Did iCloud leakage give a vulnerable point to 1password synchronization?

[Deleted User]

Those iCloud leaked photos make me worry about my 1password data, it can be easily captured by attackers, what can i do? Just simply disable the synchronization?

littlebobbytables

That's why your vault is never transmitted in an unencrypted state, it is only ever decrypted locally. the opt vault (I think that's what they call the newer format) is what is used when you sync via iCloud too so you should feel relatively safe as long as your master password isn't anything too obvious.

Of course if you don't synchronise 1Password with any devices then iCloud can definitely be turned off, just make sure you make your own backups. By that I mean something like Time Machine where important data is stored in a second location other than just the single drive.

[Deleted User]

reply to @‌littlebobbytables

Thanks for your recommendations, I have disabled the iCloud synchronization and using the external disk storage instead.

Do you think it's easy or not to crack those encrypted vault data for those iCloud attackers? Or it's highly depend on the strength of master password?

[Deleted User]

@littlebobbytables this post just for 3#

littlebobbytables

@Autonomous‌ I trust AgileBits in the design decisions they've made securing our information. I see it in the posts @jpgoldberg‌ makes about why they've made the choices they have or why something works the way it does or even why they don't intend to implement suggestion X. They know their product is all about the security and they take it seriously.

By using standards approved encryption, the hope is there isn't a weakness they have to worry about in the encryption so that leaves brute force password guessing. Now if somebody has access to a copy of your vault that's exactly what they can try which is why password strength is important. It all depends on a good master password.

jpgoldberg

There are lots of lessons from the leaked photos from iCloud. The first one, which should go without saying is.

1, Voyeurism is voyeurism

Viewing what were intended as private photos stolen from a personal account is engaging in voyeurism. Even if the victims of such a crimes used poor passwords or (in)security questions they were not "asking for it". Nor are the victims to blame for having created photos that they would prefer to remain private.

2. Authentication-based systems need rate-limiting everywhere

Authentication systems (where proving who you are gives you access to something) should always use rate limited, lock-out, or some other sort of throttling systems. We should think of authentication systems (like the iCloud service) as having stuff in a box stored by Apple. There are doors into that box with a guard at each door. If you know the right password, you can be granted access to what is in the box.

Typically, when such a guard hears to many incorrect passwords for a user ID, the guard will stop listening for a time. There are other variations on this, but just about every website does something like this. As I said above, an authentication system can have multiple doors into the box, each with its own guard. Even if you don't expect anything but your own software to ever be talking to a particular guard, you need to make sure that that guard also engages in rate limiting. It appears that Apple failed to do this with one of them.

Because 1Password does not work through authentication, but is encryption only, there really are no doors. Decryption transforms the data from something that is indistinguishable from random into your actual meaningful stuff. So there isn't an immediate lesson for us from this. Our equivalent of "rate limiting" is through using a deliberately "slow" key derivation function for processing a Master Password.

3. Use a device passcode on your iOS device.

Some of your data stored in iCloud is encrypted with a device key. So even if someone gets a hold of that data from guessing your Apple ID password, they will not be able to decrypt that data.

Your iCloud Photo Steam is not encrypted that way. It is meant to be available from a website, and so there must be a way for the web server to have the data. But other things are encrypted using keys that are only available on your devices (or computers). So whether or not the victims of this attack used a device passcode on their iOS devices wouldn't have prevented the theft of the photos.

But using a device passcode means that other sorts of data that might be stored on iCloud would still remain unavailable to the attacker who got the Apple ID password only.

Going back to the analogy of a guarded room somewhere, some of the things within that room may also be encrypted in ways that the guards cannot decrypt. It is a really complicated story about exactly which portions of your iCloud data are encrypted with keys on which devices, but setting a device passcode increases what will be encrypted. This includes things related to 1Password.

Quite simply, and data that is marked "ThisDeviceOnly" will encrypted with a device key built into your device. So even if an attacker gets hold of that encrypted data from iCloud, they will not be able to decrypt that data (unless they are launching the attack from your phone or iPad.) 1Password makes extensive use of "ThisDeviceOnly" and related data protection classes.

[Deleted User]

@jpgoldberg
thanks for your elaborations, 1password can be highly trusted and i no longer worry about my private vault again.

khad

On behalf of @jpgoldberg, you are quite welcome!

If you ever have any further questions or concerns, please don't hesitate to let us know. We are always here to help. :)

[Deleted User]

@littlebobbytables
Thanks, according to jpgoldberg, a device passcode is enhanced the safety of encrypted data, it make me free from worries.

sjk

Hi @Autonomous,

I'm happy to hear that @jpgoldberg could help you to be worry-free about your encrypted 1Password data. :)