This is stupid.
1Password sends your password in clear text across the loopback interface
31–40 of 147 posts
Re: 1Password sends your password in clear text across the loopback interface
#32Encrypted or not, if 1Password is sending passwords to the browser extension, that means its keychain is unlocked and malware, should it really want to grab data out of the keychain, could just request it from the 1Password helper itself. No need to passively sniff for passwords. I don't really see what the vulnerability is here.
In a corporate environment, a system administrator with administrative access to employee/user machines could gain access to their credentials. That's the big issue, I think, unless I'm missing something.
They can do that anyways by sniffing the keyboard directly.
Re: 1Password sends your password in clear text across the loopback interface
#33So what?
Re: 1Password sends your password in clear text across the loopback interface
#34I'm very skeptical of any attempts to secure already compromised machine. It's just unnecessary complications for user, bloat for software and determined attacker is likely to overcome them anyway.
Re: 1Password sends your password in clear text across the loopback interface
#35Encrypted or not, if 1Password is sending passwords to the browser extension, that means its keychain is unlocked and malware, should it really want to grab data out of the keychain, could just request it from the 1Password helper itself. No need to passively sniff for passwords. I don't really see what the vulnerability is here.
In a corporate environment, a system administrator with administrative access to employee/user machines could gain access to their credentials. That's the big issue, I think, unless I'm missing something.
Someone with administrative access would have an almost unlimited number of ways of accessing passwords in any password manager. Key logging, memory dumps ... once your system is owned, you're SOL.
Re: 1Password sends your password in clear text across the loopback interface
#36Re: 1Password sends your password in clear text across the loopback interface
#37What's wrong with that?
Every app that runs on your systems with enough privilege could sniff your username and password and send it out. That means also apps installed by a person who has access to your systems or malicious code that you, or someone who as access to your system, launched on your system. I'm not sure where it put 1Password in terms of safely storing password, but it is probably in the area of a post-it on your monitor. I do…
I don't see how the situation you describe is avoidable, while retaining the ability for a user to automatically fill form fields. That inherently means that the password will be unencrypted and stored for some time; what's the practical difference between sending it via loopback and any other method?
Re: 1Password sends your password in clear text across the loopback interface
#38At least on OSX 10.11 (not sure about others), you can't sniff loopback as a normal user. So, if you could sniff this, you'd have elevated privs anyway, which means you could read the keyboard device, memory, etc. Not ideal, but not sure it's a glaring hole. IMHO. I'd love to hear other thoughts on how to exploit this / how I'm underestimating this hole.
Right, if you can watch loopback as a normal user, then the biggest problem is with machine configuration.
After that, assuming the transmission has to happen, it's just a matter of how difficult you want to make it for root to see the passwords. Since you have to arrive at plaintext in the browser itself, everything a determined root needs to decrypt the transmission will be present on the machine anyway. Still, even a simple ROT-13 to keep an honest root from accidentally seeing the password would be welcome.
Re: 1Password sends your password in clear text across the loopback interface
#39So how vulnerable is loopback on a machine in general? This is almost certainly not a best practice, but I can't help but wonder how practically exploitable this is.
If I already pwn your machine I can learn your passwords while they are moving. So - it will require a special target for the exploit to be worthwhile - lets say North Korean general that uses the same password for pornhub and nuclear launch. That is protected by 1password.
Re: 1Password sends your password in clear text across the loopback interface
#40If you can't trust your system, there is no point in encryption. There is an innumerable number of ways an attacker can get your password if you assume the attacker has system privileges.
If you have loopback sniffing privileges, you could just also ReadProcessMemory the password right out of 1passwords memory.