Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password sends your password in clear text across the loopback interface

medium.com

Post reply on HN
Print view View original

81–90 of 147 posts

Re: 1Password sends your password in clear text across the loopback interface

#81

Post by ikeboy »

drhayes9 wrote: post #67
ikeboy wrote: post #57

Earlier quoted context omitted.

Surely encryption with a shared key is strictly better than sending in plaintext? >In the extreme case, we could have some explicit pairing (sort of like Bluetooth) between 1Password mini and the extension. That is, the browser extension may display some number that you have to type into 1Password mini (or the other way around). With this user intervention we can provide solid mutual authentication, but that user act…

Not if the shared key is present in the host computer already, which it'd have to be if the host process is to decrypt anything.

http://arxiv.org/abs/1505.06836

Other non root apps can masquerade as the app intended to get the data, and if it's sent in plaintext, they get information they wouldn't if it used a shared key accessible to the intended app.

Re: 1Password sends your password in clear text across the loopback interface

#82

Post by nikolay »

revelation wrote: post #40

If you can't trust your system, there is no point in encryption. There is an innumerable number of ways an attacker can get your password if you assume the attacker has system privileges. If you have loopback sniffing privileges, you could just also ReadProcessMemory the password right out of 1passwords memory.

If this was an easy task to tackle, we wouldn't be paying a commercial entity to take care of it.

Re: 1Password sends your password in clear text across the loopback interface

#83

Post by yborg »

msbarnett wrote: post #58
tonywebster wrote: post #44

Earlier quoted context omitted.

The author used `tcpdump -i lo0 -s 65535 -w info.pcap` which, as a non-root user without sudo, successfully captures loopback traffic in OS X 10.11.3. I just tried it, and with Chrome and 1Password, I was able to see my auto-filled bank password in the pcap. So, I presume any process on my system, without root privileges, would be able to sniff loopback. I don't see why 1Password wouldn't use TLS here. This is not go…

$ tcpdump -i lo0 -s 65535 -w info.pcap tcpdump: lo0: You don't have permission to capture on that device ((cannot open BPF device) /dev/bpf0: Permission denied) Looks like you're logged in on a superuser account or have otherwise somehow disable some security settings.

I also can't access loopback on 10.11.3, I get this exact error. And I'm running as an Administrator account.

Re: 1Password sends your password in clear text across the loopback interface

#85

Post by tedmiston »

Is this post about the 1Password browser extension communicating to the Mac app?

I'd like to understand better to know whether it a similar issue affects LastPass. Though at least with LastPass we're able to use the browser extension without having the native app. I don't think that's possible with 1Password for Mac.

Re: 1Password sends your password in clear text across the loopback interface

#86

Post by ikeboy »

nbadg wrote: post #75
drhayes9 wrote: post #67

Earlier quoted context omitted.

Not if the shared key is present in the host computer already, which it'd have to be if the host process is to decrypt anything.

Particularly if someone is specifically targeting 1password, which they (almost by definition) already would be. It'd just be a single patch to the exploit and you're back in business. Well, okay, obviously that's an oversimplification, but it wouldn't do you much good regardless.

But then malware must run as root.

Re: 1Password sends your password in clear text across the loopback interface

#87

Post by isleyaardvark »

jlgaddis wrote: post #19
aidos wrote: post #5

I'm not sure what the implications are. What has access to that information? Is it public to all services on the machine? Either way, I don't think this is 100% responsible disclosure.

Anyone with administrative access to the machine could run a capture on the loopback interface and gain access to the plain-text passwords. It's certainly an issue, albeit a limited one (the same user could sniff your keystrokes, etc.). The author gives his justification for full disclosure in the last paragraph. As I wrote yesterday [0], opinions vary regarding "responsible" disclosure -- and the "discoverer" gets t…

That sounds like a "It rather involved being on the other side of this airtight hatchway" problem.

https://blogs.msdn.microsoft.com/oldnewthing/20060508-22/?p=...

Re: 1Password sends your password in clear text across the loopback interface

#88

Post by venomsnake »

tptacek wrote: post #42
dcole2929 wrote: post #24

By no means an expert but is this even exploitable if the machine is not already otherwise compromised? Loopback is used for communication between two network applications on the same machine but it doesn't actually use the network device. Of course you'll be able to see it listening on your own computer but an outside computer can't sniff something that doesn't actually get transmitted over the network. Also in orde…

No, it is not exploitable.

But could it leak something - lets say antivirus or firewall with heuristics picks up the traffic and sends it for analysis?

Re: 1Password sends your password in clear text across the loopback interface

#89

Post by jlgaddis »

matthewmacleod wrote: post #30
jlgaddis wrote: post #19

Earlier quoted context omitted.

Anyone with administrative access to the machine could run a capture on the loopback interface and gain access to the plain-text passwords. It's certainly an issue, albeit a limited one (the same user could sniff your keystrokes, etc.). The author gives his justification for full disclosure in the last paragraph. As I wrote yesterday [0], opinions vary regarding "responsible" disclosure -- and the "discoverer" gets t…

Maybe I'm not understanding fully how this works, but couldn't any user with administrative access already gain access to this information anyway? It's obviously got to be stored unencrypted in the browser's memory, regardless of how it gets there; I'm not sure what the difference is here.

They could, sure, but this lowers the bar, I think. It's a helluva lot easier to simply fire up a packet capture for a few minutes and grab the credentials from that than to go sifting through all the gigabytes of RAM for the credentials.

Re: 1Password sends your password in clear text across the loopback interface

#90

Post by tptacek »

venomsnake wrote: post #88
tptacek wrote: post #42

Earlier quoted context omitted.

No, it is not exploitable.

But could it leak something - lets say antivirus or firewall with heuristics picks up the traffic and sends it for analysis?

Don't install antivirus software on OS X. Who knows what crazy shit it might do to your system?
Post reply on HN