Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password sends your password in clear text across the loopback interface

medium.com

Post reply on HN
Print view View original

41–50 of 147 posts

Re: 1Password sends your password in clear text across the loopback interface

#41

Post by pfg »

LukaAl wrote: post #29
jish wrote: post #14

Serious question: Why is this a bad thing, and how would you do it differently? You need the password to be "plaintext" in the input field in the browser, so how do you get it there? Give the extension access to your private keys and master password to do decryption there? Is the browser a safer environment than an app on your machine?

I explained in a previous comment the problem. As for the solution, without thinking too much, using TLS to encrypt the channel would do it. If we think the browser is not safe, well, all your stack is basically compromised. But if it could handle TLS correctly (and I guess it does it pretty well since it use it to send the info to your bank) it could get the password in a sfae way...

You can't read loopback as a normal user. If you have root, you don't need to read unencrypted loopback traffic to get the passwords - just use a key logger.

Re: 1Password sends your password in clear text across the loopback interface

#42

Post by tptacek »

dcole2929 wrote: post #24

By no means an expert but is this even exploitable if the machine is not already otherwise compromised? Loopback is used for communication between two network applications on the same machine but it doesn't actually use the network device. Of course you'll be able to see it listening on your own computer but an outside computer can't sniff something that doesn't actually get transmitted over the network. Also in orde…

No, it is not exploitable.

Re: 1Password sends your password in clear text across the loopback interface

#43

Post by uptown »

Do other browser extensions have the ability to look at this data? Could a malicious extension have the necessary permissions to read the loopback interface data? Seems like if the 1Password extension has access, I'm not sure what would prevent others from exploiting that access as-well.

Re: 1Password sends your password in clear text across the loopback interface

#44

Post by tonywebster »

s800 wrote: post #10

At least on OSX 10.11 (not sure about others), you can't sniff loopback as a normal user. So, if you could sniff this, you'd have elevated privs anyway, which means you could read the keyboard device, memory, etc. Not ideal, but not sure it's a glaring hole. IMHO. I'd love to hear other thoughts on how to exploit this / how I'm underestimating this hole.

The author used `tcpdump -i lo0 -s 65535 -w info.pcap` which, as a non-root user without sudo, successfully captures loopback traffic in OS X 10.11.3.

I just tried it, and with Chrome and 1Password, I was able to see my auto-filled bank password in the pcap. So, I presume any process on my system, without root privileges, would be able to sniff loopback.

I don't see why 1Password wouldn't use TLS here. This is not good.

Re: 1Password sends your password in clear text across the loopback interface

#45

Post by matthewmacleod »

LukaAl wrote: post #29
jish wrote: post #14

Serious question: Why is this a bad thing, and how would you do it differently? You need the password to be "plaintext" in the input field in the browser, so how do you get it there? Give the extension access to your private keys and master password to do decryption there? Is the browser a safer environment than an app on your machine?

I explained in a previous comment the problem. As for the solution, without thinking too much, using TLS to encrypt the channel would do it. If we think the browser is not safe, well, all your stack is basically compromised. But if it could handle TLS correctly (and I guess it does it pretty well since it use it to send the info to your bank) it could get the password in a sfae way...

That still means the password will be stored unencrypted in the browser's memory. AFAIK, this is no more secure than sending it unencrypted over the loopback interface; is there a scenario where one could snoop loopback, not not read browser memory?

Re: 1Password sends your password in clear text across the loopback interface

#46

Post by tptacek »

tonywebster wrote: post #44
s800 wrote: post #10

At least on OSX 10.11 (not sure about others), you can't sniff loopback as a normal user. So, if you could sniff this, you'd have elevated privs anyway, which means you could read the keyboard device, memory, etc. Not ideal, but not sure it's a glaring hole. IMHO. I'd love to hear other thoughts on how to exploit this / how I'm underestimating this hole.

The author used `tcpdump -i lo0 -s 65535 -w info.pcap` which, as a non-root user without sudo, successfully captures loopback traffic in OS X 10.11.3. I just tried it, and with Chrome and 1Password, I was able to see my auto-filled bank password in the pcap. So, I presume any process on my system, without root privileges, would be able to sniff loopback. I don't see why 1Password wouldn't use TLS here. This is not go…

Your system is misconfigured.

    > $ tcpdump -i lo0 -s 65535 -w info.pcap                                                 
    tcpdump: lo0: You don't have permission to capture on that device
    ((cannot open BPF device) /dev/bpf0: Permission denied)

Re: 1Password sends your password in clear text across the loopback interface

#47

Post by jpgoldberg »

[Disclosure: I work for AgileBits, the makers of 1Password]

We've talked about this several times, most recently was in June. Please see https://blog.agilebits.com/2015/06/17/1password-inter-proces...

This falls into the question of what can we do to prevent attacks from malicious processes running on the user's machine. For the most part, we do try to defend against something where we can. For example, we take steps to make key logging a little more difficult.

In this case, the steps (other than mere obfuscation) that would be necessary to properly encrypt that channel would require that the user be confronted with a "pairing" request and prompt almost every time they restart their browser.

Again, it would be easy to obfuscate this communication, say by using wss; but the private key for that server would still need to be stored en clare on the computer.

There are other approaches as well, but all have unpleasant side effects that risk user data in other ways.

Re: 1Password sends your password in clear text across the loopback interface

#48

Post by msbarnett »

fixermark wrote: post #6

So how vulnerable is loopback on a machine in general? This is almost certainly not a best practice, but I can't help but wonder how practically exploitable this is.

You need superuser privileges to sniff the loopback. Which means if you're in a position to exploit this, you could just sniff the keyboard, or do any number of other malicious things instead.

This is a complete non-issue.

Re: 1Password sends your password in clear text across the loopback interface

#49

Post by cortesoft »

jlgaddis wrote: post #19
aidos wrote: post #5

I'm not sure what the implications are. What has access to that information? Is it public to all services on the machine? Either way, I don't think this is 100% responsible disclosure.

Anyone with administrative access to the machine could run a capture on the loopback interface and gain access to the plain-text passwords. It's certainly an issue, albeit a limited one (the same user could sniff your keystrokes, etc.). The author gives his justification for full disclosure in the last paragraph. As I wrote yesterday [0], opinions vary regarding "responsible" disclosure -- and the "discoverer" gets t…

I don't think you even need administrator access to the machine. The ports being listened to aren't protected ones, and the process is running as the regular user. Any process running as that user could kill the other process and bind to those ports.

Re: 1Password sends your password in clear text across the loopback interface

#50

Post by draw_down »

aidos wrote: post #5

I'm not sure what the implications are. What has access to that information? Is it public to all services on the machine? Either way, I don't think this is 100% responsible disclosure.

I don't get it. Half of these comments are "this is stupid and impossible to exploit", half are calling this irresponsible disclosure.
Post reply on HN