Read first: Previous version support information

UNOFFICIAL Solution for 1Password 6 and Chrome

czz
czz
Community Member
in 1Password 3 – 7 for Mac

It is possible to manually patch 1Password 6.8.9 to work with the current version of Chrome while still maintaining the security of code signature enforcement for both Chrome and 1Password. I have tested the below steps and they work on macOS 12.3.1, but of course I make no guarantees.

VERY DANGEROUS! UNSUPPORTED! TRY THIS AT YOUR OWN RISK! MAKE BACKUPS FIRST!

For the developers out there, the tl;dr - update the certificate's common name string in the OnePasswordCore binary, and re-sign the framework with a self signed cert.

Steps:

  1. Disable the extension in chrome://extensions
  2. Open a Finder window, navigate to "Applications", right click on "1Password 6" and select "Show Package Contents"
  3. Navigate to Contents/Frameworks/OnePasswordCore.framework/Versions/A/
  4. Right click on "OnePasswordCore", and select "Duplicate". This is your backup. Leave the Finder window open.
  5. Install and launch a hex editor. This process is much easier if you do not use a hex editor from the Mac App Store due to sandboxing, so this example uses hexfiend installed from .dmg.
  6. Drag OpenPasswordCore from the Finder window into the HexFiend window. You'll see this:
  7. Select Edit->Jump to Offset from the menubar, and enter 1390547. You'll see this, and your cursor will be positioned before the first 00 on the line that begins 1390544:
  8. Type in two more 00s. The result should look exactly like this:
  9. Click on the text representation on the right side of the window, and change "Google, Inc." to "Google LLC" only on lines 1390512/1390528 (leave the one above untouched). When done, it should look exactly like this:
  10. Save the modified file (File->Save) and exit the hex editor.

Now that the modification is done, the framework's code signature needs to be replaced with one of our own. The extra careful among you can disconnect your internet connection now, or even perform these steps on a different isolated system.

  1. Launch "Keychain Access", then select Keychain Access->Certificate Assistant->Create a Certificate from the menubar.
  2. Name it "1password self sign", leave the Identity Type as "Self Signed Root", and change the Certificate Type to "Code Signing". Click "Create".
  3. You'll get a warning at this stage that while technically true, is a bit misleading in this case. We're not asking anyone else to trust this certificate, and more importantly, code-signature checks are still performed on our modified binary. Malicious code won't be able to modify it (any more than it could've modified the original). You can test this yourself after the process is done.
  4. Open a Terminal, and run the following command (all on 1 line):
    sudo codesign -fs '1password self sign' '/Applications/1Password 6.app/Contents/Frameworks/OnePasswordCore.framework/'
  5. If you're asked to grant permissions, go ahead. If it worked, you'll see this (without any additional messages):
    /Applications/1Password 6.app/Contents/Frameworks/OnePasswordCore.framework/: replacing existing signature
  6. [Optional - for the paranoid] Back in Keychain Access, select the 'login' keychain on the left, and then the 'Keys' tab. Search for '1password self sign', right click on the row for the 'private key', and delete it.
  7. Reboot. If you don't want to, launch "Activity Monitor", search for "1Password mini", click the "Stop" icon, and select "Quit". It should immediately restart itself.
  8. Re-enable the Chrome extension, and it should work!

1Password Version: 6.8.9
Extension Version: 4.7.5.90
OS Version: macOS 12.3.1

This discussion has been closed.