LastPass Breach -- Comments?

My issue is how misinformed people are about this and don't get not all password managers are alike.

@prime: Agreed! And I don't mean 'misinformed' in a derogatory way. No shame in not knowing, and that's why we try to spread the word ourselves and appreciate it so much when you do. Honestly, a black day for LastPass is a black day for 1Password and password managers (and security!) in general, as it can scare people away from using any of them to be more secure.

I'll have to investigate this further, but from what I understand LastPass users who use a unique password for each site will still have an advantage over those who don't use a password manager at all.

I previously used Dropbox for a variety of confidential file storage and transfer functions, but I stopped after they accidentally left their site wide open without password security for four hours on a weekend afternoon in June, 2011.

@fourwheelcycle: I understand the hesitation and respect your choice. After all, the reason we have Wi-Fi Sync in the first place is for our customers who either can't or won't sync using a cloud service!

This is sad news. I guess I should switch to wifi sync instead of Dropbox. Are there instructions to transfer the vault from Dropbox to local drive for wifi sync?

@spacemn_spiff: Yes! But it's also important to note that your 1Password data is end-to-end encrypted, so 1Password simply doesn't depend on the sync service to protect your data. A cloud breach still requires the attacker to have your Master Password to decrypt your data. :)

Does 1password support two factor authentication?

No! Since 1Password isn't a centralized service, it doesn't authenticate you. Rather, your data is encrypted, and you need to use provide your Master Password to have it decrypted.

And so more to my last point, if 1Password were authenticating through a cloud service they would have to have to be able to validate your Master Password -- preferably with a salted hash -- and this could make them a target for attackers to get at your data. AgileBits simply does not have your Master Password, in any form. So if you were to tell us your Master Password (Don't) we couldn't tell you if it's the right one to authenticate you anyway!

Also, we don't have your data. ;)

I certainly don't wish bad things on your competitor but the hack certainly demonstrates the benefit your philosophy regarding storage location and associated protection of the passwords.

@Plato: As I mentioned above, this is bad news for everyone in the security business. Not everyone ('normal' people -- the guy on the street who thinks Edward Snowden is the Wikileaks guy, etc.) understands how all of this works, and a vulnerability for one erodes trust in the public eye for all. And ultimately all philosophies or models have tradeoffs.

Sure, some folks will be motivated by paranoia to use 1Password to improve their security, but many more will simply throw up their hands and say "I give up." And that's a loss for all of us.

The more of us that raise the bar for our own security, the better for all of us collectively. I hope that one day we can get to the point where we're all so secure with our crazy-unique passwords for everything that the bad guys cut their losses and go back to making malicious banner ads in lieu of trying to steal personal information in aggregate.

But right now that dream still seems a long way off.

@davaz3: As I mentioned above, since AgileBits doesn't have your 1Password data (or your Master Password) there is no central place where one can authenticate once, much less twice.

I have one Windows PC, 2 iPhones and 1 iPad. Does the wifi sync need a PC or a Mac to sync, can it sync between two iOS devices on the same network without the PC?

@spacemn_spiff: With 1Password Wi-Fi Sync, a single computer (Mac or PC) acts as the server, while your iOS devices are clients that connect to it when you sync. Unlike Calvinball, these rules must be strictly observed. ;)

Does 1password store any customers passwords or are all users passwords stored on their local machines (unless they use dropbox, icloud etc to sync the encrypted passwords, in which case each user has their own setup for this so there is no centralised target.)

@vels: Your Master Password is never stored, regardless of where you store your 1Password data (except when you use Touch ID on iOS, which is protected by your fingerprint and device passcode).

To be clear, even if you sync your 1Password data, the Master Password is not stored or sync'd, only the data which you can then decrypt using your Master Password. It's like your car: wherever you move it, it doesn't have the key; but you can use the key which is necessary to unlock it, regardless of location.

Just read that Last Pass was hacked! Please assure me that this won't happen with 1Password!

@kohls: "1Password" is not an entity or centralized repository that can be the target of any attack. And AgileBits has neither your 1Password data nor the Master Password used to secure it; only you do!

Even if you sync your data, no one has the Master Password needed to decrypt it unless you tell it to them. The security of 1Password simply doesn't depend on where your data is stored. :)

LastPass, a service similar to yours, recently had a severe security breach. Should a 1Password user, such as myself, be concerned (for obvious reasons)?

@Zendlakdavala: As mentioned earlier in the thread, 1Password differs significantly in that your data is not stored on a central server, and AgileBits does not have it. 1Password is a product, rather than a service. Be sure to let us know if you have any other questions! :)

Hi @EAGLSPRGS,

I've merged your message into an existing discussion about this in our "Lounge" forum. I hope you don't mind!

The short answer here is that this same problem cannot happen to 1Password because your 1Password data is not stored on a central server. We don't have your data, so no one can steal it from us. By default, all your 1Password data is stored locally on your device. If you use the iCloud or Dropbox sync options in 1Password, then an encrypted copy of your data is stored in your iCloud or Dropbox account, but your master password isn't stored anywhere at all (except in your head).

You can find more information in the other posts in this thread. A good place to start is with brenty's post and jpgoldberg's post. If you have more questions about that, please don't hesitate to let us know! :)