3 ms·
What I dont understand is how they store your password-db in a safely encrypted manner, when there isn't a password to encrypt it with. It seems that either los
by im3w1l 4y ago
What I dont understand is how they store your password-db in a safely encrypted manner, when there isn't a password to encrypt it with. It seems that either losing your device is fatal (if the encryption key is stored in some trusted tamper resistant chip on device), or 1password can access all your passwords in plaintext?
- vlmutolo 4y agoI believe I read that 1Password will allow unlocking with a hardware token, like a Yubikey. I wonder if they’ll use the PGP capabilities of the Yubikey to allow decryption.
- sebk 4y agoThe blogpost is light on details but they’re most likely using WebAuthn prf which was designed with this use case in mind: https://w3c.github.io/webauthn/#prf-extension https://w3c.github.io/webauthn/#prf-extension , with the idea that it’s backed by a sync fabric rather than a single hardware device.