Security of WiFi syncing

LarryP

In 1Password 4 WiFi sync between iOS devices and Mac would only work once you select Window->WiFi Sync from the menu to open the Wifi Sync dialog box. I took this to be a good security measure -- whatever server 1Password starts on the Mac for the iOS device to connect to is only running when the user wants to sync. Prevents password guessing attacks. The user manual for 1Password 5 also says that you must select Window->Wifi Sync before you can sync. (see the bottom of the page at https://guides.agilebits.com/1password-ios/5/en/topic/sync-over-wifi ) HOWEVER --- I have discovered (by accident and then confirmed) that Wifi sync will work even when the user has not opened the Wifi Sync dialog box. In fact, even if 1Password 5 on the Mac is closed the Wifi Sync from iOS will work. This is contrary to what the user manual implies. And it means that though unlikely we are now open to someone on the Wifi subnet guessing the syncing password.

I'd like someone from AgileBits to comment on this. Is it intentional that syncing works even when you have not selected Window->Wifi Sync? I.e, that the Mac is always ready to connect to an iOS device requesting a sync? What are the security risks associated with this behavior.

Thanks in advance for your response. And PS I think this is a great product -- it has proven to be very useful and very reliable.

rickfillion

Hi @LarryP,

You're right that the behavior changed there between version 4 and version 5. If the documentation doesn't reflect this change then it's because the documentation is out of date and we should fix that. It's possible that the windows version of the app still requires that the window be open for the Wi-Fi sync server to be running, in which case they may have decided to just keep the instructions simpler and consistent.

I'd say that the risks associated with this are equivalent to those with storing your AgileKeychain in a place like Dropbox, or letting anyone have physical access to your computer (where they can get access to your encrypted data), in that we do as much as we can to protect your data by keeping it encrypted with strong keys and AES encryption. As a user, we now give you the choice about when you'd like the Wi-Fi sync server to be running. When you uncheck the checkbox, the sync server shuts itself off. This also means the server doesn't start running until you check the checkbox.

I'll file a bug report against the documentation so that they can take a look at that last line and fix it up if need be.

If you have any specific questions, let us know and we'll do our best to answer them.

Rick

LarryP

I like the added security of not having the sync server running when I'm on a WiFi network that I don't fully trust. For the same reason I don't use iCloud and Dropbox syncing. I can see why this was changed in version 5 however -- it is much simpler for the end user this way.

For those security paranoids like me it's nice to be able to turn the sync server off and on. I tried unchecking the checkbox you mention. That did the trick. I should mention though that when I checked it to turn the sync server back on, sync from iOS did not start working again until I quit Mac 1Password and restarted it. Re-checking the box was not enough to get the server running again. An inconvenience I can live with.

Thanks for your prompt response.

Larry

Megan

Hi @LarryP,

I'm glad that Rick was able to help you out here! If you have any further questions or concerns, we're here for you. :)