Hacker News Reader

Comment by lolsal | Hacker News Reader

> This part is not true -- your data is encrypted with a randomly generated key that is kept locally. You could freely post the data they have all over the internet and it would be fine.

Do we know this is true? I assume it is, but I haven't checked the source or verified that I can encrypt/decrypt my data with my key, or that there isn't a master key that 1password has that can access it.

View on HN

Hi lolsal. Ben from 1Password here. Implementation details can be found here: https://1pw.ca/whitepaper If you have any questions our security team would be happy to elaborate. They can be reached at support+security@1password.com

I think it's awesome that you publish a whitepaper, but it's just a whitepaper, not source. It doesn't prove anything.

Edit: also there seems to be a lot of this:

> We’re sorry. This section of this document is not yet ready. Any- thing you see in this section is at most an outline of things to come.

We're offering a (mostly) closed source solution. You can evaluate the source for the web app, and the browser extensions. If your argument is that folks shouldn't ever consider using something closed source then obviously 1Password is probably not going to be a good fit and we're at a bit of an impasse.

> Edit: also there seems to be a lot of this:

Some, yes. I'm not sure I'd say 'a lot', but yes, it is a work in progress. Our security team should be able to elaborate on any points that we have yet to detail, though, if you're interested.

I've confirmed it because you can see the data that the web browsers sends and it was encrypted. I've also tested this on LastPass and Bitwarden and from what I can see 1Password does it the best.

Reply on news.ycombinator.com