Encryption of ALL 1Password metadata in the keychain
As per Steve Gibson's disclosure that metadata in the keychain is NOT encrypted, when will AgileBits update the 1Password software so that ALL 1Password metadata in the keychain IS encrypted? Soon? A little while? Never?
1Password Version: 5.4.1 (541003)
Extension Version: 4.4.4
OS Version: OS X 10.10.5
Sync Type: Dropbox
Comments
-
@OnePswrd if you have concerns you should be able to make the change now, but first read this knowledge base article carefully:
Switching to OPVault from Agile Keychain
(I don't work for AgileBits but am merely a volunteer here so am pointing you to the this knowledge base article knowing it doesn't exactly answer your question but hoping it may be of use in the meantime. Please don't shoot the messenger. :) )
Stephen
0 -
Hi @OnePswrd,
The article that Stephen linked to should help you make the switch to the .opvault format if you're interested. Because we make it a policy not to discuss unreleased features (and fixes), I can't provide any details on when .opvault will be standard for 1Password across all platforms, but I would be happy to pass along to our development team that you would like to see it as soon as possible.
Additionally, I think it's important to note that many of us on the AgileBits team still use the .agilekeychain format for our own data: we wouldn't have this format available at all if we believed that it was insecure.
If you have any further questions, we're happy to help.
0 -
Further details can be found in my post here:
Your passwords are safe when using the Agile Keychain format
0 -
Stephan- Thanks for your reply. I appreciate that you sent a recipe for better securing my data though it does mean I have to 'tinker' with terminal commands to do what I think should be part of the 1Password software.
Megan- Thanks for your reply. We all have different levels of concern for privacy. Guess my concern is a bit higher than that of yourself and your team. I do think that difference should drive your effort to provide the best, most private service possible. Just because it's good enough for you doesn't mean it suits everyone.
khad- Thanks for your reply. I think I understand what you say, but I think it is a copout and admission of a shortcoming of 1Password to suggest that the final security of my metadata in 1Password depends on the security of my Dropbox account. I think it is NOT OK for outsiders who may stumble upon my (easily seen) metadata to be able to see what websites and locations I use when accessing my passwords via the 1Password app.
0 -
Stephan- Thanks for your reply. I appreciate that you sent a recipe for better securing my data though it does mean I have to 'tinker' with terminal commands to do what I think should be part of the 1Password software.
If you wanted to use the latest beta, OPVault is the default format in the betas. Barring any unforeseen circumstances, it will be the default in the next stable release.
Megan- Thanks for your reply. We all have different levels of concern for privacy. Guess my concern is a bit higher than that of yourself and your team. I do think that difference should drive your effort to provide the best, most private service possible. Just because it's good enough for you doesn't mean it suits everyone.
Completely understandable. That is why we created the OPVault format years ago.
khad- Thanks for your reply. I think I understand what you say, but I think it is a copout and admission of a shortcoming of 1Password to suggest that the final security of my metadata in 1Password depends on the security of my Dropbox account. I think it is NOT OK for outsiders who may stumble upon my (easily seen) metadata to be able to see what websites and locations I use when accessing my passwords via the 1Password app.
Just as a reminder, this only applies when syncing with Dropbox. Syncing with iCloud and Wi-Fi Sync use the OPVault design and have always done so. Dropbox syncing has simply been around longer, so there were other considerations that needed to be made. We stuck with the Agile Keychain for compatibility. Not everyone is using (or can use) the latest version of 1Password on all their devices, and support needs to be available on all platforms. But whatever benefits of compatibility there were have been outweighed by the benefits of switching to OPVault as the default format going forward.
We are now making it the default when syncing with Dropbox in future updates just as you desire. :)
0 -
khad- Thanks again for your comments. As a 1Password user since 2007 and one who learned about the existence of Dropbox from AgileBits I have been quite pleased with 1Password. I appreciate the I am able to use long, ambiguous passwords with ease. What I am asking for today is simply for AgileBits to recognize the error in logic when you allowed some metadata to be easily seen and to ask for improvements in privacy I've been without.
Please let me know when the updates are available.0 -
Thanks for your longtime support, @OnePswrd! 1Password wouldn't be the app it is today without users like you. We genuinely can't thank you enough.
As a longtime user, I'm sure you remember the processing power available that many years ago. From the aforelinked post:
When we designed the Agile Keychain format in 2008, the iPhone 3G was current. If you owned one of those earlier iPhones, you'll remember how much less processing power they had compared to today's phones. Agile Keychain intentionally left some metadata unencrypted to avoid the battery and performance penalties that would've been incurred from having to do processor-intensive decryption for every operation.
Here's the image I linked to in that paragraph, it's straight from Apple's website:
Things were very different back then. From that same post:
At the time, we felt that this was a sensible compromise. We no longer need to make this compromise. In fact, we've moved away from that with the OPVault format we created in 2012.
Paul Moore wrote an excellent overview of the situation on his blog, which you may be interested to read to get a perspective from an unbiased third party.
Please let me know when the updates are available.
As I mentioned, the OPVault format has been available for years. You can switch to it now — either in the current beta which uses OPVault by default when syncing with Dropbox, or by following the steps in that link in the current stable version.
The release notes are always public, so you can keep an eye on them if you are looking for the stable update which includes the change. But if you are in a hurry to move to OPVault, you can make the switch immediately. :)
Let me know if there is anything else I can help with.
Have a great rest of your week and a lovely New Year!
0
