1Password sends your password in clear text across the loopback interface
1–10 of 147 posts
Re: 1Password sends your password in clear text across the loopback interface
#2Wow, the communication should be encrypted.
Re: 1Password sends your password in clear text across the loopback interface
#3Seems bad!
Re: 1Password sends your password in clear text across the loopback interface
#4What's wrong with that?
Re: 1Password sends your password in clear text across the loopback interface
#5I'm not sure what the implications are. What has access to that information? Is it public to all services on the machine?
Either way, I don't think this is 100% responsible disclosure.
Re: 1Password sends your password in clear text across the loopback interface
#6So how vulnerable is loopback on a machine in general? This is almost certainly not a best practice, but I can't help but wonder how practically exploitable this is.
Re: 1Password sends your password in clear text across the loopback interface
#7I'm trying to understand when this can be a problem. I guess if you are sharing a VPN / socks proxy with multiple people? And then they are sniffing the loopback and catch your plaintext? Or something?
Re: 1Password sends your password in clear text across the loopback interface
#8[deleted]
Re: 1Password sends your password in clear text across the loopback interface
#9I'm trying to understand when this can be a problem. I guess if you are sharing a VPN / socks proxy with multiple people? And then they are sniffing the loopback and catch your plaintext? Or something?
[deleted]
Re: 1Password sends your password in clear text across the loopback interface
#10At least on OSX 10.11 (not sure about others), you can't sniff loopback as a normal user.
So, if you could sniff this, you'd have elevated privs anyway, which means you could read the keyboard device, memory, etc.
Not ideal, but not sure it's a glaring hole. IMHO. I'd love to hear other thoughts on how to exploit this / how I'm underestimating this hole.