Regardless, I'm glad they are being open about this. I use 1password, so I want to know absolutely anything that could be a threat, especially after the debacle with LastPass.
1password user data is encrypted, right? so even if a hack had allowed a bad actor access to user pw databases, it's not like they would've just scored everyone's passwords.. right?
Exactly. Accounts are locked with both password and encryption key. The latter is not known by 1Password.
To be accurate, they don't know either. A login key and a decryption key are derived from password and secret key client-side.
I'm not sure about 1password, but with Lastpass, the passwords were encrypted, but not the URLs for each site. Whoever has the lastpass vault knows what sites were associated with each account, and can start targeting accounts which look valuable.
Also, and I don't mean to scare the people who use 1password, they (LastPass) lied about the extent of the encryption. Many technical details they either omitted or lied about until they HAD to reveal the true extent of the hacks that had occurred. I know, I was a LP user unfortunately. Now comfortable at Bitwarden, but 1password was an option I considered.
If they have vaults downloaded, then they can rapidly brute force the vault passwords and would like be able to decrypt a lot of them.
1password protects against this by combining the password you choose with a cryptographically random 128bit “secret key”. That one isn’t getting brute forced easily.
They document their vault security highly and it’s worth reading through.
Good point. It’s been such a long time since I’ve had to use the secret that I forgot it existed.
It’s not as simple as brute forcing the password, it’s also encrypted using a secret key. You essentially have 2 factor encryption on the vaults.
If a user was social engineered, not very tech savy to catch on to it and revealed the master password, you'd only need to guess the encryption key, no?
Yes, but the encryption key is very likely more secure than the users password to begin with.
Unless they had the encryption key.
but the encryption keys are not stored on the 1password cloud systems
It wasn't 1Password that got breached, it was a 3rd party company called Okta, which 1Password was using in some capacity.
The attempted breach was detected and the hackers had only 1 set of Okta credentials from 1 member of the IT team. So they couldn't actually do much.
It was detected and immediately all the keys were changed so the hacker lost all access to Okta immediately.
No 1Password systems were affected at all.
Hypothetically even if the hackers somehow managed to get a customers vault, they would never be able to decrypt it because it requires 1. The master password AND 2. The very long and complex decryption key, which only the user posseses.
Even 1Password does not posses it so it's literally impossible for the vault to be hacked.
1Password is still by far THE most secure password manager.
1Password is still by far THE most secure password manager.
Now that is a very confident statement. Any sources to back that up? Maybe even a comparison to other password managers like Bitwarden, LastPass, etc.?
Don't compare it to last pass, you'll have an answer very shortly
First password manager coming to mind because of such things.
Nothing is unhackable.
Hmm. Why don’t you let everyone know what you know about encryption. Or, let everyone know how much you don’t know about encryption by just stating, “Nothing is unhackable”.
Opsec is a treadmill. Everything is hackable. This is why companies hire penetration testers.
I mean... also, insecure things are eminently hackable and you don't know until someone has tried. That's the main reason companies hire penetration testers.
I think my knowledge suffices to say that equal to physical security no security is forever safe. At some point a weak point will be exposed.
And if you can get a hand on encrypted content and live long enough with the right ressources and determination you might be able to crack something.
Because afaik it's all math at some point. Math is logic and logic can be cracked.
Interesting. Currently, I guess if you have hundreds of years to sit at the most advanced computers currently available you too can crack modern encryption…
Please don't bring up LastPass in this conversation. They aren't relevant to anything wrt security, and worse yet, they remain extremely opaque with their security protocols.
Yeah definitely not worth doing a comparison to LastPass but doing the comparison to bitwarden and then local only ones like keypass/KeepassXC may be worthwhile
Oh yeah. How secure is a local encrypted password safe that is synced via things like Dropbox/OneDrive/GDrive/Syncthing or Resilio in comparison to something like Bitwarden and 1Password.
Not sure if you've read this but it might help get started.
Considering we're hearing about a lot of password managers getting hacked, saying you're the most secure is not really that impressive.
Is it more secure than Bitwarden? (Genuine question)
In theory yes because Bitwarden only uses your master password to unlock your password collection. If someone were to brute force the password and figure it out, or if bitwarden servers were hacked and the password acquired, they could access all your passwords.
With 1Password your vault (database with all your passwords) is encrypted on the server. To open it you must provide 2 things:
The master password
The decryption key
1Password do not have any record of the decryption key. They give it to you as a pdf when you create your account, and only you have it.
So even if someone cracked your master password, they still cannot decrypt the vault to get your info. They would have to come to your house and try find that pdf with decryption key. Which they don't do.
So you are at significantly safer on 1Password
I hope they don't have your master password either. The decryption key sounds like just a longer password or salt with extra steps. What if the generation algo is cracked?
Also, you can go multi-factor with every password manager I know.
You clearly don’t understand what happened, nor what it would take to get into a users password store.
Not as clearly as you seem to think. You'll struggle to find qualified people with criticism of their response.
The main difference is that 1Password requires two pieces of information for decrypting your passwords while Bitwarden requires only one.
Requiring an additional secret in the form of a decryption key has both upsides and downsides:
if someone somehow gets access to your master password, they won't be able to decrypt your passwords unless they also got access to your secret key (or one of your trusted devices)
a weak master password doesn't automatically make you vulnerable
if you lose access to your secret key, your passwords are not recoverable
additional effort to properly secure your key
So whether you want both or only password protection is a trade-off between the additional protection the key offers and the increased complexity of adequately securing it.
Your proposed scenarios of the master password being brute forced or the servers being hacked and your master password acquired when using Bitwarden are misleading.
Brute forcing the master password is not feasible, unless it is weak (too short, common, or part of a breach). By default, Bitwarden protects against brute force attacks on the password itself using PBKDF2 with 600k iterations. Brute forcing AES-256 (to get into the vault without finding the master password) is not possible according to current knowledge.
Your master password cannot be "acquired" if the Bitwarden servers are hacked.
They store the (encrypted) symmetric key used to decrypt your vault as well as your vault (where all your passwords are stored), AES256-encrypted using said symmetric key.
This symmetric key is itself AES256-encrypted using your master password (this is a simplification) before being sent to their servers.
Neither your master password nor the symmetric key used to decrypt your password vault is recoverable from Bitwarden servers by anyone who doesn't know your master password and by extension neither are the passwords stored in your encrypted vault.
Care to back up the last statement about last pass being the most secure? I'm having a really hard time seeing lastpass as more secure than a local only password manager like keepass or KeePassXC.
Honestly, this reads like a PR post.
It really does read like a PR post.
There's some bold confident statements in there that are definitely not really accurate from the standpoint of software and system security.
OP said 1password, not LastPass.
Something local with sufficient encryption will always win against a cloud service, until someone gets access to your computer.
Interesting to learn how to open up not just one PC but a whole infrastructure of passwords, tokens etc.
Imagine trusting a 3rd party to keep every single one of your passwords. That literally defeats the purpose of using passwords if you keep them all centralized. You're supposed to MEMORIZE your passwords. Kindergarten shit.
I have 1400 passwords saved at the moment. You really expect me to memorize all of them?
There's a tradeoff between security and convenience that has to be dealt with. You're not supposed to reuse passwords, but most sites/apps require a login. How do you memorize a couple hundred passwords? An offline vault is safer, but also a real hassle to keep synchronized between devices and locations.
I've settled on memorizing passwords for financial sites and emails and storing the rest in a password manager. All I can hope is that, should a breach happen and my passwords somehow get decrypted, I'll retain control over the most critical accounts.
Save you a click: No user data was compromised.
Regardless, I'm glad they are being open about this. I use 1password, so I want to know absolutely anything that could be a threat, especially after the debacle with LastPass.
1password user data is encrypted, right? so even if a hack had allowed a bad actor access to user pw databases, it's not like they would've just scored everyone's passwords.. right?
Exactly. Accounts are locked with both password and encryption key. The latter is not known by 1Password.
To be accurate, they don't know either. A login key and a decryption key are derived from password and secret key client-side.
I'm not sure about 1password, but with Lastpass, the passwords were encrypted, but not the URLs for each site. Whoever has the lastpass vault knows what sites were associated with each account, and can start targeting accounts which look valuable.
Also, and I don't mean to scare the people who use 1password, they (LastPass) lied about the extent of the encryption. Many technical details they either omitted or lied about until they HAD to reveal the true extent of the hacks that had occurred. I know, I was a LP user unfortunately. Now comfortable at Bitwarden, but 1password was an option I considered.
If they have vaults downloaded, then they can rapidly brute force the vault passwords and would like be able to decrypt a lot of them.
1password protects against this by combining the password you choose with a cryptographically random 128bit “secret key”. That one isn’t getting brute forced easily.
https://1passwordstatic.com/files/security/1password-white-paper.pdf
They document their vault security highly and it’s worth reading through.
Good point. It’s been such a long time since I’ve had to use the secret that I forgot it existed.
It’s not as simple as brute forcing the password, it’s also encrypted using a secret key. You essentially have 2 factor encryption on the vaults.
If a user was social engineered, not very tech savy to catch on to it and revealed the master password, you'd only need to guess the encryption key, no?
Yes, but the encryption key is very likely more secure than the users password to begin with.
Unless they had the encryption key.
but the encryption keys are not stored on the 1password cloud systems
It wasn't 1Password that got breached, it was a 3rd party company called Okta, which 1Password was using in some capacity.
The attempted breach was detected and the hackers had only 1 set of Okta credentials from 1 member of the IT team. So they couldn't actually do much.
It was detected and immediately all the keys were changed so the hacker lost all access to Okta immediately.
No 1Password systems were affected at all.
Hypothetically even if the hackers somehow managed to get a customers vault, they would never be able to decrypt it because it requires 1. The master password AND 2. The very long and complex decryption key, which only the user posseses.
Even 1Password does not posses it so it's literally impossible for the vault to be hacked.
1Password is still by far THE most secure password manager.
Now that is a very confident statement. Any sources to back that up? Maybe even a comparison to other password managers like Bitwarden, LastPass, etc.?
Don't compare it to last pass, you'll have an answer very shortly
First password manager coming to mind because of such things.
Nothing is unhackable.
Hmm. Why don’t you let everyone know what you know about encryption. Or, let everyone know how much you don’t know about encryption by just stating, “Nothing is unhackable”.
Opsec is a treadmill. Everything is hackable. This is why companies hire penetration testers.
I mean... also, insecure things are eminently hackable and you don't know until someone has tried. That's the main reason companies hire penetration testers.
I think my knowledge suffices to say that equal to physical security no security is forever safe. At some point a weak point will be exposed.
And if you can get a hand on encrypted content and live long enough with the right ressources and determination you might be able to crack something.
Because afaik it's all math at some point. Math is logic and logic can be cracked.
Interesting. Currently, I guess if you have hundreds of years to sit at the most advanced computers currently available you too can crack modern encryption…
Please don't bring up LastPass in this conversation. They aren't relevant to anything wrt security, and worse yet, they remain extremely opaque with their security protocols.
Yeah definitely not worth doing a comparison to LastPass but doing the comparison to bitwarden and then local only ones like keypass/KeepassXC may be worthwhile
Oh yeah. How secure is a local encrypted password safe that is synced via things like Dropbox/OneDrive/GDrive/Syncthing or Resilio in comparison to something like Bitwarden and 1Password.
Not sure if you've read this but it might help get started.
https://1passwordstatic.com/files/security/1password-white-paper.pdf
Considering we're hearing about a lot of password managers getting hacked, saying you're the most secure is not really that impressive.
Is it more secure than Bitwarden? (Genuine question)
In theory yes because Bitwarden only uses your master password to unlock your password collection. If someone were to brute force the password and figure it out, or if bitwarden servers were hacked and the password acquired, they could access all your passwords.
With 1Password your vault (database with all your passwords) is encrypted on the server. To open it you must provide 2 things:
1Password do not have any record of the decryption key. They give it to you as a pdf when you create your account, and only you have it.
So even if someone cracked your master password, they still cannot decrypt the vault to get your info. They would have to come to your house and try find that pdf with decryption key. Which they don't do.
So you are at significantly safer on 1Password
I hope they don't have your master password either. The decryption key sounds like just a longer password or salt with extra steps. What if the generation algo is cracked?
Also, you can go multi-factor with every password manager I know.
They don't have your password in any form. The random key is generated with a CSPRNG, we don't know how to crack those. They aren't hiding behind secrets: it's all documented right here https://1passwordstatic.com/files/security/1password-white-paper.pdf
1Password is quite good.
Not good enough clearly.
You clearly don’t understand what happened, nor what it would take to get into a users password store.
Not as clearly as you seem to think. You'll struggle to find qualified people with criticism of their response.
The main difference is that 1Password requires two pieces of information for decrypting your passwords while Bitwarden requires only one.
Requiring an additional secret in the form of a decryption key has both upsides and downsides:
So whether you want both or only password protection is a trade-off between the additional protection the key offers and the increased complexity of adequately securing it.
Your proposed scenarios of the master password being brute forced or the servers being hacked and your master password acquired when using Bitwarden are misleading.
Brute forcing the master password is not feasible, unless it is weak (too short, common, or part of a breach). By default, Bitwarden protects against brute force attacks on the password itself using PBKDF2 with 600k iterations. Brute forcing AES-256 (to get into the vault without finding the master password) is not possible according to current knowledge.
Your master password cannot be "acquired" if the Bitwarden servers are hacked.
They store the (encrypted) symmetric key used to decrypt your vault as well as your vault (where all your passwords are stored), AES256-encrypted using said symmetric key.
This symmetric key is itself AES256-encrypted using your master password (this is a simplification) before being sent to their servers.
Neither your master password nor the symmetric key used to decrypt your password vault is recoverable from Bitwarden servers by anyone who doesn't know your master password and by extension neither are the passwords stored in your encrypted vault.
See https://bitwarden.com/help/bitwarden-security-white-paper/#overview-of-the-master-password-hashing-key-derivation-and-encryption-process for details.
Care to back up the last statement about last pass being the most secure? I'm having a really hard time seeing lastpass as more secure than a local only password manager like keepass or KeePassXC.
Honestly, this reads like a PR post.
It really does read like a PR post.
There's some bold confident statements in there that are definitely not really accurate from the standpoint of software and system security.
OP said 1password, not LastPass.
Something local with sufficient encryption will always win against a cloud service, until someone gets access to your computer.
Fucking Okta. Or as I call it Okra.
Interesting to learn how to open up not just one PC but a whole infrastructure of passwords, tokens etc.
Imagine trusting a 3rd party to keep every single one of your passwords. That literally defeats the purpose of using passwords if you keep them all centralized. You're supposed to MEMORIZE your passwords. Kindergarten shit.
I have 1400 passwords saved at the moment. You really expect me to memorize all of them?
There's a tradeoff between security and convenience that has to be dealt with. You're not supposed to reuse passwords, but most sites/apps require a login. How do you memorize a couple hundred passwords? An offline vault is safer, but also a real hassle to keep synchronized between devices and locations.
I've settled on memorizing passwords for financial sites and emails and storing the rest in a password manager. All I can hope is that, should a breach happen and my passwords somehow get decrypted, I'll retain control over the most critical accounts.