how to protect against keyloggers when using 1Password browser extensions?
Comments
-
@rschmid: Great question! On both macOS and Windows, there are facilities in place to prevent other apps from capturing your Master Password:
- On macOS we the Master Password field uses SecureInput, both in the app and browser extension.
- On Windows, such a thing does not exist, but if your PC supports SecureDesktop, you can enable that feature for the browser extensions in 1Password 4 > Preferences > Browsers > Unlock on Secure Desktop. Unfortunately not all versions of Windows support this, and come system configurations will break it ("security" suites and display drivers most frequently).
But the best defense against key loggers is to not install them — or allow someone else access to your system so that they can. I hope this helps! :)
0 -
@brenty: yes, your answers helps me a lot. Thank you.
I will enable on my Windows SecureDesktop for my (IE) Browser Extension. Does Windows7 Pro (64-bit) support it?
Good to know that on my Mac I can feel secure :)
How often should I change Master Password?Sure best defense against key loggers is not to install them - or allow someone else to install them :) ;)
Kind regards,
Roland0 -
Does Windows7 Pro (64-bit) support it?
@rschmid: SecureDesktop is supported by Windows 7 and higher, but if you encounter issues there may be some other software which is incompatible. That's why it's optional in 1Password 4, and disabled by default.
How often should I change Master Password?
So long as you choose a long, strong, unique Master Password, you should never* have to change it.
*Barring future developments of super intelligent machines which can infer what we were thinking when we chose it...
Sure best defense against key loggers is not to install them - or allow someone else to install them
I guess that might have sounded a bit snarky, but that wasn't my intention: I was serious. It is so fun to try to new software (at least for me), and ultimately we're the weakest link in our own security. We all make mistakes, so being a little bit paranoid on the internet can go a long way. Cheers! :sunglasses:
0 -
So long as you choose a long, strong, unique Master Password, you should never* have to change it.
@brenty: I guess my master password is secure for the moment. I created it using the English Diceware Word List (Arnold Reinhold).
I guess that might have sounded a bit snarky, but that wasn't my intention: I was serious. It is so fun to try to new software (at least for me), and ultimately we're the weakest link in our own security. We all make mistakes, so being a little bit paranoid on the internet can go a long way. Cheers! :sunglasses:
you are right, humans are the weakest link in our own security.
Thanks for your kind help.Kind regards,
Roland0 -
I guess my master password is secure for the moment. I created it using the English Diceware Word List (Arnold Reinhold).
@rschmid: Awesome! I'll just add that 4 words is considered good enough, but I prefer 5-7 to give myself some "breathing room" as computing power improves.
you are right, humans are the weakest link in our own security. Thanks for your kind help.
Any time! Don't hesitate to reach out if you have any other questions, comments, or suggestions. Have a great weekend! :)
0 -
Awesome! I'll just add that 4 words is considered good enough, but I prefer 5-7 to give myself some "breathing room" as computing power improves.
@brenty: I use 5 words. Those 5 words I remember very good as I type them daily into my keyboard :)
Any time! Don't hesitate to reach out if you have any other questions, comments, or suggestions. Have a great weekend! :)
have a nice sunday! ;)
Kind regards,
Roland0 -
I use 5 words. Those 5 words I remember very good as I type them daily into my keyboard :)
Love it. :chuffed:
have a nice sunday! ;)
Will do! :) :+1:
0 -
:sunglasses: :+1:
0 -
A lot of extensions in Chrome require the permission "Read and change all your data on the websites that you visit." Can these extensions in principle read my Master Password and Account Key?
0 -
@pervel: That's a fantastic question! While my answers above apply primarily to the native 1Password apps, we also take some similar precautions (and many others, such as WebCrypto) with the web interface. I am not 100% clear on all of the details though, so I've asked some other folks who specialize in 1Password's browser integration, web services, and overall security if they can weigh in on the risks and the security measures in place specifically on the website. Thanks for bringing this up! :)
0 -
@pervel, you are indeed correct. Just as 1Password can read usernames and passwords and save them into its database when you ask it to do so, any other extension with the ability to "read and change all your data on the websites that you visit" can do the same.
For this reason, I actually have two profiles (or "People") in Chrome. One I've named "Loose" and one "Strict":
In the "Loose" profile I have a variety of extensions installed, but in "Strict", only 1Password is installed. I added another extension to "Loose" that blocks 1Password.com URLs, along with some other important sites:
So I can access those sites only in the "Strict" profile where I know that 1Password is the only extension that can read the page.
This has given me a little more peace of mind that I don't have to worry as much about one of my extensions going rogue and getting access to all my secrets – personal, work, and otherwise.
I hope that helps!
0 -
I use it without a Google account.
0
