Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password CLI Vulnerability

codeberg.org

Post reply on HN
Print view View original

41–50 of 67 posts

Re: 1Password CLI Vulnerability

#41

Post by macintux »

crazygringo wrote: post #37
aniviacat wrote: post #34

Earlier quoted context omitted.

> 99.9% of my usage is within the browser plugin anyways. If you don't (or barely) use the app, the app is not an issue to you; that seems pretty self-evident. The experience for regular users may differ.

What is the problem with it? And isn't everyone using the browser plugin anyways mostly? Isn't that where the vast majority of passwords get entered?

Personally, I use it as much for other secrets as for browser passwords. Social security numbers, software licenses (not so much anymore), password reset questions, passwords I can't paste (for work), etc.

I don't use a plugin. Never tried it, simply never mattered enough (and I generally store frequently-used browser passwords in the browser's keychain as well).

Re: 1Password CLI Vulnerability

#42

Post by RainyDayTmrw »

TheDong wrote: post #30

This is another case of being on the other side of an airtight hatchway: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31... If someone has arbitrary code execution on your machine as your user, then of course they can access things your user can access. They could just as easily keylog your password, or replace the onepassword-cli binary with one that exfiltrates data, or steal your browser cookie to get…

I thought the same. Although, perhaps we have too few hatchways, and too much surface area inside each.

Re: 1Password CLI Vulnerability

#43

Post by chatmasta »

delusional wrote: post #23
hollow-moe wrote: post #4

is this just a "vulnerability" in the same way sudo doesn't ask for password for a short time after first use ?

Yep. This "vulnerability" is actually just a standard warning to not run untrusted software on your machine. In this case the attacker can leverage a commandline program to read your unlocked password vault, but without that he'd still be able to steal any user owned files on your machine and access your bank through your browser to steal your money. "It rather involved being on the other side of this airtight hatchw…

For those not in the know, the hatchway quote is a reference to Raymond Chen’s 2006 blog post: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

Re: 1Password CLI Vulnerability

#44

Post by e40 »

troad wrote: post #33

I really wish I could restrict CLI access to 1Password per vault (or even per item). When I briefly tried Kamal, it made me very uncomfortable for a script to ask for access to my entire 1Password - every login, credit card, etc. While I do not think Kamal is malicious, in the context of all the constant supply chain attacks, saying yes to anything like that seems extremely irresponsible. This seems like an area wher…

This is the takeaway from this disclosure. Everyone using op should create a service account and expose only the secrets that need access via the CLI. That greatly decreases the attack surface.

Re: 1Password CLI Vulnerability

#45

Post by GauntletWizard »

chatmasta wrote: post #43
delusional wrote: post #23

Earlier quoted context omitted.

Yep. This "vulnerability" is actually just a standard warning to not run untrusted software on your machine. In this case the attacker can leverage a commandline program to read your unlocked password vault, but without that he'd still be able to steal any user owned files on your machine and access your bank through your browser to steal your money. "It rather involved being on the other side of this airtight hatchw…

For those not in the know, the hatchway quote is a reference to Raymond Chen’s 2006 blog post: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

Which itself is a Hitchhiker's Guide to the Galaxy reference.

Re: 1Password CLI Vulnerability

#46

Post by [deleted] »

damaya1982 wrote: post #16
kachapopopow wrote: post #11

Earlier quoted context omitted.

only applies to the current terminal session, this applied from any session including build sub-sessions. but yah, you're right it's a very low-risk attack.

Low-risk in terms of what? They’re superficially similar only in that both cache authentication for convenience. But the consequences are totally different. Sudo caches auth to let you run privileged commands locally; it doesn’t hand secrets to other processes. An unlocked 1Password CLI session can be abused by any code that can call the CLI (or read its session token) to export and ship vault contents, that’s an exf…

[deleted]

Re: 1Password CLI Vulnerability

#47

Post by lexicality »

jen729w wrote: post #13
alwa wrote: post #8

Earlier quoted context omitted.

Reported to 1Password 2023, disclosure authorized by 1Password 2024, repo published yesterday, no?

Oh wow, my bad. I saw 2024 as the disclosure and thought, well obviously 1Password have fixed that by now . Huh. Unflagged. So, as someone who literally last month moved all of his .env in to 1Password and was feeling pretty, pretty smart about it: what now? (Did that, by the way, on the advice of a comment here in response to the previous npm hack, whatever that was, where that commenter said 'you're a fool if you d…

> what now?

Put the secrets in their own vault, use a service account to access them and then follow the same rules as sudo's grace period - dedicated terminal session, run only the commands that need to be privileged and exit the session as soon as you don't need it any more

Re: 1Password CLI Vulnerability

#48

Post by jdpage »

troad wrote: post #39
conception wrote: post #36

Earlier quoted context omitted.

Use a service account via cli?

Oh neat, I didn't realise that was an option for personal accounts, I had incorrectly assumed they required a business sub. Thank you for the tip!

One thing that's very cool about 1Password is that they expose a lot of their more enterprisey features even on regular subs. I'm able to use 1Password for secret storage on my at-home k8s cluster without any kind of special business account.

Re: 1Password CLI Vulnerability

#49

Post by crazygringo »

macintux wrote: post #41
crazygringo wrote: post #37

Earlier quoted context omitted.

What is the problem with it? And isn't everyone using the browser plugin anyways mostly? Isn't that where the vast majority of passwords get entered?

Personally, I use it as much for other secrets as for browser passwords. Social security numbers, software licenses (not so much anymore), password reset questions, passwords I can't paste (for work), etc. I don't use a plugin. Never tried it, simply never mattered enough (and I generally store frequently-used browser passwords in the browser's keychain as well).

Genuinely curious: why would you pay for 1Password but then use your browser's password manager? Now you have to keep track of updating passwords in two places? Or remembering which sites are stored in which password manager? That's breaking my brain.
Post reply on HN