Hacker News Reader

Comment by bwoodruff | Hacker News Reader

Thanks for the kind words! Glad to hear it is working out. We have beta support for mutual unlock of the Linux app and browser extension so you can unlock in the browser using your fingerprint. You can check it out here: https://1password.community/discussion/120745/a-better-way-t... - Ben, 1Password

View on HN

Just a warning for people who don't know the parent is referring to the extension formerly called 1Password X (now just 1Password in the browser because AgileBits wants you to use that one) which puts ALL OF YOUR PASSWORDS into your browser's memory.

This is an interesting concern, and you've pasted this identical comment at least three times in this thread. Could you elaborate or link to somewhere that explains this in detail?

This comment on its own isn't very helpful.

This comment by me was wrong, sorry everyone. They’re NOT doing stupid crazy things.

> They do not say that they do not decrypt your entire vault into browser memory, because they do.

I am sorry but this is just wrong. I have close to 6,000 items in my 1Password across family and business accounts. Loading everything into memory all the time would be ridiculous.

I agree, but I was under the impression that the vaults were encrypted as a whole, but according to the security white paper that changed at some point. So you can decrypt individual passwords. So I’m happy and am in the process of correcting my comments. Sorry.

Thank you for following up, CamJN!

Why are you making stuff up, CamJN?

The extension is using IndexedDB to store the passwords and other items. A lot of work went into making sure the extension uses as little memory as possible.

Roustem Founder of 1Password

This statement by me was incorrect and based on the belief that they still encrypted vaults as a whole, but they’ve moved on to encrypting individual passwords so they can be decrypted individually and my whole concern was unfounded. I can’t edit that comment anymore, probably took too long. But it is wrong.

Reply on news.ycombinator.com