Hacker News Reader

Not dismissing anything you said regarding 1PW but they also had cure53 audits. See e.g.

- https://cure53.de/pentest-report_1password-b5.pdf

- https://cure53.de/pentest-report_1password-mobile.pdf

Edit: overview of audits https://support.1password.com/security-assessments/

These are pen-tests and black-box security audits. While they're definitely better than nothing, and they would show that their security is better than LastPass', the code was never audited.

Are we reading the same reports? At least the two latest reports by Cure53 mentions "source code audit". In addition, the audits by ISE and AppSec explicitly mentions code review as part of the audit.

I am in no way familiar with these kinds of reports, but does this not mean that (at least parts of) the source code was audited?

Reply on news.ycombinator.com