How 1Password is designed to keep your data safe, even in the event of a breach
1–10 of 12 posts
Re: How 1Password is designed to keep your data safe, even in the event of a breach
#2I'm a user of 1Password and a huge fan of the service but I'd really like to have a device sponsor another device automatically (like how iCloud does it) instead of having to present the secret key to the user to manually input into the new client.
Re: How 1Password is designed to keep your data safe, even in the event of a breach
#3I would be very impressed if the 1Password CEO released his/her encrypted vault to the public. It would be a real vote of confidence for the encryption.
Re: How 1Password is designed to keep your data safe, even in the event of a breach
#4I would be very impressed if the 1Password CEO released his/her encrypted vault to the public. It would be a real vote of confidence for the encryption.
We do have a $1,000,000 bug bounty for anyone that can capture the flag.
Re: How 1Password is designed to keep your data safe, even in the event of a breach
#5I'm a user of 1Password and a huge fan of the service but I'd really like to have a device sponsor another device automatically (like how iCloud does it) instead of having to present the secret key to the user to manually input into the new client.
I agree providing the Secret Key to other devices can be a pain. In fact it's our #1 onboarding challenge. On Apple devices specifically it's much easier as we can store it in iCloud Keychain, but we'd like to make it simpler everywhere.
Curious if you've had a chance to try the Setup Code? It's not as slick as iCloud since we don't own the OS, but it enables you to scan the code and get all the account details on your new device. That way all you need to do is type your password.
On that note we recently had a hackathon around this to make things even simpler and we had some success there. I'm hoping we can make this real and share it in an update later this year.
Re: How 1Password is designed to keep your data safe, even in the event of a breach
#6I would be very impressed if the 1Password CEO released his/her encrypted vault to the public. It would be a real vote of confidence for the encryption.
We do have a $1,000,000 bug bounty for anyone that can capture the flag.
Link to the bug bounty:
https://bugcrowd.com/agilebits
Re: How 1Password is designed to keep your data safe, even in the event of a breach
#7I'm a user of 1Password and a huge fan of the service but I'd really like to have a device sponsor another device automatically (like how iCloud does it) instead of having to present the secret key to the user to manually input into the new client.
The secret key is what keeps your account safe in case of compromise though?
Security is always at odds with convenience. - Steve Gibson
Re: How 1Password is designed to keep your data safe, even in the event of a breach
#8I'm a user of 1Password and a huge fan of the service but I'd really like to have a device sponsor another device automatically (like how iCloud does it) instead of having to present the secret key to the user to manually input into the new client.
The secret key is what keeps your account safe in case of compromise though? Security is always at odds with convenience. - Steve Gibson
"Your Secret Key and your 1Password account password both protect your data. They’re combined to create the full encryption key that encrypts everything you store in 1Password."
Re: How 1Password is designed to keep your data safe, even in the event of a breach
#9Earlier quoted context omitted.
The secret key is what keeps your account safe in case of compromise though? Security is always at odds with convenience. - Steve Gibson
" Your Secret Key and your 1Password account password both protect your data. They’re combined to create the full encryption key that encrypts everything you store in 1Password. " https://support.1password.com/secret-key-security/
Right. That reaffirms what I said.
Re: How 1Password is designed to keep your data safe, even in the event of a breach
#10There was an article on HN earlier this week about PBKDF2 iterations[1]. The gist of the article was that adding iterations to the key derivation function doesn't actually increase the entropy of a password all that much. No matter how much education and encouragement they're given, some users will choose weak passwords, and those passwords will be crackable even with any reasonable number of DF iterations.
This was good support for 1PW's 2-key solution, since one of the keys is randomly generated with a true 128 bits of entropy, no matter what password the user chooses, a compromise of the service's data store alone will mean the user's vault encryption key is uncrackable.
[1]: https://neilmadden.blog/2023/01/09/on-pbkdf2-iterations/
Disclaimer: I'm an employee of 1Password.