Hacker News Reader

Comment by smileybarry | Hacker News Reader

All of this is irrelevant for 1Password, as their architecture has an "account key" component & a "password" component combined to form the full key. 1Password SaaS never knows neither one. 1P SaaS is essentially a plain file host for a fully-encrypted database per-customer (technically per-vault so that different users can share vaults, and thus own keys to the same DB without sharing their own DB).

This is also why I personally picked 1Password (and have used them for ~10 years) out of all options, because their original OPVault format (which I synced via Dropbox as a plain file host) and current SaaS format had these safeguards.

Here's the whitepaper explaining this: https://1passwordstatic.com/files/security/1password-white-p...

View on HN

I find the contents of that whitepaper to be interesting and full of valuable information for anyone looking to make a decision on such services.

I do think that it would be technically possible to, eventually, abuse this system. The problem is, these "guarantees" create a misunderstood sense of security. They want you to believe this is "more" secure. But "more secure" than what? Competing cloud platforms, maybe.

What if someone had access to 1Password's "vaults". They would only need to phish the user for two pieces of data; the 1Password password and the account key. Then, without ever having hacked your network, they gain all your passwords.

So anyone with a back door into 1Password gets a trove of accounts that they can phish.

But that’s just a regular phishing attack, and borders on social engineering. It’s even a bit harder than classic phishing because you never input your account key other than at setup of the 1P app.

Your key or password aren’t even sent to 1Password, ever. Logging in is done by computing and sending a cryptographic proof, and both sides validate each other through those cryptographic challenges.

Again, a back door into 1P SaaS in this case is equivalent to a back door into any cloud storage service, e.g.: Google Drive, Dropbox, etc.

> They would only need to phish the user for two pieces of data; the 1Password password and the account key

I think there’s a misunderstanding here. You have an email, an alphanumeric account key and a password. There are 3 user details, effectively. Then, you can add 2FA, either via TOTP or FIDO2/Passkey. So a total of 3 factors: something you have (account key), something you know (password) and something else you have (a 2FA device).

While the encryption might be solid, if you have a security issue in a sensitive area such as the build environment, you cannot have any confidence in the app.

I'm not saying that this is what happened here, just pointing out that there are other risks here which cannot be mitigated by strong encryption.

That extends to any and all applications. Nothing is stopping a local only Keepass installation from being exposed via a supply chain attack to start sending passwords to an attackers server. In fact, I trust 1Password's corporate infrastructure more than my own ability to lock down my personal devices.

I don't disagree. Just pointing out that "zero knowledge" isn't the cure for every security issue.

Reply on news.ycombinator.com