Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing 1Password for Teams

blog.agilebits.com

Post reply on HN
Print view View original

51–60 of 151 posts

Re: Introducing 1Password for Teams

#51

Post by jpgoldberg »

Titanous wrote: post #49
jpgoldberg wrote: post #47

Earlier quoted context omitted.

Yep. There is very definitely a reason. You might not like it, but there is. For the moment we need a client that runs reasonable well in web browsers. As libraries become more available or the nature of our clients change, we can switch. We certainly look forward to having the smaller keys that ECC will give us. We are aware of tweet-nacl, but we are trying to avoid the number of external JS libraries we would need.…

Thanks for the answer! WebCrypto is obviously a disaster, it is very unfortunate that new systems are being stuck with legacy crypto if they use it instead of non-native libraries.

I think that there are three issues with WebCrypto that people often conflate. But they need to be looked at separately when judging the security of any particular things.

1. Limited algorithms. This is what has use using GCM instead of a stream cipher for our transport layer. 2. It allows developers to shoot themselves in the foot by not enforcing best practices. 3. It encourages crypto delivered over the web.

If (3) is your concern, then it doesn't matter how good, modern, up to date, the methods are. This objection applies to tweet-nacl just as well.

If (1) is your concern, keep in mind that there is nothing wrong with the algorithms and modes we are using. Sure we had to forego some slicker alternatives, but this is a performance hit.

If (2) is your concern then what is true about WebCrypto is true of almost every crypto library out there. Whether we use libcrypto, CommonCrypto, MS CAPI, etc, we have just as great a chance of "using it wrong" as we do with WebCrypto. WebCrypto isn't worse than most of the alternatives, it is just new enough that we all hoped it would be better than the alternatives in this regard.

So given these three general concerns with WebCrypto, you need to make a judgement about how these play out when evaluating 1Password for Teams.

Re: Introducing 1Password for Teams

#52

Post by steeef »

conorgil145 wrote: post #34
codycowan wrote: post #2

With the sale of Lastpass to LogMeIn, more excited than ever for 1Password to add team features

Why is it an issue that LastPass was sold to LogMeIn? Does that company have a bad reputation, or...? This is a serious question. I am not familiar with LogMeIn.

LogMeIn has a history of buying useful products and then raising prices on them without much warning. I was a faithful customer of Hamachi until LogMeIn purchased them, upped the price, and then tried to lock me in to a subscription.

Re: Introducing 1Password for Teams

#54

Post by jpgoldberg »

tw04 wrote: post #46
AGKyle wrote: post #43

Earlier quoted context omitted.

Really don't want to see anyone get down voted here for having an opinion. Different opinions are what drive conversation, so, I won't ignore your concerns here. I'm not super big on the terminology, but I assume on-prem is on-premise, meaning you'd like to self-host. If I have that correct then unfortunately I can't promise anything here. I will most definitely pass this along to our team though so that they know th…

Correct - on-prem = on-premise. AD integration meaning yes, ability to tie users/groups between 1password and existing AD infrastructure. The idea there being that if a user is terminated, and their AD account is deleted/locked out, everywhere else is locked at the same time. Having to go to 20 different systems to try to clean them out is a great way to miss accounts :)

Ah, that is better. No promises (and nothing in the immediate future), but this does certainly remain in the realm of possibilities.

I don't want to speak for the down-voters (I'm not one of them and I think your comment is was a valuable contribution), but when I first saw AD integration requests I assumed that people wanted AD managed Kerberos authentication to 1Password for Teams; and so imagined delegating 1Password for Teams authentication and authorization to a third entity.

Don't get me wrong. I love Kerberos. And in very early planning stages we looked at it quite a bit. But Kerberos is only about authentication. We need client derived encryption keys as well as authentication tokens to achieve our security goals of end-to-end encryption.

Re: Introducing 1Password for Teams

#55

Post by jms703 »

AGKyle wrote: post #50
tw04 wrote: post #46

Earlier quoted context omitted.

Correct - on-prem = on-premise. AD integration meaning yes, ability to tie users/groups between 1password and existing AD infrastructure. The idea there being that if a user is terminated, and their AD account is deleted/locked out, everywhere else is locked at the same time. Having to go to 20 different systems to try to clean them out is a great way to miss accounts :)

Hey, thanks so much for that. Seriously, means a lot to come in here and know full well you're not really the right person to answer the question but give it a shot anyway and the other party is gracious enough to explain it. I will definitely be passing this along so we have some proper request information on hand. My bosses are reading this, one has even interacted in this discussion already so they're seeing this…

Recommend including LDAP integration in addition to Active Directory. With such a large Mac userbase, you're likely to have more customers using LDAP than AD.

Re: Introducing 1Password for Teams

#56

Post by dijit »

AGRob wrote: post #48
dijit wrote: post #24

Earlier quoted context omitted.

Read only and no browser integration. :/ at least they publish a python module to speak to the agilekeychain

Currently read-only, yes, but it will eventually offer read and write ability. Rob AgileBits

"eventually" doesn't allow me to use it now though, unfortunately.

I don't mean to sound petulant but I do own 1password on two devices and it's really frustrating to have no reasonable ability to use it on my main workstations at home or at work.

Re: Introducing 1Password for Teams

#57

Post by pwman »

bjacobel wrote: post #33
tw04 wrote: post #25

Interesting - lack of active directory integration, and lack of on-prem solution is disappointing though. Edit: since someone is apparently upset over my comment - those two features are absolutely mandatory in almost all corporate environments. If you have a comment to the contrary, feel free to share it. Don't just downvote my comment because you don't personally need the features.

Business customers of LastPass Enterprise and TeamPassword probably disagree.

LastPass has AD Sync capability and has for years with large customers using it: https://enterprise.lastpass.com/enterprise-administration-ba...

Re: Introducing 1Password for Teams

#58

Post by jpgoldberg »

neilellis wrote: post #27

At last full NSA support, I've been waiting for this for ages. Really getting tired of having to open my firewall and give them an SSH login.

At the risk of sounding "markety", let me point out the first three bullet points in the overview of our security doc.

\item[True end-to-end encryption] All cryptographic keys are generated and managed by the client on your devices, and all encryption is done locally. Details are in \nameref{ch:deep}.

\item[Server ignorance] We are never in the position of learning your Master Password or your cryptographic keys. Details are in \nameref{ch:SRP}.

\item[Nothing “crackable” is stored] Often a server will store the password hash. If captured, this can be used in password cracking attempts. Your locally held Account Key means that the data we store cannot be used for cracking attempts. See \nameref{sec:account-key} and particularly Discussion~\ref{aside:factor} for details.

A way of summing this up is that we've aimed to designed things so that our data store is not an attractive target. And that means not being attractive to LEAs.

Post reply on HN