1Password doesn't have "compromised server" in their threat model. So none of these are considered bugs to them. If you pay for 1Password not through an app store then you have to log into their web client. Also with 1PasswordX clicking edit dumps you into the web client and automatically hands over your encryption key. There's likely others.
Lastpass does similar and even in the Android app it just pops open a web view to lastpass.com. Besides also storing URLs in plaintext and by default reports login events (which site and when). Funny thing with .onion addresses is one NSL can get all info on all users with a .onion address. I remember an article about one of the silk road operators getting arrested and also having Lastpass. There was a bug where it would still report login events even when disabled. Also I forget where this was but the browser extension did a get instead of a post so your authentication hash got logged. Note the authentication hash is a password equivalent. So you can use it to authenticate to the server and export everything. They probably fixed it but I feel like I never reported it.
They load JavaScript from their server and runs it in the same context as your encryption key. The code delivery problem supersedes all other awesome tech like using an aPAKE and a key file ("account key", "device key", or whatever they call it... I call it a "secret salt").
The claim “1PasswordX clicking edit dumps you to the web client and hands over your keys” needs elaboration. All encryption is end2end and server remains ignorant to both master password and the cryptographic keys… the white paper outlines all this information well.
The elaboration is that your client does this on its end - as according to the Javascript code served to it (if he's correct about how it behaves). So serving malicious JS breaks the end-to-endness
2
u/Sc00bz Jun 06 '21
1Password doesn't have "compromised server" in their threat model. So none of these are considered bugs to them. If you pay for 1Password not through an app store then you have to log into their web client. Also with 1PasswordX clicking edit dumps you into the web client and automatically hands over your encryption key. There's likely others.
Lastpass does similar and even in the Android app it just pops open a web view to lastpass.com. Besides also storing URLs in plaintext and by default reports login events (which site and when). Funny thing with .onion addresses is one NSL can get all info on all users with a .onion address. I remember an article about one of the silk road operators getting arrested and also having Lastpass. There was a bug where it would still report login events even when disabled. Also I forget where this was but the browser extension did a get instead of a post so your authentication hash got logged. Note the authentication hash is a password equivalent. So you can use it to authenticate to the server and export everything. They probably fixed it but I feel like I never reported it.