Hacker News Reader

Comment by ryanmccullagh | Hacker News Reader

Can't trust passwords being stored in the cloud.

Which is a fine mentality for personal passwords -- at least I get where the distrust comes from.

But for an enterprise team (or just a team), you need to be able to share passwords with various team members.

Without a system, you're left with each of those people having to use their own (often insecure) personal methodology. Without a password manager, people resort to very simple passwords, or reusing passwords across multiple systems, or writing passwords down on PostIt notes next to their monitors.

Without the convenience of a cloud-based system, you don't have an easy way to back up your passwords -- what happens if someone gets hit by a bus? And you can't easily have someone run compliance to verify when the last time was you updated your password, or how complex your passwords are -- at least not without showing them the raw passwords in all systems.

I get paranoia... but any team that runs a password manager service consistently for all users will be much more secure than any team that doesn't.

* Most Private And Secure Password Managers - Secured.fyi - Alpha || https://secured.fyi/password.html

* Best Password Manager 2018 - Lastpass vs. Dashlane vs. 1Password || https://www.tomsguide.com/us/best-password-managers,review-3...

It's pretty much the old on-prem vs off-prem argument, and for some people & organizations, on-prem is non-negotiable.

I don’t anticipate on-prem being available for individuals; there is simply too much infrastructure required. But for businesses this may be possible in the future. Please reach out to our business team at `business@1password.com` if you are interested. - Ben, AgileBits

> Without the convenience of a cloud-based system

There is a wide spectrum between password-on-PostIt and cloud-based third-party service.

A password-manager accessing a version-controlled master file on the LAN, for example. Which can not only be firewalled nice and tight but is also resilient to xloud-provider going out of business or changing their ToS.

1Password has a whitepaper and explanation of their system end-to-end where they state very unequivocally that they don't have the key and only store/sync your encrypted blob. They could be lying about that, but they are an established business with literally everything to lose if they are caught making such a bone-headed mistake.

Can you really trust the company? What about each and every one of the employees that touch the code? Can you trust their Government not to have asked them for a backdoor?

I don't think I can trust a password manager that isn't open source. Cloud or not.

Can you trust your hosting company?

Can you trust the manufacturer of your personal devices?

Sooner or later you're trusting somebody, unless you literally smelted your own machine starting from ore and a bucket of sand, and then wrote every line of code for it, including the compiler, yourself.

Maybe you should inventory all the entities you're trusting already.

Local vaults is completely client side encrypted, so you didn't have to trust dropbox or iCloud if you used that to sync.

The only major vuln are the updates, and that would have to be a backdoor delivered to everyone, otherwise the mismatched hashes would be noticeable. The surface area is smaller with the client side encrypted version.

Do you trust your client? Oh, you compiled it yourself. Do you trust your compiler? And so on and so forth.

Data is encrypted client side with 1Password.com as well. -Ben, AgileBits

This is a good question.

It was really difficult in the beginning to earn the trust but 1Password is now over 13 years old and there are over 15 million users.

We started 1Password Teams project in 2015 and since then we had several external audits: https://support.1password.com/security-assessments/

We are currently in the process of completing the SOC 2 compliance audit.

We also have the highest paid bug bounty program in BugCrowd: https://bugcrowd.com/agilebits

Trust is earned. Many of us (myself included) feel that 1Password has earned that trust. Don’t let us down :-)

May I ask what your gripes with the cloud are, especially in situations where you encrypt the data to be stored and the cloud provider has no knowledge of the encryption keys?

Does the cloud provider have knowledge of the encryption keys? Do you generate the key in the provider's application, or is it import? Do they send the key to their servers? Can you verify all of this?

The encryption keys are supposed to be generated client side. Obviously you can’t verify this since 1password is closed source, but if your threat model involves the client misbehaving, then you should be using any proprietary password manager. Cloud vs not Cloud is irrelevant.

There is no way we would want to know your keys. There are several million 1Password accounts and 1Password a huge attack target. All keys are generated on the client side and encrypted with a PBKDF2-hardened combination of Master Password + Secret Key.

Details are here: https://1password.com/security/ Whitepaper (PDF): https://1password.com/teams/white-paper/

Reply on news.ycombinator.com