Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password and the Crypto Wars

blog.agilebits.com

Post reply on HN
Print view View original

91–100 of 111 posts

Re: 1Password and the Crypto Wars

#91

Post by jpgoldberg »

revelation wrote: post #18

Back in April, there was an attack on 1Password that managed to exploit some flaws in its crypto scheme to achieve a sizable speedup. [1] To this day, they have not managed to rollout the new 1Password 4 Cloud Keychain that is supposed to fix these flaws. [2] Lots of smooth talk, but apparently security is not a blocker. 1: http://hashcat.net/forum/thread-2238.html 2: http://discussions.agilebits.com/discussion/14780…

[Disclosure: I work for AgileBits, the makers of 1Password]

The PBKDF2 speedup that hashcat achieved really was just 1 bit. This is because the other optimization is used by 1Password as well as by hashcat.

The particular flaw in PBKDF2 that hashcat was able to so brilliantly exploit not only gave it the 2x advantage, but also was connected to a clever AES speed up. (Only decrypting the last CBC block, with the penultimate block as the IV.

I presented a talk about this at PasswordsCon, the slides (PDF) discussing all of this.

Slides (PDF) : http://tooagile.wpengine.netdna-cdn.com/wp-content/uploads/2...

Video: http://youtu.be/oqFwQIOucwo

The 1Password 4 Cloud Keychain Format has been available in 1Password for iOS since December 2012, and it has been working well in the 1Password 4 Beta for Mac. But rolling it out everywhere will take time. Transitioning between formats in a world where data is synchronized between systems takes time. It will continue to take time.

Re: 1Password and the Crypto Wars

#92

Post by jpgoldberg »

revelation wrote: post #83
tptacek wrote: post #69

Earlier quoted context omitted.

Isn't this the attack that reduced the strength of their PBKDF2 scheme by one (1) bit? Because they were unnecessarily calling PBKDF2 twice, where a normal system would have called it once and expanded the resulting key, resulting in exactly the same speed characteristics? Your snark would sting more if you knew what you were talking about. The reason nobody's hair lit on fire over this is that it's a stupid issue.

The speedup was apparently 4x, so rather 2 bit, or as the layman would say, only 1/4th the work . But thats not the point. If you can't trust them to deploy a fix to a stupid issue in half a year, why would you trust them to do it in a day should a serious issue arise? But I agree, its a stupid issue. Snowden tells us endpoint security is the problem. So maybe the Windows 1Password client should stop 1) checking for…

[Disclosure: I work for AgileBits, the makers of 1Password.

The PBKDF2 speed up was 2x, not 4x. Jens was simply wrong about that. The "disputed" speed up comes from an PBKDF2 optimization that is available to the defender as it is to the attacker. 1Password makes use of that optimization. So it gives no advantage to the attacker. It is not a speed up when the defender makes use (as we do) of the same trick.

What versions of 1Password for Windows are you using? The check for updates is over HTTPS. The download is still from a CDN, but the binary is signed (by us). You can examine the trust chain to decide whether it satisfies your requirements.

However, until not so long ago (a few months, I think) you were correct that the 1Password for Windows updater was vulnerable to "evilgrade" attacks.

Re: 1Password and the Crypto Wars

#93

Post by moystard »

dobbsbob wrote: post #84
moystard wrote: post #68

Earlier quoted context omitted.

With LastPass, all data are encrypted locally on your machine so except if there is a backdoor in their extensions/desktop applications, you are normally pretty safe.

http://www.tobtu.com/lastpass.php why nobody should use lastpass

Thanks for the read, will probably switch to KeePass then.

Re: 1Password and the Crypto Wars

#94

Post by revelation »

jpgoldberg wrote: post #92
revelation wrote: post #83

Earlier quoted context omitted.

The speedup was apparently 4x, so rather 2 bit, or as the layman would say, only 1/4th the work . But thats not the point. If you can't trust them to deploy a fix to a stupid issue in half a year, why would you trust them to do it in a day should a serious issue arise? But I agree, its a stupid issue. Snowden tells us endpoint security is the problem. So maybe the Windows 1Password client should stop 1) checking for…

[Disclosure: I work for AgileBits, the makers of 1Password. The PBKDF2 speed up was 2x, not 4x. Jens was simply wrong about that. The "disputed" speed up comes from an PBKDF2 optimization that is available to the defender as it is to the attacker. 1Password makes use of that optimization. So it gives no advantage to the attacker. It is not a speed up when the defender makes use (as we do) of the same trick. What vers…

As stated, the check for updates is finally over HTTPS in the very latest build (333), but you do not verify the certificate in any way. So its essentially HTTP with obfuscation. This allows a malicious network to downgrade clients to build 332, where the check for updates is over plain HTTP and downloaded binaries are not verified.

Re: 1Password and the Crypto Wars

#95

Post by tptacek »

tedunangst wrote: post #88
tptacek wrote: post #69

Earlier quoted context omitted.

Isn't this the attack that reduced the strength of their PBKDF2 scheme by one (1) bit? Because they were unnecessarily calling PBKDF2 twice, where a normal system would have called it once and expanded the resulting key, resulting in exactly the same speed characteristics? Your snark would sting more if you knew what you were talking about. The reason nobody's hair lit on fire over this is that it's a stupid issue.

More accurately, they did call PBKDF2 once, but PBKDF2 internally calls itself twice if you request a key larger than the hash output size. It "expands" the key by generating two and concatenating. It's a stupid bug, but it's a bug in the spec.

Just to be clear: it's fine to take the output of PBKDF2 and expand it with SHA2. They didn't do that, but that would have been a totally normal design with the same "problematic" performance characteristics.

Re: 1Password and the Crypto Wars

#96

Post by SCdF »

eknkc wrote: post #58
SCdF wrote: post #21

In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.

I used both KeePass and 1Password is not just about the pretty interface as you make it to be. Entire UX is much better. Also, even if some 3rd party looked at the code, it doesn't really matter because they are really transparent about the file storage format, there are even some open source cli tools to extract data. Also it is a fact that no data leaves your control. No server side storage or something like that.…

You can only validate their file format, you can't validate, say, the quality of their implementation. For all you know they are intentionally generating files that are really easy to crack, or are using a custom rng implementation given to them by the NSA, or whatever. Super smart people might be able to reverse engineer such knowledge, but it would be better if they could look at the code.

Re: 1Password and the Crypto Wars

#97

Post by tedunangst »

tptacek wrote: post #95
tedunangst wrote: post #88

Earlier quoted context omitted.

More accurately, they did call PBKDF2 once, but PBKDF2 internally calls itself twice if you request a key larger than the hash output size. It "expands" the key by generating two and concatenating. It's a stupid bug, but it's a bug in the spec.

Just to be clear: it's fine to take the output of PBKDF2 and expand it with SHA2. They didn't do that, but that would have been a totally normal design with the same "problematic" performance characteristics.

I'd just as soon pick sha2 as my pbkdf2 hash instead of bolting it on after the fact. That said, I'm not sure what's problematic. Expanding the key with sha2 results in the attacker needing to perform exactly as much work as you. There's no shortcut and no "problem".

Re: 1Password and the Crypto Wars

#98

Post by jamesgeck0 »

shawndumas wrote: post #78
lwhalen wrote: post #26

Earlier quoted context omitted.

Does 1Password have a Linux client? Looking at their page, they appear to only support Mac, Windows, iOS, and Android.

they create an HTML file in your Dropbox (when you sync) that you can hit with any browser.

Just opening the 1PasswordAnywhere html file in Firefox doesn't work. Something about Firefox's local file access policy. I serve the HTML file with `python -m SimpleHTTPServer` and visit localhost:8000 to use it.

Re: 1Password and the Crypto Wars

#99

Post by eknkc »

SCdF wrote: post #96
eknkc wrote: post #58

Earlier quoted context omitted.

I used both KeePass and 1Password is not just about the pretty interface as you make it to be. Entire UX is much better. Also, even if some 3rd party looked at the code, it doesn't really matter because they are really transparent about the file storage format, there are even some open source cli tools to extract data. Also it is a fact that no data leaves your control. No server side storage or something like that.…

You can only validate their file format, you can't validate, say, the quality of their implementation. For all you know they are intentionally generating files that are really easy to crack, or are using a custom rng implementation given to them by the NSA, or whatever. Super smart people might be able to reverse engineer such knowledge, but it would be better if they could look at the code.

One important thing is, my data directory is on my computer. It's not transmitted over any wire. Unless NSA comes knocking... Of course if you want to sync then it goes through dropbox then you have a problem. But they stated that the new version will be able to sync within a wireless LAN.

And If you don't really trust 1Password's encryption, it would be trivial to relocate data files within a trucrypt container or something. (I know this is somewhat ridiculous)

Re: 1Password and the Crypto Wars

#100

Post by SCdF »

eknkc wrote: post #99
SCdF wrote: post #96

Earlier quoted context omitted.

You can only validate their file format, you can't validate, say, the quality of their implementation. For all you know they are intentionally generating files that are really easy to crack, or are using a custom rng implementation given to them by the NSA, or whatever. Super smart people might be able to reverse engineer such knowledge, but it would be better if they could look at the code.

One important thing is, my data directory is on my computer. It's not transmitted over any wire. Unless NSA comes knocking... Of course if you want to sync then it goes through dropbox then you have a problem. But they stated that the new version will be able to sync within a wireless LAN. And If you don't really trust 1Password's encryption, it would be trivial to relocate data files within a trucrypt container or s…

Oh for sure. My original point, way back up tree, still stands though. If you care about security, surely you should care about security. If the data is just on your computer and you're not worried about people getting access to the file why don't you just use a text file, or get the browser to save passwords, or a billion other possibilities that don't cost USD$50-70?

There is something to be said, I suppose, for "well if I sell my computer and forget to dd the drive / it gets stolen then it stops randoms from easily gaining access to my stuff". You then need to wonder if that's the only file you wouldn't want people being able to access. If it turns out that there is other stuff as well, perhaps encrypting your home directory is a smarter idea (I hear there isn't a massive performance hit these days)?

Post reply on HN