6 ms·

1password has a document on their security arch: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security

1password has a document on their security arch: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p.... This alone lends credence to their claims. To this date there has been no major breaches despite being a large target (albeit smaller than LP). Moreover, the fact that your vault is both password protected and locked behind a secret key is about as good as you can get in terms of commercially offered security. That's not to say they couldn't be lying. But after careful evaluation I've gone to them and people much more experienced in security have also moved to them as well. FWIW a "source code audit" or "making it open source" does not imply intrinsic security. You are putting far too much weight in either a firm to do the right thing with money, or the existence of sufficiently motivated OSS researchers mining what might be millions of lines of code. We still find bugs in the Linux kernel regularly despite it quite literally having tens of millions of eyes on it. What makes you think this would do anything more than assuage your fears through security kabuki? In fact, OSS while sounding nice introduces an entirely new attack vector that a company may simply not have the staff to mitigate. To use the Linux kernel once more vulnerabilities have been deliberately injected into the kernel more than once. There have been game breaking SSL bugs. Huge overflow problems, etc. I love OSS. It is not a panacea. Signal chose this model - it does not imply it is the best, the most practical, or the most secure.

deleted 4y ago
[deleted]
EMIRELADERO 4y ago
If a document alone lends credence to their claims, the source code would do wonders. It's not about public contributions, it's about transparency and good faith.
- maccard 4y ago
  Why do you trust the source code is actually what they deploy to your device, or that what they build isnt linked against extra libraries, maybe even internal library?
  - EMIRELADERO 4y ago
    It's a matter of trust and good faith. You could apply the same dichotomy to actual FOSS programs.
    - maccard 4y ago
      I do. Having source code available does6 mean anything if you can't verify the source yourself, or if the source can't be community certified. There's no point in a backend being open source, if nobody can verify what is running there. There's no point in an iOS app being open source if the app is distributed through the app store, as we have no way to verify that it is what it says it is. Meanwhile if I'm running Debian I trust the maintainers have built the source code to distribute to me, similarly with homebrew and chocolatey. > Its a matter of trust and good faith Indeed it is, and you have to trust 1password, and if you don't, it doesn't matter whether there's good faith or not.
      - EMIRELADERO 4y ago
        > Indeed it is, and you have to trust 1password, and if you don't, it doesn't matter whether there's good faith or not. Precisely. By not showing their source code, they implicitly state that they don't care about whether you trust them or not when it comes to source code. It is not a meaningless distinction. Bitwarden for example lists being open-source as a plus in security. You may not personally see it that way, but a big part of the industry does.
        roustem 4y ago
        Intellectual property is important and making everything open source would allow our competitors to easily copy it or at least get an idea how to improve their products. It is hard to seriously compare the features, the security design, and the UX of Bitwarden to 1Password — it is not close. Just a few examples: being able to edit your data while offline, ability have large notes with Markdown formatting (aka "Moby Dick Workout"), support for large datasets (more than 100,000 items). 1Password has been in business for 17 years, longer that any other password manager. It is very difficult to have a long term business model built completely on open source.
FatActor 4y ago
> What makes you think this would do anything more than assuage your fears through security kabuki? And > But after careful evaluation I've gone to them and people much more experienced in security have also moved to them as well. Do you not see your contradiction?

deleted 4y ago

[deleted]

EMIRELADERO 4y ago

If a document alone lends credence to their claims, the source code would do wonders. It's not about public contributions, it's about transparency and good faith.

maccard 4y ago
Why do you trust the source code is actually what they deploy to your device, or that what they build isnt linked against extra libraries, maybe even internal library?
- EMIRELADERO 4y ago
  It's a matter of trust and good faith. You could apply the same dichotomy to actual FOSS programs.
  - maccard 4y ago
    I do. Having source code available does6 mean anything if you can't verify the source yourself, or if the source can't be community certified. There's no point in a backend being open source, if nobody can verify what is running there. There's no point in an iOS app being open source if the app is distributed through the app store, as we have no way to verify that it is what it says it is. Meanwhile if I'm running Debian I trust the maintainers have built the source code to distribute to me, similarly with homebrew and chocolatey. > Its a matter of trust and good faith Indeed it is, and you have to trust 1password, and if you don't, it doesn't matter whether there's good faith or not.
    - EMIRELADERO 4y ago
      > Indeed it is, and you have to trust 1password, and if you don't, it doesn't matter whether there's good faith or not. Precisely. By not showing their source code, they implicitly state that they don't care about whether you trust them or not when it comes to source code. It is not a meaningless distinction. Bitwarden for example lists being open-source as a plus in security. You may not personally see it that way, but a big part of the industry does.
      - roustem 4y ago
        Intellectual property is important and making everything open source would allow our competitors to easily copy it or at least get an idea how to improve their products. It is hard to seriously compare the features, the security design, and the UX of Bitwarden to 1Password — it is not close. Just a few examples: being able to edit your data while offline, ability have large notes with Markdown formatting (aka "Moby Dick Workout"), support for large datasets (more than 100,000 items). 1Password has been in business for 17 years, longer that any other password manager. It is very difficult to have a long term business model built completely on open source.

FatActor 4y ago

> What makes you think this would do anything more than assuage your fears through security kabuki? And > But after careful evaluation I've gone to them and people much more experienced in security have also moved to them as well. Do you not see your contradiction?