people don't read open source and instead trust that the experts will catch any issues....
- FatActor 4y ago
  It's turtles all the way down. Would you rather NOT have the option for other experts to see the code?
  - danShumway 4y ago
    Of course not, I'd rather the code be Open and audited. Being Open Source is in some ways a multiplier on security because it allows more expert review. But the expert review is the important part; if security-critical code is Open Source but hasn't been looked at by anyone other than the main developers, the Open Source part is a multiplier on zero. It's a little bit more complicated than that, and there are a lot other factors at play as well even outside of security. We're not really getting into stuff like future-proofing and what happens if 1Password gets a lot worse in the future. It's complicated. But the gist is that while it would be a lot better if 1Password was Open Source, it's still in its current state probably got more eyes on it than some Open Source security projects do.
  - JamesBarney 4y ago
    When the tool is opened sourced honest and rogue security experts are going to go through it. Now how much value is the first adding versus the second removing is the case. And based on incentives for each, an honest security research maybe getting a small bug bounty, and a rogue one potentially gaining access to 10's of thousands of accounts I think it might be a net negative overall.
- function_seven 4y ago
  Even so, the number of experts looking at the code will increase if it's open, right? I know the concept of "many eyes makes all bugs shallow" isn't the panacea we once thought it was; that still there can be bugs lurking in widely-read sources. But it must be smaller than the number of bugs that exist in code read by a smaller group.
Espressosaurus 4y ago
An appeal to authority is not a logical fallacy if the person in question is actually an authority in the domain.
- fatbird 4y ago
  I wish more people would remember this.
  - butthisiswrong 4y ago
    But its incorrect, its literally the logical fallacy, argument from authority, if the person us not an authority then it cannot by definition be argument by authority. Experts must prove their views with evidence and not rely upon their reputation, that is the meaning of the fallacy. No wonder so many people cant reason well.
    - fatbird 4y ago
      An argument from authority is not a fallacy in and of itself. An appeal to false authority is always a fallacy, such as considering an authority's opinion on a topic on which they're not authoritative. If the participants in a debate agree that an authority is legitimate, then an unchallenged appeal to their authority is not fallacious. If an authority's opinion is contradicted by undisputed evidence, then an appeal to their authority is fallacious. The whole point of the distinction is to admit authority as a valid source of information, in the absence of direct evidence, because we can't possibly reason from direct evidence in every single case.
- ValentineC 4y ago
  > if the person in question is actually an authority in the domain I haven't seen a name mentioned in much of the discussion here. Who are we talking about from this list, and what else have they done? https://1password.com/company/ https://1password.com/company/
- thefaux 4y ago
  The truth of a statement is what matters, not who uttered it.
burkaman 4y ago
Appeal to authority is not a fallacy, it's basically a necessity to function in the world.
- FatActor 4y ago
  https://www.grammarly.com/blog/appeal-to-authority-fallacy/ https://www.grammarly.com/blog/appeal-to-authority-fallacy/
  - inthepipe 4y ago
    > When you need to support a claim, it can be tempting to support it with a statement from an authority figure. But if done improperly, this could be a logical fallacy—the appeal to authority fallacy. The key words are: “if done improperly, this could be…” The article goes on the give non-fallacious examples of an appeal to authority. The quality of an implantation will be correlated to experience, so this is an example of a non-fallacious appeal to authority.
  - burkaman 4y ago
    > if done improperly, this could be a logical fallacy Maybe I'm wrong but doesn't this put it in a totally different category than other fallacies? Circular arguments, for example. All circular arguments are wrong. If you identify a circular argument you don't even have to fully understand what is being said, you can immediately conclude "this is a bad argument". But appeal to authority isn't like that. "I'm not going to drive through the mountains today because the roads are iced over, and I know that because the highway department said so." That's an appeal to authority, and it isn't proof, but it's a good argument and there's no need to drive out yourself and confirm that the roads are dangerous. Identifying an appeal to authority is not enough to discard an argument, you need to evaluate the authority. When you see a circular argument you don't have to measure the diameter of the circle or something. So I don't think appealing the Grammarly was a fallacy, but in this case I think they're wrong.
    - FatActor 4y ago
      That's a good clarification. Thanks for the example. Hmm... perhaps my concern is that expert opinions matter way more than non-experts, but we still can't blindly trust them. ...and I'm sure you're not saying to take everything they say as word of truth. I withdraw my argument on the grounds it is poorly constructed.
inthepipe 4y ago
Just curious: Imagine two people took the 1Password white paper and created two separate implementations. The only information you have on the two implementations is the background of the people who implemented them. One is a first year CS student; the other is a seasoned security researcher with multiple published vulnerability discoveries. Which would you choose and why?

EMIRELADERO 4y ago

Still doesn't explain why it's all not at least source-available. I'm not going to complain if they don't use open-source licenses such as MIT or (A)GPL, but straight up not making the source code publicly readable at all is a big strike against it.

dagi3d 4y ago
Making it opensource is no guarantee at all(if there could be any), for instance it could be more dangerous: anyone could spot a security hole and take advantage of it without reporting it, there is no guarantee there would be a responsible disclosure.
- EMIRELADERO 4y ago
  Are you vouching for security through obscurity?
  - dagi3d 4y ago
    When systems and code are audited and pentested by third parties, I don't see any benefit of actually making anything public.
samwillis 4y ago
There is good insight into this from this comment from them in 2014: https://1password.community/discussion/comment/114870/#Comment_114870 https://1password.community/discussion/comment/114870/#Comme...
- EMIRELADERO 4y ago
  That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible.

joshe 4y ago

Which people? I've been very reluctant to use their cloud solution as I trust Dropbox more for security. So I still fight 1password to keep the vault stored in Dropbox. I figure there are maybe 4 organizations who are active enough to prevent a full download of all their user's data. Google, Dropbox, Amazon, and Facebook. (Maybe Apple, but they seem lethargic.) Because they store all the passwords to all of our services they are a huge target.

irrational 4y ago
My company forced us to use Box and actively blocks Dropbox on all work computers. They did an audit and didn’t like what they saw in Dropbox.
soraminazuki 4y ago
You trust Dropbox? The company that infamously invited to their board a former government official responsible for authorizing warrantless mass surveillance?
dijit 4y ago
i think “trusting dropbox more” is not what i would necessarily expect. nonetheless i think the provider of my password manager should not themselves host my password vault. If anyone from 1password is reading this: I trust you, but you make it hard to do so if you cannot be flexible about not hosting everything. fd: I use 1password at home and for work.
- manmal 4y ago
  How would you run a shared vault for work on a „dumb“ file hosting service? With the ability to add/remove team members, recover vaults in case of password loss etc? What about the fact that master passwords can be brute forced if they are weak, just as LP customers are now affected?
  - dijit 4y ago
    I mean, crypographically we’ve had solutions to those exact problems for 30 years. PGP might not be very usable but it also had mechanisms to do this. if you are scared of people copying the vault before they lose access to the storage: you’ll be very sad to know that this is already possible with the SaaS solutions. if you're worried about people breaking the vault if they have access: then its even more of a reason to control the access.

alecco 4y ago

> Finally, it's been built by people who are respected in the security industry. Source for this? To me, the celebrity endorsement makes me doubt it's a serious business.