1Password sends your password in clear text across the loopback interface

Re:1Password sends your password in clear text across the lo... by drhayes9 on Wednesday March 02, 2016 @02:36PM (#11212385)

Not if the shared key is present in the host computer already, which it'd have to be if the host process is to decrypt anything.

[ Parent | on HN ]

Re:1Password sends your password in clear text across the lo... by ikeboy on Wednesday March 02, 2016 @02:44PM (#11212426)

http://arxiv.org/abs/1505.06836

Other non root apps can masquerade as the app intended to get the data, and if it's sent in plaintext, they get information they wouldn't if it used a shared key accessible to the intended app.

[ Parent | on HN ]

Re:1Password sends your password in clear text across the lo... by nbadg on Wednesday March 02, 2016 @02:42PM (#11212416)

Particularly if someone is specifically targeting 1password, which they (almost by definition) already would be. It'd just be a single patch to the exploit and you're back in business. Well, okay, obviously that's an oversimplification, but it wouldn't do you much good regardless.

[ Parent | on HN ]

Re:1Password sends your password in clear text across the lo... by ikeboy on Wednesday March 02, 2016 @02:45PM (#11212434)

But then malware must run as root.

[ Parent | on HN ]

Re:1Password sends your password in clear text across the lo... by julie78787 on Wednesday March 02, 2016 @04:29PM (#11213161)

Not necessarily. Malware only requires privilege if it is violating a security policy. There are a variety of attacks in which a process executing as a user is able to access resources controlled by other processes which are executing as the same user.

[ Parent | on HN ]