1Password sends your password in clear text across the loopback interface

Re:1Password sends your password in clear text across the lo... by roustem on Wednesday March 02, 2016 @02:51PM (#11212498)

Unfortunately, there is no way for browser extensions to create Unix sockets,

Also, code signing would prevent anyone from modifying the binaries to change the IP address.

[ Parent | on HN ]

Re:1Password sends your password in clear text across the lo... by julie78787 on Wednesday March 02, 2016 @04:36PM (#11213216)

But even if they could, UNIX domain sockets aren't immune to attacks. That sort of the problem with "First, assume your machine has been pwn'd".

[ Parent | on HN ]

Re:1Password sends your password in clear text across the lo... by kazinator on Wednesday March 02, 2016 @05:50PM (#11213693)

Yes; if we assume the machine has been pwned, then whatever we can still trust is anywhere else but in that machine. At best we can come up with ways to securely smuggle bits through the pwned machine between two trusted endpoints; but we cannot manipulate any secrets on that machine.

(Trusted computing relies on some tamper-resistant core of the machine not being pwned when the rest of it is pwned.)

[ Parent | on HN ]

Re:1Password sends your password in clear text across the lo... by kazinator on Wednesday March 02, 2016 @03:07PM (#11212611)

Indeed, it would be particularly amazing if a browser extension did that on Windows. :)

[ Parent | on HN ]