Keepass has Key Files as a part of the spec https://keepass.info/help/base/keys.html

On my devices, keyfiles and a KP client are stored locally. The DB rests in the cloud.

Is that kind of file storage secure? I thought files stored on disk can be extracted quite easily?

LastPass would have also led their customers to believe that "brute forcing was not possible" and that they were taking extraordinary measures to keep vaults and data safe.

I think one distinction between services like KeePass and 1Password is end user perception of how easy it is for an attacker to acquire an encrypted vault to begin with. For many, they consider a KDBX database sitting in their Dropbox account to be less likely to be stolen than an encrypted vault being held by a company like 1Password, a high value target to the most sophisticated attackers including state actors.

Doesn't necessarily matter what LastPass "would have also led their customers to believe", the mathematical reality is still that LassPass vaults are crackable in a way that 1P vaults fundamentally are not.

Yes, according to what 1Password is telling us. But as we've seen, what these companies say and what they actually do in practice are not always aligned. And oftentimes customers are inserting a lot of their own assumptions into the mix, not only with respect to vault encryption but vault storage and operational security.

> Yes, according to what 1Password is telling us. But as we've seen, what these companies say and what they actually do in practice are not always aligned.

That's just not accurate:

1. First off, all the encryption happens client-side. It is possible for anyone so inclined to validate how 1P and LP are doing their encryption.

2. The deficiencies in LP's encryption approach were well known for years.

My point it, yes, companies will spin things how ever they want, which is why you should completely ignore what they say and only evaluate what is verifiable. And 1P's and LP's approaches are verifiably different.

1Password's client side encryption is occurring within it's proprietary, closed-source product, so I'm not sure how the end to end process can be completely validated.

With respect to your confidence in 1Password's code and encryption methodology, would you be willing to send me your 1Password vault so that I can have a look at it?

> 1Password's client side encryption is occurring within it's proprietary, closed-source product

It's Javascript running in a browser.

> With respect to your confidence in 1Password's code and encryption methodology, would you be willing to send me your 1Password vault so that I can have a look at it?

Yes, absolutely (note I don't actually know how to get the encrypted version of the vault standalone). Are you willing to send banking information over HTTPS? It's the same level of security.

> Yes, absolutely (note I don't actually know how to get the encrypted version of the vault standalone).

I believe that, given that it's just JavaScript in the browser, that the encrypted vault should be available as a blob in one of the network requests when you are making a change to the vault.

> Are you willing to send banking information over HTTPS? It's the same level of security.

Maybe I'm being irrational, but I just think there is a fundamental difference in the risk profile between a breach of my banking credentials and having every stored set of credentials across my entire digital life exposed through a password vault breach.

If my banking details were compromised somehow, I at least have a bank I can work with and real people I can talk to. Both the bank and myself have a strong mutual interest in addressing the acute security issue. Government banking regulations come into play. Insurance comes into play.

If my password vault is compromised and credentials for every service and website are exposed, I would argue that is a far graver matter. And who do I turn to in that case? I have to imagine that any of these password management companies would just point to me being somehow negligent with my master key and tell me to pound sound.

> Yes, according to what 1Password is telling us

With their very comprehensive whitepaper and Charles Proxy you can verify all their claims. Their whitepaper is one of the best resources I have found on E2EE. With that, you should be able to write your own 1P vault parser.

All valid points!

Same was said about LastPass many times and look at what happened, everything turns out to be a false promise.

That's not a fair comparison. The differences in LP and 1P encryption approaches have been well known for years, and they are fundamentally different.

Now, while 1P encrypted vaults are not brute-forceable the way LP's are, that doesn't mean it's impossible to hack 1P (e.g. malicious code injection in any of their apps or plugins), but I don't like the "everything turns out to be a false promise" broad-brushing when there are real and verifiable differences in how these companies secure your data.

Unless you want to spend the time doing RE of crypto (so fun!), how to do you even know who works for 1Password?

Are you waiting for Snowden 2.0 to explain how things work a decade later?

Note that 1Password copies the "Secret Key" to iCloud... without asking.

Do you mean iCloud keychain? That's arguably one of the most secure cloud storage in existence.

Yes. And no, because it depends on how users setup and use their AppleID and its passwords/security/devices.

My only point is, if 1Passwords decides to share the private key with [whichever cloud service] the user should at least be notified, or get a choice.

> And no, because it depends on how users setup and use their AppleID and its passwords/security/devices.

Can you elaborate what the issue would be? I see that the AppleID password could be a weak link, but that's mostly mitigated by 2FA.

> if 1Passwords decides to share the private key

I'm not aware that they could do that. Their servers have no knowledge of either the password or secret key. Authentication happens via a zero-knowledge proof.

Ah, Apple recently improved things further: https://www.apple.com/newsroom/2022/12/apple-advances-user-s...

But in the context of a strong master password, the additional benefit of the secret key is of neglible benefit, while the hassle and dangers of having to synchronise the secret key remain.

I'd rather use an extremely high entropy master password by itself.

How do you remember a 128 bit entropy password?

remember 10 random words

How is 1Password's secret key more secure than using keepass's key file feature?

Or, simply a password for your Keepass database with the same entropy as 1Passwords secret key.

Anyways, it depends on the app you use. Some Keepass apps haven't even been audited for example, so security of those apps may be questionable.

> Or, simply a password for your Keepass database with the same entropy as 1Passwords secret key.

How would you remember a password of 128bit of entropy?

9-10 words chosen at random from a list of 10k common words in you native language will get you to 128 bits. Sure not trivial to memorise, but far from impossible.

You're not wrong of course - this would come with heavy UX issues though. E.g. it's hard to type 10 words into a password field without messing up. And _really_ hard on a mobile device.

1P would allow you to have a password like "1234" and still have the same key entropy as that 10 word password alone.

A mobile app could easily facilitate that by storing a "passphrase prefix" (or suffix, etc) using biometrics/device key and requiring users to enter the remainder if you don't trust the device to store the entire thing.

Here's a 142bits entropy password: CorrectHorseBatteryStaple

Also see: https://xkcd.com/936/

Depending on dictionary size, the entropy is way lower. Assuming a dictionary of 10k words, it’s only 53 bits.

That depends where you store that file. Is there a way to store this securely in a mobile device for use on the go?