Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password and the Crypto Wars

blog.agilebits.com

Post reply on HN
Print view View original

31–40 of 111 posts

Re: 1Password and the Crypto Wars

#31

Post by rdl »

tlrobinson wrote: post #25
rdl wrote: post #23

Earlier quoted context omitted.

I'd like it to actually be hardware with tamper evidence (or response, even better), unlike trezor. That makes it a lot easier to use a weaker password or biometric to authenticate with it, safely. The unknown thing is whether it should communicate directly to the computer, or have all communications mediated by the user. I'd be more comfortable if it only had one-way communications capability (user enters something…

You could emulate a keyboard, and have the Bluetooth/USB stacks implemented in dedicated chips, with a 1-way serial connection from the main MCU. But it's pretty nice to be able to hit a keyboard shortcut and have it figure out which password to fill rather than scrolling through a list. It would be pain to enter all the site names without management software too. As always, convenience vs security.

It would cost between 1/30th and 1/15th of a SCAR 17, though.

Re: 1Password and the Crypto Wars

#32

Post by rdl »

lawnchair_larry wrote: post #28
rdl wrote: post #14

Earlier quoted context omitted.

An interesting thing for an open source project might be to put code-signing keys (for a reviewer) out with pseudonymous people on the Internet -- real identities unknown to the developers. I'd be happy to only use releases of 1Password which were signed by both AgileBits and a few nyms with a long history of being awesome (e.g. Satoshi).

People would just declare that the nyms are probably NSA. And they would probably be right in some cases.

If the NSA had a long history of auditing and signing good code, in addition to an unmolested and identifiable developer, and combination of known and unknown nyms who also could attest to the security of the specific code I'm running, I'd be quite happy with their incremental approval.

Re: 1Password and the Crypto Wars

#33

Post by stayradiated »

revelation wrote: post #18

Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. [2] Lots of smooth talk, but apparently security is not a blocker. 1: http://hashcat.net/forum/thread-2238.html 2: http://discussions.agilebits.com/discussion/14780…

> To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws.

The Cloud Keychain format is currently used in 1Password 4 for iOS.

1Password 4 for Mac is also in public beta and will probably be released around the same time as OS X Mavericks.

Re: 1Password and the Crypto Wars

#34

Post by rorrr2 »

laurent123456 wrote: post #24
SCdF wrote: post #21

In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.

Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.

There are Keepass ports for every major OS.

Since it's open source, anybody can implement the client.

Re: 1Password and the Crypto Wars

#35

Post by rorrr2 »

DO NOT USE 1Password.

If you care about security, there's absolutely no reason to use 1Password over an open source solution like KeePass.

Even if 1Password doesn't have a backdoor now, nothing would stop NSA from inserting one and keep the owners quiet about it with a gag order.

AgileBits is a US company, and so you cannot trust their security. Thank the US government for that.

Re: 1Password and the Crypto Wars

#36

Post by rorrr2 »

azov wrote: post #9
ChuckMcM wrote: post #4

Nicely done. I appreciate the stand they are taking here. That said, gag orders are gag orders. You can decide not to play as Lavabits did but you cannot reasonably tell some non-US employee to blab about your NSL since you will go to jail anyway and Federal Prison is Federal Prison.

They can, for example, have a policy that every code change is reviewed by a non-US employee.

Unless the backdoor is inserted right before the compilation.

Re: 1Password and the Crypto Wars

#37

Post by leokun »

stayradiated wrote: post #33
revelation wrote: post #18

Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. [2] Lots of smooth talk, but apparently security is not a blocker. 1: http://hashcat.net/forum/thread-2238.html 2: http://discussions.agilebits.com/discussion/14780…

> To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. The Cloud Keychain format is currently used in 1Password 4 for iOS. 1Password 4 for Mac is also in public beta and will probably be released around the same time as OS X Mavericks.

Of coures useless to those using 1Password with Windows and Android.

Re: 1Password and the Crypto Wars

#39

Post by paulhauggis »

SCdF wrote: post #21

In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.

I used Keypass for a couple of months. It was very unstable, regularly crashed my browser, and I lost all of my passwords at one point.

I switched over to 1Password and never ran into these issues.

Re: 1Password and the Crypto Wars

#40

Post by stock_toaster »

revelation wrote: post #18

Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. [2] Lots of smooth talk, but apparently security is not a blocker. 1: http://hashcat.net/forum/thread-2238.html 2: http://discussions.agilebits.com/discussion/14780…

Any good cross multi-device alternatives?
Post reply on HN