1Password and the Crypto Wars

Re:1Password and the Crypto Wars by revelation on Saturday September 07, 2013 @03:55PM (#6346353)

As stated, the check for updates is finally over HTTPS in the very latest build (333), but you do not verify the certificate in any way. So its essentially HTTP with obfuscation. This allows a malicious network to downgrade clients to build 332, where the check for updates is over plain HTTP and downloaded binaries are not verified.

[ Parent | on HN ]

Re:1Password and the Crypto Wars by teamgb on Saturday September 07, 2013 @08:03PM (#6347191)

Can you write a blog post about this? Need to get this information out there. Good job finding this.

[ Parent | on HN ]

Re:1Password and the Crypto Wars by jpgoldberg on Monday September 09, 2013 @11:37PM (#6358016)

I was wrong. The updater in 1Password for Windows 1.0.9.333 is vulnerable to an evilgrade attack. It fails to verify the the trust of the certificate on the (alleged) upgrade server and will accept any old self-signed certificated.

I would like to thank whoever sent us a Proof of Concept, and I would like to apologize for actually needing the PoC before sufficiently testing my own claims.

[ Parent | on HN ]