roustem

9 ms·

91.
by roustem 9y ago
I would love to migrate to k8s at some point. It would make some things easier. We still need to figure out how to do that without downgrading our existing security configuration -- a lot of it depends on running different services in their
92.
by roustem 9y ago
I am sorry if the downtime affected you in any way. Sending several million emails could be a challenge considering that most of our customers depend on 1Password apps and usually not affected by the downtime. We do have a status page and T
93.
by roustem 9y ago
You are right. Our AWS bill could certainly be lower and we will have to start optimizing it at some point. It is does require extra time/effort though. We deployed 1password.ca and 1password.eu just a few months ago and never really g
94.
by roustem 9y ago
If our security depended on this information being private then we would be in big trouble. I would love to go into more details about the environment and some of the things we did to build on top of the default AWS security settings. It wa
95.
by roustem 9y ago
No, these are real code snippets. I only masked the account identifiers.
96.
by roustem 9y ago
I am sorry but I just could not grasp YAML for some reason. I am always confused by its indentation and maps vs lists notation.
97.
by roustem 9y ago
That's how we designed the original 1Password data format (.agilekeychain). It certainly made syncing with Dropbox much simpler. It does have its drawbacks though. Once you have too many files (and make too many requests), both Dropbox
98.
by roustem 9y ago
> Your website has no obvious way on how to buy the standalone version now. It is not easy. In the beginning we had a website that offered both standalone version and a subscription on the same page. It is easy for HN people to make this
99.
by roustem 9y ago
You are correct. This is the main reason 1Password X never uses a web page when it prompts for the master password -- the master password must be entered in the popup that is only accessible to the extension itself. It is certainly tricky a
100.
by roustem 9y ago
The biggest concern with WebCrypto (with the JavaScript code using WebCrypto) is the fact that you have to trust the delivery mechanism. If there is a problem with TLS then there is a potential for a MITM attack that could modify the JavaSc
101.
by roustem 9y ago
> You guys have already been caught erasing and hiding the previous versions on your site to convert people to 1Password.com. Wow, that is BS. You can download any previous version of 1Password, starting with version 0.8.0 (May 2006): h
102.
by roustem 9y ago
Thank you, @newman314! While we think that subscription makes it easier to use 1Password and not have to purchase apps and upgrades for every platform, there are many users that prefer to use licenses. We are going to support both for upcom
103.
by roustem 9y ago
1Password X is a pure Chrome extension and does not rely on the native app. This has its benefits and obvious drawbacks. Some of the benefits: * Simpler installation * Support for multiple users on the same computer with Chrome user profile
104.
by roustem 9y ago
It is implemented with WebCrypto APIs. The performance would be abysmal in pure JavaScript.
105.
by roustem 9y ago
Teams support has been released long time ago: https://app-updates.agilebits.com/product_history/OPW6 And all our apps have bugs :)
106.
by roustem 10y ago
1Password has over 15 million users across Mac, Windows, iOS and Android platforms.
107.
by roustem 10y ago
We are using WebCrypto in 1Password.com implementation and polyfill with SJCL when a browser does not support the algorithms we need (PBKDF2, AES-GCM in Safari, etc).
108.
by roustem 11y ago
1Password verifies the code signature of the apps connecting to the WebSockets server using SecCodeCheckValidity. That would prevent connection from the apps that do not have their code signature whitelisted.
109.
by roustem 11y ago
I am one of the 1Password developers. If you only want to pair it once then you will need to store the pairing secrets somewhere. Since both server and the client are running on the same machine, it is going to be trivial to obtain this inf
110.
by roustem 11y ago
The problem is that in this case both the server and the client are the same machine. And if you have root access to it then you have access to everything including the private keys of the server.
111.
by roustem 11y ago
Unfortunately, there is no way for browser extensions to create Unix sockets, Also, code signing would prevent anyone from modifying the binaries to change the IP address.
112.
by roustem 11y ago
How would that work when both processes are running on the same Mac, under the same user account?
113.
by roustem 11y ago
Thank you for your help with the 1Password for Teams infrastructure!
114.
by roustem 11y ago
Will the grandkids need oxygen to breathe in 2100?
115.
by roustem 12y ago
I am glad you posted the link here, Jeff! I never heard of Vol 1 and 2 but now I am going to get all three.
116.
by roustem 12y ago
I used https://www.ssl2buy.com/ in the past few months and it worked well.
117.
by roustem 15y ago
We don't collect any usage information. About 18 months ago I removed support for iOS 3 and we got a huge pushback from existing users. I spent another month adding back iOS 3 support. I am sure things must be different now.
118.
by roustem 15y ago
I agree. I am going to add the PBKDF2 strengthening and fix the problem with the PKCS#7 padding mentioned in the article. We plan to submit the 1Password update by the end of March. The support iOS 3 and the old devices really hurt us there
119.
by roustem 16y ago
Delivering Happiness is great. I loved it too. The best book of 2010 for me "Born to Run: A Hidden Tribe, Superathletes, and the Greatest Race the World Has Never Seen" by Christopher McDougall: http://www.amazon.ca/Born-Run-Hidden-Supera
120.
by roustem 17y ago
Yes, there is a way to lookup passwords through the web interface. 1Password automatically generates an encrypted web page that can be opened on Windows or Linux.

More ›