Re:"Pwned Passwords" V2 With Half a Billion Passwords
by angerbot on Wednesday February 21, 2018 @04:55PM
(#16433338)
Have you read their security white paper[1]? As much as I tend to freak out about cloud storage of password data (one reason I moved off of lastpass), they do seem to take fairly strong steps to host-proof the data (such as having an on-device generated secret key that they never receive).
[1]: https://1password.com/files/1Password%20for%20Teams%20White%...
Re:"Pwned Passwords" V2 With Half a Billion Passwords
by Spooky23 on Wednesday February 21, 2018 @05:34PM
(#16433594)
From a legal perspective, once things enter the custody of a third party, your exclusive rights to that data are dramatically diminished.
Re:"Pwned Passwords" V2 With Half a Billion Passwords
by __jal on Wednesday February 21, 2018 @05:15PM
(#16433471)
I did read it. For me, it doesn't matter for two reasons. Professionally, I have a policy to comply with. And personally, I don't use other peoples' machines for personal storage, period. So why would I want my (even well protected, assuming 1PW didn't make a mistake) passwords to be an exception?
But be aware that they are moving to cloud storage for password data. At this point, you're not forced in to it (and they've made no concrete announcement yet), but that's pretty clearly where they want to go.
Perhaps that's acceptable to you; I'll be moving off at that point. But in any case, it is something to be aware of when choosing something like this - moving between password managers is a hassle.