1Password CLI Vulnerability • Hacker News Board

Re: 1Password CLI Vulnerability

#11

Post by kachapopopow » Sun, Oct 05, 2025, 8:09 AM UTC

hollow-moe wrote: post #4

is this just a "vulnerability" in the same way sudo doesn't ask for password for a short time after first use ?

only applies to the current terminal session, this applied from any session including build sub-sessions.

but yah, you're right it's a very low-risk attack.

Re: 1Password CLI Vulnerability

#12

Post by oulipo2 » Sun, Oct 05, 2025, 8:33 AM UTC

Is the described behavior still the default with `op` cli?

Re: 1Password CLI Vulnerability

#13

Post by jen729w » Sun, Oct 05, 2025, 8:40 AM UTC

alwa wrote: post #8

jen729w wrote: post #5

[flagged]

Reported to 1Password 2023, disclosure authorized by 1Password 2024, repo published yesterday, no?

Oh wow, my bad. I saw 2024 as the disclosure and thought, well obviously 1Password have fixed that by now. Huh. Unflagged.

So, as someone who literally last month moved all of his .env in to 1Password and was feeling pretty, pretty smart about it: what now?

(Did that, by the way, on the advice of a comment here in response to the previous npm hack, whatever that was, where that commenter said 'you're a fool if you don't have your keys in a password manager' and so on and so forth. Security is hard?)

Re: 1Password CLI Vulnerability

#14

Post by robin_reala » Sun, Oct 05, 2025, 9:04 AM UTC

Sidenote, but nice to see a few more Codeberg links popping up instead of the ubiquitous GitHub. Maybe we’re decentralising a little more in this area.

Re: 1Password CLI Vulnerability

#15

Post by damaya1982 » Sun, Oct 05, 2025, 9:42 AM UTC

hollow-moe wrote: post #4

is this just a "vulnerability" in the same way sudo doesn't ask for password for a short time after first use ?

To an extent, in that once you've unlocked your vault you now have access to it without having to type a password every time (convenience). Of course, the implications of this are far worse, in that you've now sent me (the hacker) all credentials in your vault. I'd say this has less to do with a password manager and more to do with using MFA so that the credentials alone are worthless.

Re: 1Password CLI Vulnerability

#16

Post by damaya1982 » Sun, Oct 05, 2025, 9:49 AM UTC

kachapopopow wrote: post #11

hollow-moe wrote: post #4

is this just a "vulnerability" in the same way sudo doesn't ask for password for a short time after first use ?

only applies to the current terminal session, this applied from any session including build sub-sessions. but yah, you're right it's a very low-risk attack.

Low-risk in terms of what? They’re superficially similar only in that both cache authentication for convenience. But the consequences are totally different. Sudo caches auth to let you run privileged commands locally; it doesn’t hand secrets to other processes. An unlocked 1Password CLI session can be abused by any code that can call the CLI (or read its session token) to export and ship vault contents, that’s an exfiltration vector, not just local privilege reuse. I’d rate that much higher risk personally.

Re: 1Password CLI Vulnerability

#17

Post by woadwarrior01 » Sun, Oct 05, 2025, 10:12 AM UTC

1Password used to be good 10 years ago, but not anymore. A couple of days ago, there was a post about Electron based apps that slow down macOS Tahoe (due to older versions of Electron using an undocumented API). When I ran the script on my laptop, 1Password was on the top of the list.

> 1Password.app: Electron 37.3.1 (Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework)

[1]: https://news.ycombinator.com/item?id=45437112

Edit: Judging by the downvotes, it looks like there are a lot of electron lovers here. Why the hate for more efficient native apps? Are bloated binaries, janky UI and lower battery life, features? :)

Re: 1Password CLI Vulnerability

#18

Post by daveoc64 » Sun, Oct 05, 2025, 10:19 AM UTC

woadwarrior01 wrote: post #17

1Password used to be good 10 years ago, but not anymore. A couple of days ago, there was a post about Electron based apps that slow down macOS Tahoe (due to older versions of Electron using an undocumented API). When I ran the script on my laptop, 1Password was on the top of the list. > 1Password.app: Electron 37.3.1 (Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework) [1]: https://news.yc…

It's only on top of the list because it's likely to be first when you sort by app name.

Re: 1Password CLI Vulnerability

#19

Post by zatertip » Sun, Oct 05, 2025, 10:28 AM UTC

woadwarrior01 wrote: post #17

1Password used to be good 10 years ago, but not anymore. A couple of days ago, there was a post about Electron based apps that slow down macOS Tahoe (due to older versions of Electron using an undocumented API). When I ran the script on my laptop, 1Password was on the top of the list. > 1Password.app: Electron 37.3.1 (Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework) [1]: https://news.yc…

The nightly version(on Linux) is on 38.2.0

Re: 1Password CLI Vulnerability

#20

Post by Hawxy » Sun, Oct 05, 2025, 11:02 AM UTC

woadwarrior01 wrote: post #17

1Password used to be good 10 years ago, but not anymore. A couple of days ago, there was a post about Electron based apps that slow down macOS Tahoe (due to older versions of Electron using an undocumented API). When I ran the script on my laptop, 1Password was on the top of the list. > 1Password.app: Electron 37.3.1 (Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework) [1]: https://news.yc…

That's a 47 day old release and the fix for the macOS issue only came out 7 days ago. Not critically out of date by any means.