Re:1Password for Open Source Projects
by ryanmccullagh on Wednesday April 11, 2018 @05:31PM
(#16815904)
Does the cloud provider have knowledge of the encryption keys? Do you generate the key in the provider's application, or is it import? Do they send the key to their servers? Can you verify all of this?
[ Parent
| on HN ]
The encryption keys are supposed to be generated client side. Obviously you can’t verify this since 1password is closed source, but if your threat model involves the client misbehaving, then you should be using any proprietary password manager. Cloud vs not Cloud is irrelevant.
There is no way we would want to know your keys. There are several million 1Password accounts and 1Password a huge attack target. All keys are generated on the client side and encrypted with a PBKDF2-hardened combination of Master Password + Secret Key.
Details are here: https://1password.com/security/ Whitepaper (PDF): https://1password.com/teams/white-paper/