AgileBits Blog

Hey MightySCollins! 1Password X is a Chrome extension, but it's also a full-featured 1Password client! Additionally, 1Password X does work without an internet connection. In version 1.5 we added an offline cache so you can boot up your laptop, unlock 1Password X and get that WiFi password or whatever item you need. If you haven't checked it out lately, I'd highly recommend taking a peek at this recent blog post: https://blog.agilebits.com/2018/03/13/1password-x-better-smarter-faste… &drew

We have a full list from all developers who have informed us they have integrated here: https://blog.agilebits.com/1password-apps/ There are likely other apps that are not on this list, but if they don't tell us they have added support it's difficult for us to add them. You can request your favorite app add support, often times it only takes a developer 15 minutes or so to add it. Details in our github repo here: https://github.com/agilebits/onepassword-app-extension Let me know if you have any questions! I handle all of our app extension customer support and code maintenance. Kyle AgileBits

Not just when they fail deliver. I like 1Password, but I can't stand their '1Password talking in first person about itself'-communication: https://twitter.com/1password And then the self-congratulating blog posts, with employees redoing it in the comments: https://blog.agilebits.com/2017/07/13/why-we-love-1password-membership…

Just to be clear, it's still 100% possible to keep your 1Password vault in Dropbox etc and not use the SaaS version [1]. I felt like this fact was buried in the article. Edit: Here's the link to buy the standalone license [2] which is hard to find on the site now. In a post from the founder one week ago [3] he said, "We know that not everyone is ready to make the jump yet, and as such, we will continue to support customers who are managing their own standalone vaults. 1Password 6 and even 1Password 7 will continue to support standalone vaults." [1]: https://support.1password.com/sync-with-dropbox/ [2]: https://agilebits.com/store [3]: https://blog.agilebits.com/2017/07/13/why-we-love-1password-membership…

I've never seen a corporate post with more comments by employees than the one where 1Password tries to explain their subscription model [1]. It makes it looks like they want to bury non company comments. And I am a current 1Password customer and had been for years, but that post doesn't inspire confidence in me. [1] https://blog.agilebits.com/2017/07/13/why-we-love-1password-membership…

They had a perfectly fine businessmodel. 1Password has been running for years without the SaaS model: > P. S. Please don’t think our excitement for memberships has anything to do with money. We’re completely self-funded so we don’t have any investors forcing us to make changes by looking solely at our bottom line. We were doing just fine selling individual licenses and AgileBits was already steadily growing before 1Password Teams was even introduced. https://blog.agilebits.com/2017/07/13/why-we-love-1password-membership…

1Password TOTP https://blog.agilebits.com/2015/01/26/totp-for-1password-users/ is great, we use it extensively at GitLab https://gitlab.com/gitlab-com/www-gitlab-com/commit/a288508900583b3a14…

All the computers in the world wouldn't be able to brute force AES with a strong key in less than 10 quadrillion years [1]. They would be better off spending millions in four-leaf clovers and faceroll the password. That said if they knew a way to crack AES or RSA it would be a different story (a nightmare). [1] http://blog.agilebits.com/2013/03/09/guess-why-were-moving-to-256-bit-…

Also worth noting is the (linked) tongue-in-cheek http://blog.agilebits.com/2012/04/01/cipher-of-advanced-encryption-rot…

> We have to advise you to never enter your 1Password Master Password into anything that isn’t 1Password Correct me if I'm wrong, but couldn't you re-use the plumbing that you have for the Chrome extension? The blog post was here: https://blog.agilebits.com/2017/07/19/introducing-native-messaging-for… That way, software could integrate with 1Password by triggering 1Password to prompt the user for the master password, choose a password entry and send that data back to the application that triggered 1Password. That way, the master password is never sent to anything that isn't 1Password. This was the workflow of sudolikeaboss. The implementation of that, however, was hacky since it used a reverse engineered websocket connection behind the scenes. It would seem that the native messaging stuff is a little cleaner and would allow third-party apps to trigger 1Password in a way that, at most, a single password would ever be exposed. I guess the ask would be to make that native messaging protocol that the Chrome extension uses a documented and stable thing. And since the 1Password application is used by both subscribers and licensees, that can become the preferred way for 3rd parties to integrate with 1Password in a way that users know only exposes individual passwords at the single point in time when they're used rather than the entire vault, for exactly the security reasons you mentioned. BTW...as much as I've felt frustrated by some of the decisions…

In iCloud ecosystem, create a family, with a child account AppleID. Do a full backup. Wipe the phone, log in with child account. You can now redownload a few key apps needed for the trip, as well as some normal apps: weather, TripIt/Uber/CityMapper, games, etc. Because it’s a family account, all the re-downloads are free. Share essential data (that you don’t mind being taken) from your own account to this account the way you would to another family member. Use the iCloud “Family” calendar for your trip planning (useful anyway to share travel plans with partner etc), or subscribe this account to e.g. your TripIt/TripCase calendar. Invite this child account as a family member for your smart home etc., using child (parental controlled) config where available so it’s not an admin. Use secure Shared Notes from Apple Notes or Evernote to bridge travel lists. Subscribe to a shared iCloud Photos album so you can seamlessly post photos taken with this account back to your primary account (and that album will only contain photos you intend to be visible on this persona). Load in your business’s main contact info, your personal contact card with your business email and number, and then contacts for airlines, car rentals, hotels, and customer support numbers you use. If traveling with a partner, load their contact in as well, also using work info. Include a contact record for the ‘emergency contact’ you already disclosed on other forms (airline, customs). If the device is…

> This is strictly a business decision This is my interpretation of the situation having read the (IMO) train-wreck of a blog post excusing this change: https://blog.agilebits.com/2017/07/13/why-we-love-1password-membership… > A subscription model is in their belief the only way to maintain a sustainable business model that includes growth by providing SaaS with recurring revenue. Old school static licenses with local storage will not provide recurring revenue. However I don't really agree with this. I've been buying 1Password since at least version 3 and don't see any reason why I would stop, I've recommended the app to family and friends, and I've bought licenses for my family. 1Password had a sustainable business model, they sold quality, recommendable software with upgrades every couple of years. edit: I realise now that "This is strictly a business decision" and "1Password had a sustainable business model" might be seen to be contradictory, but I do see differences. With 1Password subscriptions they will make more money than I estimate I spend on the standalone product. It also means the work put into new features is de-coupled from a release cycle, and therefore the money coming in.

1Password does not have a list of "secrets" that it draws from for all forms, it only saves the information you provide per-site; anything it submits to a site is information you've already submitted to the site previously. 1Password's extension does not prompt for my master passphrase, I have to click on it to enter it (if I haven't already). It also to don't try to fill forms on page load, I have to instruct it to do so. By default it will usually submit a form upon fill but I often turn off that setting. As for browser vulnerabilities, I'm not familiar with any information about extensions being particularly vulnerable to browser exploits, it seems like when browsers get "pwned," anything in userland (if not the whole system) is up for grabs so avoiding the password manager's browser extension doesn't gain you anything. I'm not saying there's no risk, just that trade-off is worth it. Agilebits argues that using the extension is safer because it avoids keystroke loggers and clipboard sniffers [0] [0] https://blog.agilebits.com/2014/08/21/watch-what-you-type-1passwords-d…

I agree with your first sentence. But, regarding the rest of your comment: We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption. https://blog.agilebits.com/2013/03/06/you-have-secrets-we-dont-why-our… Members of the 1Password team are vocal participants in the ongoing conversation about secure software and cryptography. For instance, Jeffrey Goldberg frequently gets involved in discussions of crypto vulnerabilities on Twitter. I don't have a formal recommendation to offer you regarding their team, but I can offer the same "I've talked to these people and feel like they know what they're doing" vibe that Schneier tried to offer for BestCrypt. Anyways: that's one of the reasons I like 1Password.

> Eventually, quantum computers should be able to eat though any of today's crypto Probably not. Quoting from http://blog.agilebits.com/2013/03/09/guess-why-were-moving-to-256-bit-… A quantum of bits [Update: March 20, 2013] I reached out to the cryptographic community for any insight into Molly’s question about why the NSA insists that TOP SECRET material be encrypted using 256-bit keys. The answer came from Steven Bellovin of Columbia University: @jpgoldberg @marshray Just heard that during the AES competition, NSA said in the open meetings it was for defense against quantum computing Quantum computers, if they are every made practical, will be able to do amazing things. They will certainly change how we design cryptographic systems. It’s not that quantum computers will be faster or more powerful. Indeed, in some very important respects they will be less powerful than current computers. But there are some things that they will be able to do in less “time”. I put “time” in scare quotes because it has a different meaning in this context from the ordinary use of the word. Oh, what a big difference it is. In this context it means the number of distinct steps an algorithm must take in performing some computation. Searching through 2128 keys (on a classical, non-quantum, computer) takes a number of steps that is proportional to 2128. But for a quantum computer it takes a number of steps proportional to the square root of that number, 264. If a quantum computer is…

In my experience they are pretty awesome at customer service. I emailed them a few months ago after someone published a weakness during the BlackHat Conference (https://media.blackhat.com/bh-eu-12/Belenko/bh-eu-12-Belenko-Password_… Jeffrey got back to me with a way-more-reasonable-than-expected answer: --------------------------------------------- Hi Bernardo, I'm sorry for not getting back to you earlier. I think I answered your question elsewhere, and so failed to get to the email followup. The Belenko and Sklyorov analysis of a large number of password managers found that many of them (including 1Password) were vulnerable to a "padding oracle" attack. We discussed the problem the day that the report came out, and released an update to 1Password for iOS (Mac and Windows versions were not affected) within a few weeks. The specific vulnerability (that pretty much affected everyone who used the standard cryptographic libraries) is fascinating, and I'm hoping to write more about it some day. But for the moment, please see http://blog.agilebits.com/2012/11/08/dont-trust-a-password-management-… which includes some links to the issue and what we did about it. The key paragraph is "The [New York Times] article cites some of the research behind Elcomsoft’s scathing review (PDF) of password managers on mobile devices, which we wrote about last March. That report did included some issues in 1Password on iOS (which we quickly…

That is simply not true. I recommend that people actually read Elcomsoft's outstanding report on the security of password managers on mobile devices. At Blackhat, Andre demonstrated a Chosen Ciphertext Attack (CCA) against PKCS CBC padding scheme. And 1Password (along with pretty much everyone else who used common recommended libraries) did use that padding. But there is a whole lot more that would need to be put in place for a CCA to work. In particularly you need to be able to ask the app to repeatedly decrypt bogus ciphertext and see how it responds. You need to be able to interact with the thing that is performing decryptions for you. CCAs are most applicable when there is some encrypted server, and this does form the basis for the BEAST attacks against SSL servers. Although the CCA didn't pose an immediate threat to 1Password users, we did change the padding scheme in an update to 1Password within weeks of getting to see the report. (It would have been nice to see it beforehand.) Changing the padding scheme fixes the particular CCA that was used, but the proper way to prevent all CCAs is to use authenticated encryption. Take a look at http://blog.agilebits.com/2013/01/18/authenticated-encryption-and-how-… which discusses that. There were two other things that they dinged us for. (1) Our low-security items are really very low security. We already knew that, but because of how people used 1Password, it was possible for people…

> If you're using a password manager to have unique passwords for every site, what does TOTP 2FA even protect you against? Man in the middle attacks of course, which are possible on insecure connections. With the prevalence of root certificates installed on people's computers as a corporate policy, by shitty anti-viruses, etc, it's very much possible to compromise HTTPS connections. The TOTP 2FA code acts as a temporary password that's only available for a couple of seconds. A "one time password" if you will. Yes, it still strengthens security. Read 1Password's article about it: https://blog.agilebits.com/2015/01/26/totp-for-1password-users/

I suspect it'll warn you if any of the accounts you've saved in Firefox (username/password) have been compromised. 1Password already does this¹ but this is likely the Firefox implementation of it. ¹ - https://blog.agilebits.com/2018/02/22/finding-pwned-passwords-with-1pa…

I'm reminded of this Agile Bits blog post about "curing" themselves of Slack. https://blog.agilebits.com/2016/04/19/curing-our-slack-addiction/

Sure. 1Password for Mac had WLAN sync implemented in version 4 there is no reason for us to remove it. 1Password for Windows is a full rewrite and the new codebase never had WLAN sync. We wanted to see if people really need it when we announced 1Password 7 for Windows: https://blog.agilebits.com/2018/03/20/introducing-1password-7-beta-for… I think so far we had about 90 people expressing interest in it. For a product with over 15 mln customers, that is a very low number.

They announced a price for the windows version. It will be $65, and you get a $25 discount if you've been using the beta version. I assume Mac licenses will cost the same. Source: https://blog.agilebits.com/2018/03/20/introducing-1password-7-beta-for…

They mention the discount in this blog post: https://blog.agilebits.com/2018/03/28/the-1password-7-beta-for-mac-is-… "Licenses will be available for $64.99 when we launch later this year, but are available now for only $39.99."

https://blog.agilebits.com/2018/03/28/the-1password-7-beta-for-mac-is-… There's also a Windows version now.

I, too, hope they never discontinue the standalone product. If it makes you feel any better, I noticed on their blog they're offering a paid upgrade for the next standalone version of 1password. So they're not getting rid of it in the next major version. https://blog.agilebits.com/2018/03/28/the-1password-7-beta-for-mac-is-…

They recently introduced a 1st-party CLI that supports Linux: https://blog.agilebits.com/2017/09/06/announcing-the-1password-command… https://app-updates.agilebits.com/product_history/CLI However their official CLI sadly only supports interactions with the subscription service. If you are using local vaults then there are still open source CLIs for Linux: https://github.com/latkin/1poshword (disclaimer: my project) https://github.com/georgebrock/1pass

They have a new Chrome extension, 1Password X (Beta) which works as standalone. Only downside is it's only available for Chrome at the moment. https://blog.agilebits.com/2017/11/13/1password-x-a-look-at-the-future… https://support.1password.com/getting-started-1password-x/

I don't use Windows so I don't know if there are any particular bugs in their Windows software but they announced the 1Password 7 beta for Windows eight days before they made this Mac announcement https://blog.agilebits.com/2018/03/20/introducing-1password-7-beta-for…

OOH integration with the pwned password database. However, it looks like it pings Troy's service to do its magic so not everything is kept locally. (I don't blame them, for speed, and for not needing a many-gig database download for each client. Still, a cool feature, but something to be aware of. https://blog.agilebits.com/2018/02/22/finding-pwned-passwords-with-1pa…

He recently shared Pwned Passwords which lets you check if your password is in the breached data. 1Password then did a POC integration into their service so you can test if your password shows up in HIBP data. https://blog.agilebits.com/2018/02/22/finding-pwned-passwords-with-1pa…