For browser extensions, the URL constructor would be even easier: https://developer.mozilla.org/en-US/docs/Web/API/URL/URL (Yes, I know it says that IE doesn't support it, but IE doesn't have a proper extensions framework, so it's irrelevant to this topic.)
See this pastebin[1] for the function I believe is determining the url of the active tab and if it has a valid hostname.
There's also this one[2] that seems to be extracting the hostname of a given url also using the URL API.
Both these pastebins contain minimized code that I've cleaned up.
0: https://developer.mozilla.org/en-US/docs/Web/API/URL
LastPass (on Chrome) will auto-fill information on a detected site, which a malicious site can read immediately.
1Password (on Chromium nightly) requires me to hit the 1Password Mini button and select a site/account to log in with. If 1Password had a similar vulnerability, a malicious site as described would merely wind up showing me accounts for the wrong site in the dropdown. Clicking one could wind up submitting/leaking my credentials to the attacker, though.
This is actually how I use 1Password most often. Global hotkey of cmd+opt+\, type a site name, hit enter: 1Password opens the site and logs in.
Please don't do this on Hacker News.
While I would agree that this place would be better off without judgment, and harsh judgment as I've shown here, the reality is that we all share this place equally with others who do not stop and consider their actions as affecting others thought processes in a negative way. I put this on here to illustrate that point in a non-obvious way, and in a way people CAN understand: anger. It's not the only way of course, but it does get the bug into people's brains quite well.
I appreciate your comment and intent behind it.
I very much agree that downvoting without comment (indeed except for the truly awful ones that would just draw needless noise because of it) is an anti-pattern. But I am occasionally guilty of it myself as well, partly because writing a reply to a not-quite-awful comment costs me a lot of time (even if it's a short cmt).
The greying-out of downvoted comments doesn't help with the perception of receiving a downvote without comment either (makes it feel more harsh, IMO). I'd prefer showing the counts again, actually.
My goal was to settle concern for myself and other 1Password users. That's why I wrote whether a similar vulnerability "does not affect 1Password" instead of "does". My apologies if this was unclear.
I recently started using LastPass after years of reusing the same uncrackable password: !p@ssword123
- This is the second serious security incident with them. Nobody's immune to bugs, but I haven't seen a similar history with AgileBits.
- LastPass has, IMHO, terrible UI/UX. Things don't work consistently, there are weird, unexpected pauses that look like malfunctions until something visible happens; it took me a comparatively long time to figure out how to map common actions to the gestures that perform them; and finally, this is way down the priority list, but I find it generally kind of ugly. I suspect some of these complaints are partially linked to the next point.
- Lastpass is more trouble than it is worth in Safari/Mac.
I've used 1Password personally since 2008-ish, and think I've had exactly one nontrivial problem with it in that time, which was my fault. (There was some upgrade-path weirdness with the iOS version several years ago, and I left a device unused long enough that it ended up with orphaned data I couldn't sync. I forget the details of what exactly happened.)
1Password Teams didn't exist when my company started using Lastpass, but I'm hoping to get switching onto the low-priority project list.
Can't agree with this more. I've had so many issues with LastPass staying logged in one browser across sessions, even though the preferences are set to logout after short inactivity windows and on browser quit. LastPass seemed to lose its preferences like this multiple times, and it made me uncomfortable from a security perspective to not know for sure when my sessions would actually end.
Besides that it's mostly UX issues for me, similar to what you've described.
I also prefer 1Password's pronounceable random password generator vs LastPass's generator (obligatory xkcd https://xkcd.com/936/).
But after the first use of the LastPass Safari extension, TextExpander (or KeyboardMaestro, or a bunch of other tools) won't work anywhere until a after reboot or some other method of disabling SI.
You should maybe try and get it on the high priority list. On August 1st the Teams pro plan will increase from $4/user/mo. (introductory price) to $12/user/mo. for new signups: https://1password.com/teams/pricing/
For me, the biggest pain point is the interface. The automatic form filling rarely works as it should; I click the LastPass icon in the username field, select the site, and it only populates the username (even though there is an input with type="password" right below it).
I then have to: 1) Press ALT+W to bring up the LastPass site search 2) Type in the domain name 3) Find the correct entry, and then click "Show Password" 4) Use my mouse to highlight the password and copy it (there is no quick way to copy the password) 5) Close the tab, go back to the original site, put my cursor in the password field and paste it
And then I have to worry about what password I may or may not have lingering in my clipboard.
If anyone has a better workflow please let me know. I'm envious when I watch coworkers use 1Password to populate a form in two steps using hotkeys.
Then just click the password field and Ctrl-V, of course.
If you're concerned about the clipboard, get in the habit of typing Shift-LeftArrow Ctrl-C after entering the password, to quickly replace your clipboard with a single character.
I'm not sure how LastPass does it, but 1Password does clear the clipboard after a short period of time (configurable, I think 90 seconds by default). I use clipboard logging via Alfred, and can confirm that however they clear the clipboard works to keep them out of its log.
(Without a paid subscription, bookmarklets on mobile still work for free of course. But I found that login flow so cumbersome.)
[0]: Stack Overflow Outage Postmortem https://news.ycombinator.com/item?id=12131909
There are appropriate channels to ask questions like that and appropriate times to downvote. But, hey, I'm not here to offend the hivemind. Please have mercy ;)
I think an official word holds more clout and is more valuable than any one person confirming for themselves in one version of one browser on one version of one OS.
I understand that, as a user of 1Password's browser extension(s), you may well feel some concern that a similar vulnerability exists, and I don't think it's unreasonable to want reassurance on that score.
But I think your phrasing and framing of the question feels a lot more like a "gotcha" than anything else, and it's that feeling which motivated my prior comment - I'm not an AgileBits dev myself, but if I were, I'd feel strongly inclined to shy away from that question rather than trying to frame an answer that doesn't leave me open to a potentially hostile followup.
I have sent a message to 1Password through the official customer support channel to ask the same question posed here. I'll update once they reply.
> Thank you for taking the time to write to us here at AgileBits. The current version of the 1Password extension does not use regex to parse URLs for this exact reason. We don't autofill either, which also helps avoid issues like the one you mentioned.
1: Defensiveness. It seemed more like an honest question than a pot shot. You seemed to read into it something like "Aha! How about your software fool!?!"
That said, if it were a reporter asking the question, then I would see it as a gotcha, because the use of the word confirm is used as a setup sometimes.
2: Tech bias. Not everyone on here is a Dev, and even though I know a fair bit about programming it would not be a trivial task to do what is simple for you regarding checking out code injections and what they do re a security standpoint. That would probably be a long afternoon of googling for me :)
Just my view...
Presumably that's the job of a professional security developer that might reasonably be expected to have checked their own similar product for this vulnerability...
Since malicious attackers have complete control over the page you're seeing - they can simply replace document.createElement with their own function. And instead of returning a DOM object, they can return an object that returns whatever they want in .hostname
If the website could override extension functions, attacks would already be possible by overriding Regex functions.
The untrusted script can override its own view of createElement, but not the extension's view.
I wonder if a DOM mutation event would be triggered if a content script adds a new link element and changes it's href.
Would I be able to catch that and quickly change the href, before the content script continues to fecth the processed properties?
It is true. See documentation => https://developer.chrome.com/extensions/content_scripts#exec... :
> Content scripts execute in a special environment called an isolated world. They have access to the DOM of the page they are injected into, but not to any JavaScript variables or functions created by the page. ... The same is true in reverse
[0] http://archive.oreilly.com/pub/a/network/2005/11/01/avoid-co...
For desktop browser extensions that are properly using the frameworks, the extension's Javascript runs in its own execution context so the page cannot redefine variables. This protected 1Password when we discovered that a certain page had redefined the global JSON object, which provides parse and stringify functions among other things, to be the number 3, i.e. a numeric constant called JSON. :'D
Context: I'm a new 1Password user who is contemplating use of the extensions for those latter two browsers, and while it seems probable their extension frameworks offer the level of security you describe, I'd like to be certain before pulling the trigger. Thanks!
Hi there!
Yes, all 3 of the major browsers (and derivatives of them) offer the same support for a sandboxed execution environment. You can safely use any of them if that's a requirement you have :)
Kyle
AgileBits
We really try not to call it "Classic" or anything like that. It's standalone, you're in charge of upgrades, syncing and backups and stuff like that. It's also not designed for sharing (at least to the degree of the Family and Team solutions).
That said, we don't have any immediate plans to remove the standalone products. However, if a vast majority of our users switch to 1Password Family or 1Password Teams (and as of today, an Individual plan!) then it doesn't make a ton of sense to keep the standalone product around. So, it's probably one of those speak with your wallet kind of scenarios.
I'll certainly pass your feedback along, it sounds like you'd like to keep it around.
I hope that helps answer your question :)
Kyle
AgileBits
Anyway, I gave up on both 1Password and LastPass. I've been a 1Password user for about 2 years before I switched to KeePass.
To be more specific, for the desktop (OS X, Linux, Windows) I use: https://keeweb.info/
For Android: https://play.google.com/store/apps/details?id=keepass2androi...
And for iOS, though be warned this one is subpar: http://minikeepass.github.io/
All 3 apps are open-source. This is important because open-source will not die for as long as there is demand and more importantly, you own it.
No, I'm NOT against proprietary software, as I said, I gladly paid a premium for 1Password. However their Windows client is basically unmaintained, their new "modern Windows" app is still alpha and doesn't work with Wine and of course, they have no Linux support. Most aggravating is that they are clearly switching to a subscription model, with all of their development effort going towards it lately. No more Everywhere interface for OpVault, no new sync options other than Dropbox and iCloud, etc. In other words I'm tired of bait and switch models and one is in progress here.
But the real important thing to consider is whether the protection you would get from a hosted solution so above and beyond overkill that it matters?
If you're curious why I feel that way, we have written up a white paper on how 1Password Teams (and therefore Families and now Individuals) stores and secures your data.
https://1password.com/files/1Password%20for%20Teams%20White%...
We designed 1Password so that we cannot know anything about your data. We also designed it knowing full well that our servers would be a target. So, we designed it in such a way that if a malicious person were to acquire your data there's more or less nothing they can do to acquire the decrypted data.
What we settled on is having two secrets. Both of which are not known by us. The first is your Master Password, something that you're likely well aware of having used 1Password already. The second part is an Account Key, which is a random 128-bit key generated locally. These two things are never given to us and should never be shared. They are both used for the cryptographic functions in 1Password. Without them both, you can't see the decrypted data.
This is unique in that it actually protects weak master passwords. That's the big deal to worry about if our database of user data is compromised. The first attack is to start running password cracking tools against it to try to find the weak passwords. Except in this case, there are no weak passwords because even if your master password is "a" the attacker still needs your Account Key, which looks something like this:
A3-Z4JZ6V-P9BALK-S6J69-FAXCN-LTDY8-T3QHJ
So, now a password cracker is going to have to guess all those combinations of weak passwords against something much much stronger as well. I wish them luck because the math more or less makes this impossible if a user uses a strong master password as well.
There's some math in the white paper if you're curious about more.
Knowing how it works and how extremely unlikely it is that I am such a target that someone is going to literally spend millions upon millions of dollars trying to crack my account (and still likely get nowhere)... I'm small fish, it just isn't worth it to even try.
Either way, for the sake of learning (I love learning, so I always assume others do as well), I would recommend reading the white paper, if not only to gain some new knowledge that you may not have been exposed to previously. If you have, awesome!
As always, if you have questions let me know!
Kyle
AgileBits
It is $2.99/mo when billed annual ($3.99/mo month to month), includes all of the applications as part of the subscription price.
It is otherwise based on the same technology as Family and Teams options. It's basically Families with only 1 user.
The same attack you describe could be applied to basically any javascript you cared to write (say, String.prototype.length). The safest approach is to treat the output of injected javascript as untrusted third-party input to your extension code and work from there.
var parser = document.createElement('a');
parser.href = "http://example.com:3000/pathname/?search=test#hash";
parser.protocol; // => "http:"
parser.hostname; // => "example.com"
parser.port; // => "3000"
parser.pathname; // => "/pathname/"
parser.search; // => "?search=test"
parser.hash; // => "#hash"
parser.host; // => "example.com:3000"