Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password sends your password in clear text across the loopback interface

medium.com

Post reply on HN
Print view View original

111–120 of 147 posts

Re: 1Password sends your password in clear text across the loopback interface

#111

Post by kazinator »

roustem wrote: post #98
kazinator wrote: post #65

Earlier quoted context omitted.

I would gravitate toward using a Unix domain socket, like what saslauthd uses. I use saslauthd in a web server I wrote. I have the user ID and password from the browser over HTTPS, open a socket to /var/run/saslauthd/mux, and send them as plain strings, then check the reply. The problem with loopback is that the only thing which prevents the program from sending the data to a rogue socket is the IP address and port n…

Unfortunately, there is no way for browser extensions to create Unix sockets, Also, code signing would prevent anyone from modifying the binaries to change the IP address.

Indeed, it would be particularly amazing if a browser extension did that on Windows. :)

Re: 1Password sends your password in clear text across the loopback interface

#112

Post by pfg »

LukaAl wrote: post #91
pfg wrote: post #41

Earlier quoted context omitted.

You can't read loopback as a normal user. If you have root, you don't need to read unencrypted loopback traffic to get the passwords - just use a key logger.

Fair enough... or not! First of all, when assessing security of a solution you have to define the perimeter of attack. You could imagine a privilege escalation that gives you access to the loopback interface but not enough to install a key-logger. In other words, you are making an assumption that could be wrong! Second, I could agree that perfect safety against every attack is impossible unless you assume your machin…

> You could imagine a privilege escalation that gives you access to the loopback interface but not enough to install a key-logger.

That's a weird thing to say. If you manage to bypass file system access rules, there's any number of ways you can get access to the password manager.

I'm not convinced that any measure 1Password could take to make this harder would amount to more than mere obfuscation, with the cost of additional complexity (and attack surface).

Re: 1Password sends your password in clear text across the loopback interface

#113

Post by jpgoldberg »

venomsnake wrote: post #76
elbigbad wrote: post #51

Earlier quoted context omitted.

I have a problem with the phrase "obviously sloppy work on the part of the developers." How exactly does one avoid loopback in an application like this? Your second point is spot on though I think, one would need to own the machine already before being able to sniff loopback.

Sending in plaintext is sloppy. You can have any protocol over loopback.

And where would you store the keys for that communication in a way that an attacker with root privileges couldn't get it? "Encrypting" with keys available to the attacker is mere obfuscation. In this case, it would provide no extra security to customers; all it would do is lead them to believe that something is encrypted when it is merely obfuscated.

Re: 1Password sends your password in clear text across the loopback interface

#114

Post by jMyles »

Etzos wrote: post #109
jMyles wrote: post #101

Earlier quoted context omitted.

> This falls into the question of what can we do to prevent attacks from malicious processes running on the user's machine. It's likely that I'm misunderstanding things here, but here's what I'm imagining: * I use 1Password and presume that my plaintext password stays on my machine. * I use HTTPS for traffic that I care to secure. * I contract to a vendor, with whom I don't share trusted information, to provide a dum…

The vendor does not have root on your machine or access to the loopback interface. Your machine's loopback interface should not be exposed through a SOCKS proxy unless you specifically tell it to do so (which is a terrible idea for reasons beyond just this situation).

I see. So the loopback traffic occurs on the local machine, the password is decrypted, and only then sent over the regular HTTP(S) connection (with this last bit being the only traffic on the SOCKS)?

Re: 1Password sends your password in clear text across the loopback interface

#115

Post by jpgoldberg »

garrettr_ wrote: post #105
jpgoldberg wrote: post #102

Earlier quoted context omitted.

Are you suggesting simple DH without any long term secret? Hmm. I'm fairly sure we thought through that option, but at moment I can't see see/recall why we rejected it.

Well, unauthenticated DH ("simple DH without any long term secret") is trivially MITM-able, so it could only be useful if you adversary could read but not write to the channel, which I doubt is the case in this context.

Right. This would be unauthenticated with all of the problems that that entails.

Re: 1Password sends your password in clear text across the loopback interface

#116

Post by jlgaddis »

jMyles wrote: post #114
Etzos wrote: post #109

Earlier quoted context omitted.

The vendor does not have root on your machine or access to the loopback interface. Your machine's loopback interface should not be exposed through a SOCKS proxy unless you specifically tell it to do so (which is a terrible idea for reasons beyond just this situation).

I see. So the loopback traffic occurs on the local machine, the password is decrypted, and only then sent over the regular HTTP(S) connection (with this last bit being the only traffic on the SOCKS)?

Yes. Check your settings for your proxy to make sure you aren't sending traffic for localhost over the proxy.

(In Firefox, for example, it's excluded automatically.)

Re: 1Password sends your password in clear text across the loopback interface

#117

Post by nikolay »

revelation wrote: post #104
nikolay wrote: post #82

Earlier quoted context omitted.

If this was an easy task to tackle, we wouldn't be paying a commercial entity to take care of it.

You're not understanding. The only solution to this "problem" is to not give the computer access to the password, which defeats the purpose. But the moment you trust the password to a compromised computer, it's game over.

No, I understand, but it looks like browsers can tackle this better than any third-party could unless there's a plugin mechanism just for that purpose.

Re: 1Password sends your password in clear text across the loopback interface

#118

Post by jlgaddis »

msbarnett wrote: post #95
yborg wrote: post #83

Earlier quoted context omitted.

I also can't access loopback on 10.11.3, I get this exact error. And I'm running as an Administrator account.

Yeah, it's that they installed Wireshark, and gave it privileges to chown the loopback interfaces. edit: Irony here is that Wireshark is doing something far more dangerous than 1password.

It's either a) change the group on the /dev/bpf entries and add your user to that group or b) run Wireshark as root.

Re: 1Password sends your password in clear text across the loopback interface

#119

Post by nullrouted »

jpgoldberg wrote: post #47

[Disclosure: I work for AgileBits, the makers of 1Password] We've talked about this several times, most recently was in June. Please see https://blog.agilebits.com/2015/06/17/1password-inter-proces... This falls into the question of what can we do to prevent attacks from malicious processes running on the user's machine. For the most part, we do try to defend against something where we can. For example, we take steps…

Author here:

Thank you for responding. The reason I wrote this up is not to let people oh my god the world is ending but to let them know, hey if you are using the browser extension there is clear text passwords being sent over the loopback, if you don't like that then don't use their extensions.

You have made very well informed arguments about how hard it is to protect if someone has access to your machine, specifically elevated. But the argument to me seems kind of like "well, it's hard to protect against then so we just decided to not do anything at all." It seems like one other password manager company did something, so why wouldn't you?

Can you explain why it would require a pairing request every time? Couldn't you just pair it once and then be done with it? Can you explain the other approaches?

Re: 1Password sends your password in clear text across the loopback interface

#120

Post by bm5k »

jpgoldberg wrote: post #47

[Disclosure: I work for AgileBits, the makers of 1Password] We've talked about this several times, most recently was in June. Please see https://blog.agilebits.com/2015/06/17/1password-inter-proces... This falls into the question of what can we do to prevent attacks from malicious processes running on the user's machine. For the most part, we do try to defend against something where we can. For example, we take steps…

FTA "the 1Password browser extension protects you from a more typical malware attack of pasteboard/clipboard sniffers."

Clearly, someone at agile bits has given thought to defending against a compromised machine. Therefore, I don't see how you can justify not obfuscating data sent over lo0. I also fail to see how obfuscating the data sent over lo0 would "have unpleasant side effects that risk user data in other ways."

Post reply on HN