Impact of SolarWinds news on 1Password [Not affected]
As I am sure "all" of you have seen yesterday and today the Net is 'abuzz' with serious electronic incursion into many US Government Agencies very most likely by a foreign power(s).
Given the ever increasing importance of pw managers surely it must be a regular occurrence that a manager's defenses are attempted to be breached. Scary stuff for sure I would imagine.
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Comments
-
@jmjm - we don't sleep.
OK, that's not true, we do. ;) But you're absolutely right: this appears to have been the real deal: a genuine APT (advanced persistent threat) that seriously compromised a specific target.
In terms of the day-to-day of 1Password, there isn't much change as a result of the recent news as of yet. This attack that affected so many organizations was the result of a single, targeted supply chain attack against a specific vendor by a very well-resourced attacker. The dust has not yet settled, but there are likely to be lessons for everyone to be learned from this. We will learn what we can as the scope and specifics of this attack become more clear. To be clear: 1Password is not affected by this incident; we do not use the Solarwinds Orion platform that was compromised. But we'll keep a close eye on developments as we all learn more.
0 -
Am relieved to hear you are not using the SolarWinds Orion product.
But are your servers hosted by a 3rd party ? If so do they use the SolarWinds Orion product ?
0 -
(I am the OP for this thread but this was not the title of the thread that I created on Dec 14. I take it a TEAM MEMBER changed the title on December 20. It isn't so much the new title that bothers me but rather the principle of doing such w/o informing the OP, in advance).
0 -
@mike_uk - yes, we use Amazon's AWS platform for physical hosting of the 1Password.com server architecture. No, Amazon does not use Solarwinds Orion platform by default. In fact, Solarwinds themselves maintain a how-to page for AWS users who wish to set it up -- precisely because an AWS customer would specifically and intentionally have to add it if they wanted it. We didn't, and don't.
0
