Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password sends your password in clear text across the loopback interface

medium.com

Post reply on HN
Print view View original

51–60 of 147 posts

Re: 1Password sends your password in clear text across the loopback interface

#51

Post by elbigbad »

venomsnake wrote: post #20

That is obviously sloppy work on the part of the developers. And bad. But anyone that can snoop on loopback already owns the machine and he could just cheat engine the passwords from the browser ram. So it is not making safe situation bad, but bad situation worse. Of course with Blizzard Warden, Steam anti cheat, driver level firewalls and all the other little helpers that collect information about your system - this…

I have a problem with the phrase "obviously sloppy work on the part of the developers." How exactly does one avoid loopback in an application like this?

Your second point is spot on though I think, one would need to own the machine already before being able to sniff loopback.

Re: 1Password sends your password in clear text across the loopback interface

#52

Post by kazinator »

The SASL authentication protocol sends cleartext passwords across a local UNIX domain socket. That's very similar: local IPC.

I use this in a web service to authenticate users. The form containing the password is submitted over HTTPS. The CGI script opens the socket, and sends it to saslauthd, which replies OK or not.

Re: 1Password sends your password in clear text across the loopback interface

#54

Post by LukaAl »

euroclydon wrote: post #27
jlgaddis wrote: post #21

Earlier quoted context omitted.

They could at least encrypt it across the socket.

How is the encryption key supposed to get into the Browser plugin?

Same way as the encryption key used to secure the communication with your bank. It doesn't.

The idea behind TLS is that the client and the server agree on a temporary key to exchange the information in a secure way (there's a ton of literature on it) without saving the key locally. The good news is that it is something already implemented in a safe way in all sufficiently recent browser (for sufficiently recent I mean, sufficiently recent to support plugins, because also IE 6 supports some old form of SSL) and make them available to plugins.

TL;DR: It's trivial to do it right, screwing it up in this way means they have no clue on what security means.

Re: 1Password sends your password in clear text across the loopback interface

#55

Post by tonywebster »

tptacek wrote: post #46
tonywebster wrote: post #44

Earlier quoted context omitted.

The author used `tcpdump -i lo0 -s 65535 -w info.pcap` which, as a non-root user without sudo, successfully captures loopback traffic in OS X 10.11.3. I just tried it, and with Chrome and 1Password, I was able to see my auto-filled bank password in the pcap. So, I presume any process on my system, without root privileges, would be able to sniff loopback. I don't see why 1Password wouldn't use TLS here. This is not go…

Your system is misconfigured. > $ tcpdump -i lo0 -s 65535 -w info.pcap tcpdump: lo0: You don't have permission to capture on that device ((cannot open BPF device) /dev/bpf0: Permission denied)

This is a fresh OS X install on a test machine :/

Re: 1Password sends your password in clear text across the loopback interface

#56

Post by cortesoft »

tptacek wrote: post #28
s800 wrote: post #10

At least on OSX 10.11 (not sure about others), you can't sniff loopback as a normal user. So, if you could sniff this, you'd have elevated privs anyway, which means you could read the keyboard device, memory, etc. Not ideal, but not sure it's a glaring hole. IMHO. I'd love to hear other thoughts on how to exploit this / how I'm underestimating this hole.

There is no modern OS on which you can sniff loopback without privileges.

Right, but it looks like the process listening on the port is running as the user.... what is to stop another process running as the same user from killing that process and then binding to the same port?

Re: 1Password sends your password in clear text across the loopback interface

#57

Post by ikeboy »

jpgoldberg wrote: post #47

[Disclosure: I work for AgileBits, the makers of 1Password] We've talked about this several times, most recently was in June. Please see https://blog.agilebits.com/2015/06/17/1password-inter-proces... This falls into the question of what can we do to prevent attacks from malicious processes running on the user's machine. For the most part, we do try to defend against something where we can. For example, we take steps…

Surely encryption with a shared key is strictly better than sending in plaintext?

>In the extreme case, we could have some explicit pairing (sort of like Bluetooth) between 1Password mini and the extension. That is, the browser extension may display some number that you have to type into 1Password mini (or the other way around). With this user intervention we can provide solid mutual authentication, but that user action would need to be done every time either the browser or 1Password mini is launched.

Why every time? The first time, yes, and then each side stores its key. Future connections must handshake on that shared key, so you aren't talking to an imposter.

You still lose against root malware, but threat still seems to strictly decrease.

Re: 1Password sends your password in clear text across the loopback interface

#58

Post by msbarnett »

tonywebster wrote: post #44
s800 wrote: post #10

At least on OSX 10.11 (not sure about others), you can't sniff loopback as a normal user. So, if you could sniff this, you'd have elevated privs anyway, which means you could read the keyboard device, memory, etc. Not ideal, but not sure it's a glaring hole. IMHO. I'd love to hear other thoughts on how to exploit this / how I'm underestimating this hole.

The author used `tcpdump -i lo0 -s 65535 -w info.pcap` which, as a non-root user without sudo, successfully captures loopback traffic in OS X 10.11.3. I just tried it, and with Chrome and 1Password, I was able to see my auto-filled bank password in the pcap. So, I presume any process on my system, without root privileges, would be able to sniff loopback. I don't see why 1Password wouldn't use TLS here. This is not go…

    $ tcpdump -i lo0 -s 65535 -w info.pcap 
    tcpdump: lo0: You don't have permission to capture on that     device
    ((cannot open BPF device) /dev/bpf0: Permission denied)
Looks like you're logged in on a superuser account or have otherwise somehow disable some security settings.

Re: 1Password sends your password in clear text across the loopback interface

#59

Post by tptacek »

tonywebster wrote: post #55
tptacek wrote: post #46

Earlier quoted context omitted.

Your system is misconfigured. > $ tcpdump -i lo0 -s 65535 -w info.pcap tcpdump: lo0: You don't have permission to capture on that device ((cannot open BPF device) /dev/bpf0: Permission denied)

This is a fresh OS X install on a test machine :/

I don't know what to tell you. Normal users can't tcpdump loopback on OSX, or anywhere else.

    > $ ls -l /dev/bpf*                                                                      
    crw-------  1 root  wheel   23,   0 Feb 29 07:59 /dev/bpf0
    crw-------  1 root  wheel   23,   1 Feb 29 07:59 /dev/bpf1
    crw-------  1 root  wheel   23,   2 Mar  2 11:11 /dev/bpf2
    crw-------  1 root  wheel   23,   3 Mar  2 10:07 /dev/bpf3
    crw-------  1 root  wheel   23,   4 Feb 29 08:11 /dev/bpf4

Re: 1Password sends your password in clear text across the loopback interface

#60

Post by joev_ »

I mucked with this a while back. You can dump all your passwords over the websocket pretty easily (provided your 1password is unlocked):

https://gist.github.com/joevennix/438782cbe447e86f2506

It would be more interesting if an arbitrary website could do this, but they prevent that attack by checking the Origin header on the initial websocket request.

Post reply on HN