News for hackers. Stuff that matters.

A comment on Bitwarden Acquires Passwordless.dev. Parent comment

Re:Bitwarden Acquires Passwordless.dev by DavideNL on Wednesday January 18, 2023 @02:52PM (#34432063)
Note that 1Password copies the "Secret Key" to iCloud... without asking.
[ Parent | on HN ]
Re:Bitwarden Acquires Passwordless.dev by manmal on Friday January 20, 2023 @08:18AM (#34452715)
Do you mean iCloud keychain? That's arguably one of the most secure cloud storage in existence.
[ Parent | on HN ]
Re:Bitwarden Acquires Passwordless.dev by DavideNL on Friday January 20, 2023 @08:32AM (#34452874)
Yes. And no, because it depends on how users setup and use their AppleID and its passwords/security/devices.

My only point is, if 1Passwords decides to share the private key with [whichever cloud service] the user should at least be notified, or get a choice.

[ Parent | on HN ]
Re:Bitwarden Acquires Passwordless.dev by manmal on Friday January 20, 2023 @08:46AM (#34453025)
> And no, because it depends on how users setup and use their AppleID and its passwords/security/devices.

Can you elaborate what the issue would be? I see that the AppleID password could be a weak link, but that's mostly mitigated by 2FA.

> if 1Passwords decides to share the private key

I'm not aware that they could do that. Their servers have no knowledge of either the password or secret key. Authentication happens via a zero-knowledge proof.

[ Parent | on HN ]
Re:Bitwarden Acquires Passwordless.dev by manmal on Saturday January 21, 2023 @03:34AM (#34464883)
Ah, Apple recently improved things further: https://www.apple.com/newsroom/2022/12/apple-advances-user-s...
[ Parent | on HN ]