For the record, as it's been asked in the blog post: Enpass uses loopback as well, but encrypts or decodes (obfuscates?) the data somehow. I looked into decoding the data, but I wasn’t able to do it (just tried for half an hour).
1Password sends your password in clear text across the loopback interface
141–147 of 147 posts
Re: 1Password sends your password in clear text across the loopback interface
#142Earlier quoted context omitted.
You're correct, the loopback works as you described. You should never see loopback packets anywhere but the host machine; if you do, that machine is compromised (not necessarily maliciously, but it's not working how it's supposed to be). I did a little poking around for a threat model for 1Password, but I couldn't find one. Plaintext over loopback is only a problem for 1Password if (and only if) 1Password was intendi…
You are correct that we are vague about the threat model in this case. But please keep in mind that encrypting local data at rest defends against a whole category of "compromise" (i.e., the data stored long term on the local disk being captured) then the case of a malicious process running on the user's machine while the user is actively using 1Password. Officially our view is "if a malicious process with user privil…
> Officially our view is "if a malicious process with user privileges is running on the users machine when they use 1Password, there is little we can do".
I'm curious about whether you guys can address the distinction between "a malicious process with user privileges is running on the users machine" and "a malicious process with some other user's privileges is running on the machine.". That is, is there a threat that your TCP server could be impersonated, and what could happen in this scenario. It's easy to dismiss a scenario where you already have pwnd the 1password user, or worse, root, but TCP listeners aren't scoped to a user, they are scoped to a (potentially multi-user) machine.
Re: 1Password sends your password in clear text across the loopback interface
#143Earlier quoted context omitted.
In this case, client = server. If your computer is compromised then they can get access to both private and public keys of 1Password and 1Password Mini. It also doesn't prevent MITM unless both the client & server. Nothing stops you from presenting a fake public key pair between the communication How doe TLS work then? Because public keys are signed by central authorities. Who do we know what to trust? Browsers and O…
Yeah, you should stop the turtle sequence. Maybe don't make it so easy that a script kid could exploit it, though...
How do you exploit it without already having root or sufficient capabilities to attack 1Password in other ways?
Re: 1Password sends your password in clear text across the loopback interface
#144Earlier quoted context omitted.
It's either a) change the group on the /dev/bpf entries and add your user to that group or b) run Wireshark as root.
On Linux you can give an executable admin access to network devices with setcap which narrows it down further. Is the same possible on OS X? Edit. Actually this is worse than running as root isn't it!
setcap is in principle better than setuid if your program is something like ping. Or in this case, wireshark.
Re: 1Password sends your password in clear text across the loopback interface
#145Earlier quoted context omitted.
Works for me too on OS X. sudo is not needed to run tcpdump for any interfaces. $ ls -l /dev/bpf* crw-rw---- 1 root access_bpf 23, 0 Mar 1 09:18 /dev/bpf0 Edit: Wireshark is installed
Did you install Wireshark? Did you let it reconfigure your system? Is your current user in the "access_bpf" group? Later Yes. Your system is misconfigured. Don't let Wireshark do that.
It looks like Wireshark will happily keep your system permanently misconfigured. To fix it, disable
/Library/LaunchDaemons/org.wireshark.ChmodBPF.plist
This actually seems like a much crummier thing than the 1Password non-thing.
Re: 1Password sends your password in clear text across the loopback interface
#146In february 2015 I had contact with agilebits at support@agilebits.com and they answered me within a day. Seriously, you claim you tried to reach them, but I have a hard time believing that. What is 'not too long ago'?
He only claim he send them an email and that he then decided not to wait for an answer and publish this before they got a chance to respond. In no way is this acceptable behaviour from any security professional. In my mind he's just a kid who thought he would get some cheap points for discovering some big security issue but in the heat of the moment forgot to follow normal protocol
Re: 1Password sends your password in clear text across the loopback interface
#147If someone is observing your loopback isn't it just as likely they're keylogging and have your 1Password master keyphrase?