Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How 1Password is designed to keep your data safe, even in the event of a breach

blog.1password.com

Post reply on HN
Print view View original

11–12 of 12 posts

Re: How 1Password is designed to keep your data safe, even in the event of a breach

#11

Post by YPPH »

Veliladon wrote: post #2

I'm a user of 1Password and a huge fan of the service but I'd really like to have a device sponsor another device automatically (like how iCloud does it) instead of having to present the secret key to the user to manually input into the new client.

I will reach for my secret key perhaps once or twice per year when I buy a new device. That being so, it's really no biggie to type in.

The obvious benefit of a secret key is its high entropy. But I also like how the secret key discourages me from logging into 1Password on anything but my own, trusted, devices. In my view, password managers should not be accessed from other people's computers or internet kiosks.

Re: How 1Password is designed to keep your data safe, even in the event of a breach

#12

Post by hn_throwaway_99 »

jxcl wrote: post #10

There was an article on HN earlier this week about PBKDF2 iterations[1]. The gist of the article was that adding iterations to the key derivation function doesn't actually increase the entropy of a password all that much. No matter how much education and encouragement they're given, some users will choose weak passwords, and those passwords will be crackable even with any reasonable number of DF iterations. This was…

> The gist of the article was that adding iterations to the key derivation function doesn't actually increase the entropy of a password all that much.

I know your linked article talks about it a bit like this, but I think it's wrong to think about PBKDF2 as "increasing the entropy" of a password. The number of PBKDF2 rounds just increases the cost of each guess an attacker makes, but doesn't fundamentally change the number of guesses an attacker needs to make. To me it's basically the constant multiplier term with respect to Big-O notation - that is, while some process make take 1000N time or 10N, it's all still just O(n).

So, that said, I 100% agree that 1Password's approach of using a truly random 128 bit string as part of the key is fundamentally an uncrackable approach while LastPass's was not.

Post reply on HN