6 ms·

Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have

Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. [2] Lots of smooth talk, but apparently security is not a blocker. 1: http://hashcat.net/forum/thread-2238.html http://hashcat.net/forum/thread-2238.html 2: http://discussions.agilebits.com/discussion/14780/which-products-use-cloud-keychain-and-which-use-agile-keychain http://discussions.agilebits.com/discussion/14780/which-prod...

stayradiated 13y ago
> To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. The Cloud Keychain format is currently used in 1Password 4 for iOS. 1Password 4 for Mac is also in public beta and will probably be released around the same time as OS X Mavericks.
- leokun 13y ago
  Of coures useless to those using 1Password with Windows and Android.
- teamgb 13y ago
  What comes first, security for users, or marketing a new release? If this new format is more secure and ready to roll out, why delay? What if Mavericks doesn't get released in October but gets pushed back to sometime next year?
stock_toaster 13y ago
Any good cross multi-device alternatives?
- WA 13y ago
  Preferably with my own server (owncloud?) as a central keychain?
  - deleted 13y ago
    [deleted]
  - hoers 13y ago
    Yeah that'd be great. I have a dirty solution of syncing my latest keychain backup with owncloud but that's merely for backup
  - dan-bell 13y ago
    There's https://yithlibrary.herokuapp.com/ https://yithlibrary.herokuapp.com/ for a self hosted LastPass clone but unfortunately there's no Firefox or Chrome addons yet.
- Create 13y ago
  https://en.wikipedia.org/wiki/KeePass https://en.wikipedia.org/wiki/KeePass https://www.keepassx.org/ https://www.keepassx.org/ http://keepass.info/ http://keepass.info/
  - chmars 13y ago
    I used KeePassX in the past but switched to 1Password since there was no browser support to speak of. Has that changed?
    - daveid 13y ago
      If you run KeePass (not X), e.g. via Mono on Linux or natively on Windows, you can use the KeeFox Firefox plugin. I believe there are Chrome extensions as well. I didn't find a better linux-native browser-integrating non-cloud alternative yet :(
    - teamgb 13y ago
      One is open source, the other isn't. What is more important - security or convenience?
      - chmars 13y ago
        Security without convenience is mostly useless IMHO.
- moystard 13y ago
  Personally, I am a Last Pass user. It is well included in most browsers out there and you have access to it on your mobile if you subscribe to the premium offer (12 dollars per year).
  - chmars 13y ago
    AFAIK LastPass is an online password manager, i.e., you do not only trust a software vendor like AgileBits for 1Password, but you trust your actual passwords to an online provider. Is that wise given that LastPass could get hacked or asked by authorities to provide your passwords – if there's not already an existing legal access channel?
    - moystard 13y ago
      As said elsewhere, passwords stored in LastPass are encrypted locally. They do not store your password so they officially don't have a way to decrypt your passwords. I agree that it's a matter of trust as your passwords are still stored on their servers.
tptacek 13y ago
Isn't this the attack that reduced the strength of their PBKDF2 scheme by one (1) bit? Because they were unnecessarily calling PBKDF2 twice, where a normal system would have called it once and expanded the resulting key, resulting in exactly the same speed characteristics? Your snark would sting more if you knew what you were talking about. The reason nobody's hair lit on fire over this is that it's a stupid issue.
- rdl 13y ago
  In 2011 they went from 1k to 10k iterations, too. This got done in advance of any known problems, and was a free upgrade. Also, there were some design issues with their mobile app about 2-3 years ago (essentially, security could fall down to a 4-digit passcode in some cases), but they again fixed that by making the passphrase again the key to security. In general I've found them nothing but responsive and competent on security issues (as well as better designers and general software engineers than any security company).
- revelation 13y ago
  The speedup was apparently 4x, so rather 2 bit, or as the layman would say, only 1/4th the work. But thats not the point. If you can't trust them to deploy a fix to a stupid issue in half a year, why would you trust them to do it in a day should a serious issue arise? But I agree, its a stupid issue. Snowden tells us endpoint security is the problem. So maybe the Windows 1Password client should stop 1) checking for updates over HTTP (no s here!) Bonus: you can specify the update URL in the response Bonus: you can specify parts of the dialogue shown to the user 2) download the update over HTTP 3) execute it with elevated rights without verifying it This was maybe fixed in the last build from 2013-08-07: Improved security of automatic updates (using https:// when checking for a new version). Reported by David Thiel, iSEC Partners. Since they use a CDN to distribute updates, these might still be downloaded over HTTP and still not be verified prior to running. -- Update -- You got to be kidding me. So I upgraded my fake update server with a self-signed certificate (with a wrong CN, no less) and of course, the 1Password client happily accepts it. Theres some good news, though. They now verify that the downloaded binary is signed (with their own key)! But since I can control the update server that tells the client what to download, I can just supply the client with an old 1Password build that is still signed but does not implement the strong(isher) scheme in build #333. The installer doesn't complain and what user keeps track of build numbers anyway.
jpgoldberg 13y ago
[Disclosure: I work for AgileBits, the makers of 1Password] The PBKDF2 speedup that hashcat achieved really was just 1 bit. This is because the other optimization is used by 1Password as well as by hashcat. The particular flaw in PBKDF2 that hashcat was able to so brilliantly exploit not only gave it the 2x advantage, but also was connected to a clever AES speed up. (Only decrypting the last CBC block, with the penultimate block as the IV. I presented a talk about this at PasswordsCon, the slides (PDF) discussing all of this. Slides (PDF) : http://tooagile.wpengine.netdna-cdn.com/wp-content/uploads/2013/07/playing-defense.pdf http://tooagile.wpengine.netdna-cdn.com/wp-content/uploads/2... Video: http://youtu.be/oqFwQIOucwo http://youtu.be/oqFwQIOucwo The 1Password 4 Cloud Keychain Format has been available in 1Password for iOS since December 2012, and it has been working well in the 1Password 4 Beta for Mac. But rolling it out everywhere will take time. Transitioning between formats in a world where data is synchronized between systems takes time. It will continue to take time.

stayradiated 13y ago

> To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. The Cloud Keychain format is currently used in 1Password 4 for iOS. 1Password 4 for Mac is also in public beta and will probably be released around the same time as OS X Mavericks.

leokun 13y ago
Of coures useless to those using 1Password with Windows and Android.
teamgb 13y ago
What comes first, security for users, or marketing a new release? If this new format is more secure and ready to roll out, why delay? What if Mavericks doesn't get released in October but gets pushed back to sometime next year?

stock_toaster 13y ago

Any good cross multi-device alternatives?

WA 13y ago
Preferably with my own server (owncloud?) as a central keychain?
- deleted 13y ago
  [deleted]
- hoers 13y ago
  Yeah that'd be great. I have a dirty solution of syncing my latest keychain backup with owncloud but that's merely for backup
- dan-bell 13y ago
  There's https://yithlibrary.herokuapp.com/ https://yithlibrary.herokuapp.com/ for a self hosted LastPass clone but unfortunately there's no Firefox or Chrome addons yet.
Create 13y ago
https://en.wikipedia.org/wiki/KeePass https://en.wikipedia.org/wiki/KeePass https://www.keepassx.org/ https://www.keepassx.org/ http://keepass.info/ http://keepass.info/
- chmars 13y ago
  I used KeePassX in the past but switched to 1Password since there was no browser support to speak of. Has that changed?
  - daveid 13y ago
    If you run KeePass (not X), e.g. via Mono on Linux or natively on Windows, you can use the KeeFox Firefox plugin. I believe there are Chrome extensions as well. I didn't find a better linux-native browser-integrating non-cloud alternative yet :(
  - teamgb 13y ago
    One is open source, the other isn't. What is more important - security or convenience?
    - chmars 13y ago
      Security without convenience is mostly useless IMHO.
moystard 13y ago
Personally, I am a Last Pass user. It is well included in most browsers out there and you have access to it on your mobile if you subscribe to the premium offer (12 dollars per year).
- chmars 13y ago
  AFAIK LastPass is an online password manager, i.e., you do not only trust a software vendor like AgileBits for 1Password, but you trust your actual passwords to an online provider. Is that wise given that LastPass could get hacked or asked by authorities to provide your passwords – if there's not already an existing legal access channel?
  - moystard 13y ago
    As said elsewhere, passwords stored in LastPass are encrypted locally. They do not store your password so they officially don't have a way to decrypt your passwords. I agree that it's a matter of trust as your passwords are still stored on their servers.

tptacek 13y ago

Isn't this the attack that reduced the strength of their PBKDF2 scheme by one (1) bit? Because they were unnecessarily calling PBKDF2 twice, where a normal system would have called it once and expanded the resulting key, resulting in exactly the same speed characteristics? Your snark would sting more if you knew what you were talking about. The reason nobody's hair lit on fire over this is that it's a stupid issue.

rdl 13y ago
In 2011 they went from 1k to 10k iterations, too. This got done in advance of any known problems, and was a free upgrade. Also, there were some design issues with their mobile app about 2-3 years ago (essentially, security could fall down to a 4-digit passcode in some cases), but they again fixed that by making the passphrase again the key to security. In general I've found them nothing but responsive and competent on security issues (as well as better designers and general software engineers than any security company).
revelation 13y ago
The speedup was apparently 4x, so rather 2 bit, or as the layman would say, only 1/4th the work. But thats not the point. If you can't trust them to deploy a fix to a stupid issue in half a year, why would you trust them to do it in a day should a serious issue arise? But I agree, its a stupid issue. Snowden tells us endpoint security is the problem. So maybe the Windows 1Password client should stop 1) checking for updates over HTTP (no s here!) Bonus: you can specify the update URL in the response Bonus: you can specify parts of the dialogue shown to the user 2) download the update over HTTP 3) execute it with elevated rights without verifying it This was maybe fixed in the last build from 2013-08-07: Improved security of automatic updates (using https:// when checking for a new version). Reported by David Thiel, iSEC Partners. Since they use a CDN to distribute updates, these might still be downloaded over HTTP and still not be verified prior to running. -- Update -- You got to be kidding me. So I upgraded my fake update server with a self-signed certificate (with a wrong CN, no less) and of course, the 1Password client happily accepts it. Theres some good news, though. They now verify that the downloaded binary is signed (with their own key)! But since I can control the update server that tells the client what to download, I can just supply the client with an old 1Password build that is still signed but does not implement the strong(isher) scheme in build #333. The installer doesn't complain and what user keeps track of build numbers anyway.

jpgoldberg 13y ago

[Disclosure: I work for AgileBits, the makers of 1Password] The PBKDF2 speedup that hashcat achieved really was just 1 bit. This is because the other optimization is used by 1Password as well as by hashcat. The particular flaw in PBKDF2 that hashcat was able to so brilliantly exploit not only gave it the 2x advantage, but also was connected to a clever AES speed up. (Only decrypting the last CBC block, with the penultimate block as the IV. I presented a talk about this at PasswordsCon, the slides (PDF) discussing all of this. Slides (PDF) : http://tooagile.wpengine.netdna-cdn.com/wp-content/uploads/2013/07/playing-defense.pdf http://tooagile.wpengine.netdna-cdn.com/wp-content/uploads/2... Video: http://youtu.be/oqFwQIOucwo http://youtu.be/oqFwQIOucwo The 1Password 4 Cloud Keychain Format has been available in 1Password for iOS since December 2012, and it has been working well in the 1Password 4 Beta for Mac. But rolling it out everywhere will take time. Transitioning between formats in a world where data is synchronized between systems takes time. It will continue to take time.