News for hackers. Stuff that matters.

A comment on 1Password sends your password in clear text across the loopback interface. Parent comment

Re:1Password sends your password in clear text across the lo... by Etzos on Wednesday March 02, 2016 @03:03PM (#11212581)
The vendor does not have root on your machine or access to the loopback interface. Your machine's loopback interface should not be exposed through a SOCKS proxy unless you specifically tell it to do so (which is a terrible idea for reasons beyond just this situation).
[ Parent | on HN ]
Re:1Password sends your password in clear text across the lo... by jMyles on Wednesday March 02, 2016 @03:11PM (#11212639)
I see. So the loopback traffic occurs on the local machine, the password is decrypted, and only then sent over the regular HTTP(S) connection (with this last bit being the only traffic on the SOCKS)?
[ Parent | on HN ]
Re:1Password sends your password in clear text across the lo... by jlgaddis on Wednesday March 02, 2016 @03:25PM (#11212725)
Yes. Check your settings for your proxy to make sure you aren't sending traffic for localhost over the proxy.

(In Firefox, for example, it's excluded automatically.)

[ Parent | on HN ]