Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password CLI Vulnerability

codeberg.org

Post reply on HN
Print view View original

31–40 of 67 posts

Re: 1Password CLI Vulnerability

#31

Post by starburst »

I’m surprised the CLI doesn’t asked permission for each program trying to access it, when using their SSH agent I get a popup for any program (then it unlock that key for that program until session ends).

People dismissing this vulnerability miss the point of a password manager which is to protect in such scenario where code gets executed on a machine but at least the data is encrypted, of course in that scenario the attacker can get access to the plain text env variables anyway that the developers has on their machine but at least it is not ALL of your credentials like in this case.

Service Account can limit the blast radius BUT you’ll end up saving that API token in your env anyway giving access to anyone executing malicious code…

Using their CLI is dangerous if they haven’t done anything to protect in this scenario. Did they have any comments in that vulnerability and how they want to mitigate it?

Why not simply return the value of the requested items and that’s it? Why unlock everything in a CLI scenario, surely the most common case is simply grabbing a single item like a .env for a project and that’s it.

Re: 1Password CLI Vulnerability

#33

Post by troad »

I really wish I could restrict CLI access to 1Password per vault (or even per item).

When I briefly tried Kamal, it made me very uncomfortable for a script to ask for access to my entire 1Password - every login, credit card, etc. While I do not think Kamal is malicious, in the context of all the constant supply chain attacks, saying yes to anything like that seems extremely irresponsible.

This seems like an area where there'd be obvious value in applying the principle of least privilege, so I was surprised when I couldn't find any granularity to the CLI permissions in 1Password.

Re: 1Password CLI Vulnerability

#34

Post by aniviacat »

crazygringo wrote: post #29
macintux wrote: post #28

Earlier quoted context omitted.

1Password used to be an excellent native app. It's not surprising that many users (myself included) resent the enshittification.

I've used it for years and am only finding out today that it's Electron. And I couldn't care less. 99.9% of my usage is within the browser plugin anyways. And whenever I have to edit an entry, it works fine.

> 99.9% of my usage is within the browser plugin anyways.

If you don't (or barely) use the app, the app is not an issue to you; that seems pretty self-evident.

The experience for regular users may differ.

Re: 1Password CLI Vulnerability

#35

Post by dangus »

psanford wrote: post #26
delusional wrote: post #23

Earlier quoted context omitted.

Yep. This "vulnerability" is actually just a standard warning to not run untrusted software on your machine. In this case the attacker can leverage a commandline program to read your unlocked password vault, but without that he'd still be able to steal any user owned files on your machine and access your bank through your browser to steal your money. "It rather involved being on the other side of this airtight hatchw…

Yes. It is a nice report that does not engage with 1password's security model at all. 1password specifically says that they do not think it is feasible to defend against locally executing malware.

“Not feasible” except that the author of the article provided a list of relatively low-effort solutions that 1Password could implement to improve the situation.

I’m pretty sure defending against locally executing malware is something that companies like Apple and Microsoft work on daily. The idea that it’s not “feasible” sounds suspiciously lazy.

Re: 1Password CLI Vulnerability

#36

Post by conception »

troad wrote: post #33

I really wish I could restrict CLI access to 1Password per vault (or even per item). When I briefly tried Kamal, it made me very uncomfortable for a script to ask for access to my entire 1Password - every login, credit card, etc. While I do not think Kamal is malicious, in the context of all the constant supply chain attacks, saying yes to anything like that seems extremely irresponsible. This seems like an area wher…

Use a service account via cli?

Re: 1Password CLI Vulnerability

#37

Post by crazygringo »

aniviacat wrote: post #34
crazygringo wrote: post #29

Earlier quoted context omitted.

I've used it for years and am only finding out today that it's Electron. And I couldn't care less. 99.9% of my usage is within the browser plugin anyways. And whenever I have to edit an entry, it works fine.

> 99.9% of my usage is within the browser plugin anyways. If you don't (or barely) use the app, the app is not an issue to you; that seems pretty self-evident. The experience for regular users may differ.

What is the problem with it? And isn't everyone using the browser plugin anyways mostly? Isn't that where the vast majority of passwords get entered?

Re: 1Password CLI Vulnerability

#38

Post by krater23 »

dangus wrote: post #35
psanford wrote: post #26

Earlier quoted context omitted.

Yes. It is a nice report that does not engage with 1password's security model at all. 1password specifically says that they do not think it is feasible to defend against locally executing malware.

“Not feasible” except that the author of the article provided a list of relatively low-effort solutions that 1Password could implement to improve the situation. I’m pretty sure defending against locally executing malware is something that companies like Apple and Microsoft work on daily. The idea that it’s not “feasible” sounds suspiciously lazy.

Especially Apple works on that on the iPhone by scanning every new app and leave the customer only install that one that are signed by Apple itself. And they still fail with it.

Re: 1Password CLI Vulnerability

#39

Post by troad »

conception wrote: post #36
troad wrote: post #33

I really wish I could restrict CLI access to 1Password per vault (or even per item). When I briefly tried Kamal, it made me very uncomfortable for a script to ask for access to my entire 1Password - every login, credit card, etc. While I do not think Kamal is malicious, in the context of all the constant supply chain attacks, saying yes to anything like that seems extremely irresponsible. This seems like an area wher…

Use a service account via cli?

Oh neat, I didn't realise that was an option for personal accounts, I had incorrectly assumed they required a business sub. Thank you for the tip!

Re: 1Password CLI Vulnerability

#40

Post by krater23 »

When I execute code on your machine, you are lost. Simply like that.

Don't store important passwords on your machine in a single point of failure. It's safer to store them unencrypted in a wrong named textfile than on the place where everyone will look automacially at first. But more secury is it to NOT store them at all on your machine.

Post reply on HN