News for hackers. Stuff that matters.

A comment on 1Password sends your password in clear text across the loopback interface. Parent comment

Re:1Password sends your password in clear text across the lo... by ihuman on Wednesday March 02, 2016 @02:37PM (#11212391)
You can't just use some kind of Diffie–Hellman key exchange to agree on a key, instead of the user copying the key?
[ Parent | on HN ]
Re:1Password sends your password in clear text across the lo... by jpgoldberg on Wednesday March 02, 2016 @02:52PM (#11212507)
Are you suggesting simple DH without any long term secret?

Hmm. I'm fairly sure we thought through that option, but at moment I can't see see/recall why we rejected it.

[ Parent | on HN ]
Re:1Password sends your password in clear text across the lo... by garrettr_ on Wednesday March 02, 2016 @02:59PM (#11212548)
Well, unauthenticated DH ("simple DH without any long term secret") is trivially MITM-able, so it could only be useful if you adversary could read but not write to the channel, which I doubt is the case in this context.
[ Parent | on HN ]
Re:1Password sends your password in clear text across the lo... by jpgoldberg on Wednesday March 02, 2016 @03:13PM (#11212650)
Right. This would be unauthenticated with all of the problems that that entails.
[ Parent | on HN ]
Re:1Password sends your password in clear text across the lo... by roustem on Wednesday March 02, 2016 @02:48PM (#11212469)
How would that work when both processes are running on the same Mac, under the same user account?
[ Parent | on HN ]