1Password X: A look at the future of 1Password in the browser

https://discussions.agilebits.com/discussion/77406/opvault-i...

https://1password.com/security/

My big issue is still with the web app allowing you to unlock your vault and access your passwords. They acknowledge in the whitepaper that it's theoretically possible that an attacker could MITM your SSL connection and serve malicious javascript, stealing both your master password and any secrets you access. They list certificate pinning and DNSSec as unimplemented future actions they may take, but also need to take into account that their web app servers themselves may be compromised.

All of this could ideally be mitigated by centrally hosting encrypted password databases, but either a) having the extension/desktop app cryptographically verify all server pages and assets, or b) allowing the web UI to be entirely disabled. If they did either of those I'd sign up for an enterprise account in a heartbeat.

[0] https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...

[1] https://tonyarcieri.com/whats-wrong-with-webcrypto

Chrome on iOS is a unique situation.

We offer two things for developers that integrate with 1Password:

1. Native application integration. The idea here is that apps that offer a login to their service/site can pull the username and password from 1Password, then insert it into their native UI controls and sign the user in

2. Web view integration. The idea here is that the developer pass us the web view as part of the process and we handle the filling.

Chrome is using option #1, so what they do is give us the URL, we provide the list of Login items, and then they take the username and password and provide the filling. For the filling parts we have absolutely no control over this in Chrome. Any filling related bugs are completely on Chrome to fix. If they used our web view filling option you'd have consistently the same filling behavior as 1Password does in Safari on iOS.

Sorry you had this experience though. Unfortunately we can't really do anything about it except say we understand your pain. We spent a lot of time and effort getting our filling systems to work as well as they possibly can and when users report issues in Chrome we have to send them off to Google to report those and get them fixed.

Kyle

AgileBits

I would have no problem with paying a monthly fee or paying for every major version (as I have done in the past when applicable) but I think for this use case being able to choose where to host your data - or to not host it at all - is much more justified than it arguably already is with SaaS products in other areas.

1Password certainly know their cryptography but do they also know how to secure servers and networks? I must say I trust Apple or Dropbox a lot more on this matter.

In general, the tendency to build and provide every aspect of a service is bothering me. Otherwise known as the Not-invented-here syndrome, which we largely thought to have overcome with the Internet and the age of hosted software, particularly Web 2.0 kind of SaaS offerings, this development amounts to tight coupling and agglomeration of features that are secondary to the benefit of the actual product at hand:

Why does every application apparently have to provide these features:

- file hosting and serving

- calendaring and event notification

- messaging

- PDF export

- and most famously: Email ("Every program attempts to expand until it can read mail.")

Why is it so hard to provide just the core features of your product and use other products and services by providers specialising in those to implement ancillary features required for building a product or service?

We still have to go a long way in terms of connecting with and building upon other services, one particularly preposterous example of which I recently encountered with a supply chain management process where a company used two perfectly fine - if slightly aging - applications to keep track of different but related data sets. In order to exchange data between these applications a PDF containing the relevant data is exported from application A, sent via email and finally manually entered into application B again.

The waste created by processes like this never ceases to amaze me.