What's wrong with that?
Like a lot of security researching blogs, this post doesn't have a good conclusion. This seems bad, and probably is bad, but there has to be details as to why it's bad, what is the danger, what is the threat model, etc.
1Password sends your password in clear text across the loopback interface
11–20 of 147 posts
Re: 1Password sends your password in clear text across the loopback interface
#12What's wrong with that?
Your firewall vendor knowing all your passwords? Nothing. And that is the most benign entity that could listen on the interface.
Re: 1Password sends your password in clear text across the loopback interface
#13Encrypted or not, if 1Password is sending passwords to the browser extension, that means its keychain is unlocked and malware, should it really want to grab data out of the keychain, could just request it from the 1Password helper itself. No need to passively sniff for passwords.
I don't really see what the vulnerability is here.
Re: 1Password sends your password in clear text across the loopback interface
#14Serious question: Why is this a bad thing, and how would you do it differently?
You need the password to be "plaintext" in the input field in the browser, so how do you get it there?
Give the extension access to your private keys and master password to do decryption there? Is the browser a safer environment than an app on your machine?
Re: 1Password sends your password in clear text across the loopback interface
#15[deleted]
Re: 1Password sends your password in clear text across the loopback interface
#16In february 2015 I had contact with agilebits at support@agilebits.com and they answered me within a day. Seriously, you claim you tried to reach them, but I have a hard time believing that. What is 'not too long ago'?
Re: 1Password sends your password in clear text across the loopback interface
#17Serious question: Why is this a bad thing, and how would you do it differently? You need the password to be "plaintext" in the input field in the browser, so how do you get it there? Give the extension access to your private keys and master password to do decryption there? Is the browser a safer environment than an app on your machine?
[deleted]
Re: 1Password sends your password in clear text across the loopback interface
#18What's wrong with that?
Every app that runs on your systems with enough privilege could sniff your username and password and send it out.
That means also apps installed by a person who has access to your systems or malicious code that you, or someone who as access to your system, launched on your system. I'm not sure where it put 1Password in terms of safely storing password, but it is probably in the area of a post-it on your monitor.
I don't know what's your opinion, but if I use a password manager, I'm expecting something more
Re: 1Password sends your password in clear text across the loopback interface
#19I'm not sure what the implications are. What has access to that information? Is it public to all services on the machine? Either way, I don't think this is 100% responsible disclosure.
Anyone with administrative access to the machine could run a capture on the loopback interface and gain access to the plain-text passwords. It's certainly an issue, albeit a limited one (the same user could sniff your keystrokes, etc.).
The author gives his justification for full disclosure in the last paragraph. As I wrote yesterday [0], opinions vary regarding "responsible" disclosure -- and the "discoverer" gets to decide how he wants to handle things.
Re: 1Password sends your password in clear text across the loopback interface
#20That is obviously sloppy work on the part of the developers. And bad. But anyone that can snoop on loopback already owns the machine and he could just cheat engine the passwords from the browser ram.
So it is not making safe situation bad, but bad situation worse. Of course with Blizzard Warden, Steam anti cheat, driver level firewalls and all the other little helpers that collect information about your system - this could lead to a leak to some entity's logs in the cloud.