Hacker News Reader

Comment by jhgg | Hacker News Reader

Perhaps I'm a bit dense here, but in the proposed attack scenario, couldn't the compromised 1Password application just send all passwords to a malicious server when the vault is unlocked - and assuming you have your Dropbox credentials in your 1Password log in and take your files anyways?

View on HN

A compromised 1Password on a Mac could just read the contents of ~/Dropbox and fling it at a remote server, bypassing any Dropbox API perms entirely, even if the user of the system was using non-Dropbox syncing for their 1Password Vault.

Not that the problem is localized to 1Password: any non-sandboxed app could do that, given the default system configuration.

A compromised 1Password application on a Mac can read a lot more than ~/Dropbox. I'm not sure why this problem is specific to Dropbox? Nor why changing the permission would materially change anything? Am I missing something?

Nope, your understanding is correct. That's why I'm not very concerned about the lack of "App folder" access strategies.

If you have 2FA enabled on your Dropbox (and probably your email too), then taking just your credentials won't give the attacker access.

Also, an attacker logging in to your Dropbox would leave a trace in your activity log.

You could still be compromised in this situation if you use 1Password to store your 2FA codes.

Sure, there are scenarios where limited permissions won't make a difference, but there are also scenarios where it will make a difference, and that's what matters.

Of course, it's up to 1Password to decide whether those scenarios are a high priority or not.

edit: 1Password, not Dropbox

OT: To be honest, that was something that always bugged me about password managers, particularly cloud-based ones. I'm not doubting the added security, but isn't it offset by adding another link in the chain with the power to compromise - and even lock you out if it's the only place you store the passwords - of all your accounts?

That's the nice thing about being able to export an encrypted 1Password database for backup. They even store periodic backups for you with the Mac client at least.

I think the files would still be in the Dropbox Trash. But yeah - think the first part could happen.

Reply on news.ycombinator.com