New Solution to People Wanting Log-In Info On Their Various Other Entries
(skip to to the bold for the solution)
PROBLEM: Your Bank Account info is one record. Your bank's Log-In info is in another record.
Seems like an unnecessary separation of connected info to me -- with multiple drawbacks. As such, I have read a few places where people have requested that their website log-in info be directly available in, say, a bank record. Here is one thread on the subject...
https://discussions.agilebits.com/discussion/58053/combine-bank-account-entry-and-bank-logins
WHY IS IT BAD TO HAVE THESE TWO THINGS SEPARATE?
Well, for one, IMHO it's just not great organization. If these were actual folders, you wouldn't have your bank account info in one folder and the bank's log-in info in another folder. IMHO it's not great to have information from one institution spread out over multiple places. Furthermore, this makes it "harder" to access the data - in multiple scenarios. For example, I would love to just print out my Bank Records and put them in my safety deposit box so my loved ones have easy access to my info in an emergency. But by having separate log-in and bank records, I need to print out all the bank records, then go in and call up each bank's log-in info and print them separately. I could use a tag, yes, to call up "bank log-ins" and print those out all at once, but now we are starting to get a complicated organization hierarchy going.
--Two separate things to print for every category.
--Tags to manage (and maybe forget)...etc.
THE CURRENT SOLUTION
One solution is to create custom fields in, say, a Bank Record that contains the log-in info. But that is problematic, if you have multiple accounts at one bank. Do all the accounts have those custom fields? So I then need to update all of them. Or maybe just one of the bank accounts is the "master keeper of the log-in info". But which one is the master?
Currently, FYI, I do use the custom fields solution -- my Bank Account records include custom fields with my log-in info. But if I have multiple accounts at that bank, I don't enter the data redundantly. One account is the "master" and in my other custom password fields on other accounts at that bank, I just put "See Chase Bank-1043" (or something) to tell me where the password is. The benefit here is, I still easily print an updated "bank account" sheet every now and then for the safe deposit box -- that has all the log-in info -- I don't have to worry about having to enter that info redundantly in multiple bank accounts. But every Bank Account Record will still easily lead anyone who looks at it to the proper place to find the password.
THE ABOVE IS NOT MY "NEW" SOLUTION. THIS IS...
My new solution is special kind of "custom field" which would allow the user to create some kind of "link" from, say, a Bank Record (or a Rewards Record, etc) back to a Log-In Record. It would work like this:
1) You are entering a Bank Record (etc)
2) You create a custom "link" field
3) The link allows you to link to any Log-In Record you have created (you select from maybe a pull-down menu)
4) Once the two records are linked, the Log-In Record's username, password (and let's say website) appear in the Bank Record like "aliases" in the Mac OS finder.
5) You can click on these field's to copy them - but you cannot edit them in this "echo" of the data.
6) However, you can click on one of those sub-menus and select "Go to Log-In Record" and you will be taken to the log-in record directly
This solves almost all problems:
1) You still create a separate log-in record for all log-ins (and therefore get the benefit from that).
2) But your log-in credentials are still easily viewable in, say, your bank record. Or your rewards record. Etc.
3) You don't have to set-up custom fields -- this solution is available out of the box for all those people who have requested (and I get the sense they are many -- certainly everyone I've spoken to)
4) You don't have to worry about redundancies or having your info for one institution spread out in multiple records.
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Referrer: forum-search:log info for bank info
Comments
-
My new solution is special kind of "custom field" which would allow the user to create some kind of "link" from, say, a Bank Record (or a Rewards Record, etc) back to a Log-In Record.
This strikes me as somewhat similar to current related-item links and is an interesting idea. It goes a bit beyond current related item functionality as related items are just included as links and you still need to click the link to view the related item, but it's in a similar vein and I can see the utility in making these links more interactive. Thanks for the feedback! I'll definitely pass it along to the team. :chuffed:
0 -
:)
0 -
:+1: :)
Ben
0 -
I'm actually trying to read about the "related items" link -- and can't seem to find anything. Any hints on how it works/how to use?
0 -
@paranoyd - Excellent question, and no -- at this point, we have no formal support page for Related Items. Might be a good idea to add one. ;)
Related items is a feature exclusive to 1password.com accounts, and it's one you won't see in normal usage if there are no Related Items for a given 1Password item. It's visible only when you click on "Edit" on a given item in one of your 1password.com vaults. When you click Edit, you have two choices:
- Link existing - clicking this button will open a window showing you items in the same vault which you can choose and create a link to from the item you're currently editing. This can be helpful if you have, say, a bank account created in the Bank Accounts category and you want to link it to the Login item for that bank's online banking site.
- Add new file - clicking this button will open a window to your computer's file structure, allowing you to navigate like you do usually in folders, to locate and import a file on your hard drive into 1Password. This file will be imported as a Document, and a link will be created from the record you were linking from to this new Document.
I use both these features. Let me use the example of purchasing one of the software bundles that you see regularly online: get 10 apps for $50 or something similar. Usually, you wind up getting a single receipt with your charge details and all the apps listed on it. So I'll need to create ten separate software licenses, one for each of the new apps I've purchased -- but I also want to have the pdf of the receipt available, should I need it for proof of purchase. So, as I'm creating the first of the ten software license records in 1Password, I use the "Add new file" option to create a 1Password Document of my receipt, and link it to that first Software License. Then, for each successive Software License I create for the apps I purchased from that bundle, I use the "Link Existing" button to simply link the new Software License to that already-existing Document of my receipt. Easy-peasy. :)
Let us know if you have any further questions about how this feature works.
0 -
Ah. I see why I haven't found it. I'm one of the edge case users who doesn't like to have their passwords in the cloud. I keep a vault on my computer...and only my computer... :)
0 -
@paranoyd - that would definitely explain it! There are a number of features that having access to both ends of the sync equation makes possible, where it's either not possible at all, or monumentally more difficult in the absence of that condition. With local vaults, items have to be added as Attachments directly to each individual 1Password item -- so in the case I mentioned above, if I wanted to have the receipt for my software licenses associated with each license, I'd have to import and attach it ten times, once to each individual Software License item in 1Password.
There are a number of other advantages to a 1password.com account, so if you find yourself wanting features that only the account can offer, we invite you to try a free 30-day trial of 1password.com. You can kick the tires for a full month before having to make a decision. Oh, and if you're interested in the nitty-gritty of how we keep your data secure on our servers and in transit, you're welcome to read through our security white paper.
If you know you'd prefer sticking with local vaults and standalone licenses, that's fine too -- we'll be supporting those in the upcoming 1Password 7. :)
0 -
Thank you. I have read up on the security. But considering the catastrophic results of any kind of breach, combined with the five breaches I have already endured of specific sensitive data, one place the keys to my entire "kingdom" will not be stored...is in the cloud. :) Your software is incredibly convenient already. I can live without the added convenience of cloud storage - considering all the potential pathways for there to be a problem. My only hope is that you guys don't leave out features in the non-cloud version (that don't require a cloud) simply to incentivize moving to the cloud solution...
0 -
@paranoyd: It's not a matter of "leaving out" features, but that some are simply not possible without a hosted service: Travel Mode, web interface, item history, secure item sharing, etc. But more importantly keep in mind that your 1Password data is end-to-end encrypted, so 1Password simply doesn't depend on the sync service to protect your data. And with 1Password.com specifically, all data is encrypted locally on your device with "keys" which we never have, so a breach isn't a problem for your data: the attacker cannot get what they need to decrypt it from us, even if they get everything else — we simply don't have what they need. Cheers! :)
0 -
Thank you for the response. And I understand that there are features that are not possible without a hosted service. My hope was that you guys wouldn't also leave out...
"features in the non-cloud version (that don't require a cloud) simply to incentivize moving to the cloud solution"
(hence my specifying features "that don't require a cloud")
It's been known to happen in the world of software. :)
As for assurances of data safety, well, suffice it to say, there are lots of words that are thrown about concerning security these days that sound very reassuring. But in the practical world, experience has shown me that those words don't always translate into the experience they promise. People make mistakes. Engineers make mistakes. What was once thought impossible suddenly because possible with the proper advances in computing power and math structures. 1Password has had problems like many others...
https://www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/
http://bgr.com/2017/02/24/uber-1password-fitbit-and-okcupid-user-data-exposed-by-massive-security-flaw/I'm sure there are internal rebuttals to these things. No sensitive data stolen and all that. "We have other layers of protection." Okay. But a big screw up was made somewhere. Maybe there are screw-ups made somewhere else. Maybe in THEORY the triple-layer of encryption can protect us. But maybe in practice, that security solution has been compromised in some way -- either by accident, or by a malicious player somewhere in the process. The only thing I can truly know for certain is this... if my passwords ONLY exist on my computer, then someone would need physical access to my computer to get my passwords. If they are in the cloud...I'm pretty sure Spock could figure out a way to grab them... :)
0 -
@paranoyd: Totally. As I'm sure you've noticed, we've continued to make improvements to the standalone apps themselves, which as "point" updates are included in your license purchase. And we've got some great stuff in the works for the next major release as well. I think you may be looking at it from the other direction though: that we're adding "cloud features" to justify "cloud service". Actually the opposite is true: if people hadn't been asking for these features we wouldn't have ever built 1Password.com in the first place. But since these things are only feasible with centralized, integrated hosting, and they were important to enough people for so many to ask us for them over the years, we decided it made sense to build that.
And with regard to security, I don't know that this is necessarily a comforting statement, but the reality is that, with 1Password.com, since only you hold the keys to your data, the only way someone can get into your data (even if they steal the database from us) is if you screw up and give them your Master Password and Secret Key. If someone wants those, they will ned to go through you anyway, so it's not out of their way to get anything you have stored locally. Certainly that's a lot of responsibility, but 1Password users have overwhelmingly told us that they want to control their data. "With great power," as they say. :)
0 -
"I think you may be looking at it from the other direction though: that we're adding "cloud features" to justify "cloud service".
Oh, no worries. I didn't think you had done this thing I spoke of yet. It wasn't an observation about your current cloud features. It was an expression of hope for the future that such a thing wouldn't occur. Like I said, it's been known to happen. :)
"...the only way someone can get into your data (even if they steal the database from us) is if you screw up and give them your Master Password and Secret Key."
Well, there's a few other IF's in there.... :) One is that the encryption gets cracked. In 2013, we learned that the NSA could crack virtually every type of encryption out there at the time. Granted, there have been advancements since then. But so have there been in the strength of computing power. I know it would take my grandmother's super computer 100,000,000,000 billion years to currently crack AES-256 encryption through a brute force attack. And we are told it won't be until the late 2020's that quantum computers will break our current encryption. Maybe that's right, maybe it's wrong. I don't want to bet all my passwords it's wrong. :) I also know the one constant in life is that things we thought were impossible, suddenly became possible because some clever person saw something that nobody else saw...and changed the world. "Impossible!" was said about a number of things in the sciency-world. And all it really was was a lack of imagination. :) I'm not saying some math genius is going to figure out a way to crack that kind of encryption in use today, but I know there are quite a bit of genius PhDs working very very hard in well-funded labs, some of them in our own government, to do that very thing. I also need to make an assumption that 1Password's encryption works as I am told - not to impugn you guys, because I think you are an awesome company. But that calculus is in there, too. Malicious actors get in a system and cause mayhem. Hell, if I was the NSA, I would ABSOLUTELY 100% be trying to get a guy in your very company (among others) to place in back-doors - and I would set my sights on a cloud back-door first. And finally, yes, if I use the cloud services...the only reason I would do that is because I wanted the ability to access my passwords from all my devices. So instead of having those master keys on one device, I would have them on...what? An iPhone, an iPad...a few computers. Suddenly there are four vectors for a theft of the kind you mentioned.
Again, I get I'm an outlier here. Possibly a little paranoid. :) But also with a lot of faith in the cleverness of my fellow man...that what we think is impossible, might just not be. And, again, considering the risk-reward...and how totally convenient your product is already, I'm cool with it one place with the occasional manual sync to my phone.
0 -
Oh, no worries. I didn't think you had done this thing I spoke of yet. It wasn't an observation about your current cloud features. It was an expression of hope for the future that such a thing wouldn't occur. Like I said, it's been known to happen. :)
@paranoyd: I apologize for misunderstanding. Frankly, we're excited for the added possibilities and flexibility that we have with 1Password.com. I agree that you raise a legitimate concern. But I feel that our track record speaks for itself. It's up to us to continue to demonstrate that though! :blush:
Well, there's a few other IF's in there.... :) One is that the encryption gets cracked. In 2013, we learned that the NSA could crack virtually every type of encryption out there at the time.
That's not technically accurate. AES has not been cracked, even after decades of people trying. "Cracked" would mean that a flaw has been found that makes it much easier to break into the encrypted data — a shortcut, if you will. The truth is that the only way the NSA or anyone else is able to break into this type of encrypted data is by guessing: brute force attacks. Certainly a combination of weak passwords and throwing lots of resources at the problem makes this feasible. That's why it's so important to use a long, strong, unique Master Password — which is further strengthened against brute force attacks using PBKDF2 to slow down guessing considerably. We're also not the only ones using AES. Pretty much everything does now. So if it was cracked, we'd all have moved on to something else. Inevitably it will be rendered obsolete by technologies that don't exist today (all of this still requires too much power to brute force strong passwords on a human time scale), but the entire security industry and those in the cryptographic field are constantly working to advance this. Truly we all stand on the shoulders of giants. :blush:
Granted, there have been advancements since then. But so have there been in the strength of computing power. I know it would take my grandmother's super computer 100,000,000,000 billion years to currently crack AES-256 encryption through a brute force attack. And we are told it won't be until the late 2020's that quantum computers will break our current encryption. Maybe that's right, maybe it's wrong. I don't want to bet all my passwords it's wrong. :) I also know the one constant in life is that things we thought were impossible, suddenly became possible because some clever person saw something that nobody else saw...and changed the world. "Impossible!" was said about a number of things in the sciency-world. And all it really was was a lack of imagination. :) I'm not saying some math genius is going to figure out a way to crack that kind of encryption in use today, but I know there are quite a bit of genius PhDs working very very hard in well-funded labs, some of them in our own government, to do that very thing.
Totally. The great thing is that there are a ton of people working on this, both ones you're afraid of and those on the "side of good" with regard to advancing the state of the art. You might be interested in this discussion regarding the feasibility of these types of attacks now and in the foreseeable future.
I also need to make an assumption that 1Password's encryption works as I am told - not to impugn you guys, because I think you are an awesome company. But that calculus is in there, too. Malicious actors get in a system and cause mayhem. Hell, if I was the NSA, I would ABSOLUTELY 100% be trying to get a guy in your very company (among others) to place in back-doors - and I would set my sights on a cloud back-door first.
Well, certainly you can do as others have done and write your own implementation that reads and writes 1Password data. Folks working on them post about those here on the forums now and then, and there are many others out there too. So while certainly there is a degree of trust involved, there's a lot of information out there not only from us, but also from 3rd party developers. While we have an extensive security white paper, we also participate in external audits and cooperate with independent security researchers to find any flaws so we can fix them. So you don't entirely have to just take our word for it.
And finally, yes, if I use the cloud services...the only reason I would do that is because I wanted the ability to access my passwords from all my devices. So instead of having those master keys on one device, I would have them on...what? An iPhone, an iPad...a few computers. Suddenly there are four vectors for a theft of the kind you mentioned.
I'm not sure that you can lay this "attack vector" at the feet of 1Password. If you are legitimately a target of government organizations or other powerful entities you should definitely take that into account with raged to how you use any technology. It's your choice, and everyone is different, so you need to do what's best for you based on your own personal threat model.
Again, I get I'm an outlier here. Possibly a little paranoid. :) But also with a lot of faith in the cleverness of my fellow man...that what we think is impossible, might just not be. And, again, considering the risk-reward...and how totally convenient your product is already, I'm cool with it one place with the occasional manual sync to my phone.
Haha I hear you. No harm in being a little paranoid, so long as you're not making yourself suffer needlessly. We've each got to do what we believe is best for us. Rock on! :sunglasses:
0 -
Haha I hear you. No harm in being a little paranoid, so long as you're not making yourself suffer needlessly.
Yeah, that's the trade off, and believe me -- with nineteen million cameras on every computer and phone and microphones connected to the internet in my house (including several Google Voices, all my iOS devices, etc) - I'm more than willing to sacrifice a little privacy/security for convenience. So far though, maintaining a local vault on one hard drive and then just manually syncing now and then isn't really much of an inconvenience. At least to compared to how utterly convenient 1Password has been thus far.
Totally. The great thing is that there are a ton of people working on this, both ones you're afraid of and those on the "side of good" with regard to advancing the state of the art. You might be interested in this discussion regarding the feasibility of these types of attacks now and in the foreseeable future.
Good point. Thank you for the link.
I'm not sure that you can lay this "attack vector" at the feet of 1Password.
My bad. I didn't mean to say it's on your feet at all. It's just an inevitable outgrowth of cloud syncing - having your data on more than once device. Cloud syncing would be much less valuable (if at all) if you only intended to access your passwords from one device.
So you don't entirely have to just take our word for it.
No, but those long-term, deep-cover, back door-installing NSA agents are really good at what they do. So I hear. :) But in a way, that's part of my calculus, actually. How awesome your product is...and how I suspect more and more people will be using it...thus making it more of a target.
That's not technically accurate. AES has not been cracked, even after decades of people trying. "Cracked" would mean that a flaw has been found that makes it much easier to break into the encrypted data — a shortcut, if you will.
Like one of these...?
"A crippling flaw affecting millions—and possibly hundreds of millions—of encryption keys used in some of the highest-stakes security settings is considerably easier to exploit than originally reported, cryptographers declared over the weekend."
:)
0 -
@paranoyd - yes, exactly like that. Fortunately, 1Password isn't using (and has never used) Estonian smart cards for two-factor authentication. ;)
That may sound flip, but it's not intended to. Instead, it's intended to be an intro to the notion that we use public, well-tested crypto libraries wherever possible, and short of revealing our source code, we go to great lengths to document both the design of standalone vault keychain formats and the security deployed on 1password.com (think I mentioned that last link earlier). We don't - and never have - "rolled our own" crypto for that very reason, and as a result, we've never experienced a breach of users' encrypted data. With a user-base the size of ours, over eleven-plus years, that's a pretty good record.
0 -
Haha - no, it didn't sounded flip. I mean...not to disparage the fine country of Estonia...but it sorta "flips" itself. :)
I was just saying that I have enough faith in the cleverness of man that there is just might be a that risk some flaw might be found one day that DOES affect me...and isn't worth betting the farm over as -- and this is the most important point -- it's not that much of an inconvenience to stay off the cloud. That being said...
I am now realizing that a cloud based solution would solve certain problems for me for a special, segregated aspect of my password storage. Meaning, some passwords I share with people...and, in that case, the convenience of cloud syncing WOULD be worth whatever risk there is. My question is: do you forsee any problems with me maintaining two completely different "worlds" on my computer. One being my stand-alone vault...and another being a vault in the cloud that someone else can sync with? Sometimes different versions of software don't play well together...and I'm not well-versed on the cloud angle to even gauge.
0 -
@paranoyd: Significantly, this is what we worry about too. That's why, in addition to our own efforts, we participate in external audits and cooperate with independent security researchers to find any flaws so we can fix them. Not having the "keys" to anyone's data (except for our own, of course!) is critical for us. Otherwise we wouldn't sync and share data either.
Regarding using both local vaults and 1Password.com accounts, while this is problematic on Windows, it's very easy on macOS: you can have both side by side. Cheers! :)
0 -
Thanks for the tip. One question - since I don't want to err and accidentally upload the wrong vault to the cloud -- for the fifty aforementioned reasons... :)
So I see how I can create two vaults...and the dynamics of how they co-exist. But is it possible for me to:
1) Create a cloud account that ONLY will "suck up" the TempGina account to the cloud.
2) Allow Gina to access the TempGina account -- but no others?0 -
@paranoyd - if you have more than one standalone vault in 1Password for Mac, your data will not be auto-imported, because 1Password doesn't know where you'd like to put various data. If it's a straight Primary-to-Personal upload into an Individual account, we assume you want it to just go from point A to point B, so to speak. So no worries on that score.
What you'll want to do instead is use these instructions to move data between any of your standalone vaults and the 1password.com vault(s). Although it's not automated, it's a pretty quick and simple process if you use shift + click or command + click to select multiple items from the standalone vault(s).
With regard to what Gina can access, are you envisioning her having an Individual account? Or you both sharing a 1Password Teams account? You can't access her individual account, unless of course you pay for it and insist she share the credentials with you. Cryptographically, if she creates the account, you can't access it in any way - even to add items to it - if you don't have the Master Password and Secret Key. Can you say a bit more about what you're trying to accomplish? Thanks.
0 -
Thanks for the help. I'm trying to accomplish:
1) I have a standalone vault - that does NOT upload to the cloud and only I can access it
2) I have a second vault - for Gina - that DOES upload to the cloud - and we both can access it
3) I want to be able to access my standalone vault the way I do now - it resides on my computer and I manually sync to my phone
4) I do not want Gina to be able to access my standalone vault
5) But Gina can access the second vault -- and I can update things on my computer and it will propagate to the cloud and back down to her iOS 1password app. Likewise, she can upload to her iOS 1password app and it will propagate to the cloudI will be maintaining and managing all accounts. Gina would just be a user who can access a "sub-portion" as it were of the one account she has been granted access to. Those would be the accounts she and I share. She has no account currently at all. I currently keep all our passwords and want to make it easier for her to access them - while keeping some of mine separate.
0 -
Hi there. I did not see the email in my inbox - nor in my junk box (which is weird because I get all the notifications). That being said, I have changed my email. Maybe try again with the new one? c******k@...
0 -
got it. will process. thank you!
0 -
:) :+1:
0 -
I sent a reply - and haven't heard back yet. Which is fine. :) I just wanted to make sure things weren't getting lost in the mail, as things were getting lost in the mail before. :)
0 -
Sure thing! I'll get back to you via email shortly. :)
0 -
So just curious if this latest exploit...
...affects our discussion of security...?
"Meltdown and Spectre are two techniques researchers have discovered that circumvent those protections, exposing nearly any data the computer processes, such as passwords, proprietary information, or encrypted communications."
0 -
@paranoyd --
So just curious if this latest exploit affects our discussion of security...?
Welllll, that depends on how you look at it, I suppose. Not trying to be vague, so let me state up front (in case you haven't already seen it) that our Chief Defender Against the Dark Arts, Jeffrey Goldberg, has a new blog post up addressing this very issue for all 1Password users: what it means for an individual user, what it means for us as hosts of your data, and related issues (spoiler: though we don't know for certain yet all of what this significant vulnerability in Intel, ARM and AMD chips might entail, the overall answer appears to be: not much, assuming you're the kind of person who stays on top of updates and practices good 'digital hygiene'. In other words, don't "melt down," ;) ).
That said, I think this definitely serves to highlight something that we've believed for some time and have said when it seemed appropriate: that keeping data out of "the cloud" isn't a guarantee of security. In fact, it's not even evidence that doing so provides provably more security than not doing so, as threat vectors appear that have nothing to do with "the cloud" (ours or anyone else's) specifically, but rather by their nature can potentially appear in the very heart of each of our own systems, as individual computer-users. In this case, as we use AWS as our host for 1password.com, part of what we pay them to do is panic for us and apply the appropriate countermeasures to their own hardware, likely much more quickly and thoroughly than individual users often do. That means the entire 1password.com server architecture is at this present moment probably better protected against threats based off Meltdown and Spectre than the average home (or even corporate) computer is. That said - as Jeff reiterates in his post - in terms of our servers, we designed 1password.com from the ground up so that we don't - and CAN'T - know your Master Password or Secret Key. All encryption is done client-side, meaning even if the hardware on which 1password.com runs were compromised, your data would not be available in decrypted form.
I'm not sure if you had something specific in mind regarding what we've discussed previously regarding security, but give Jeff's blog post a read, and if you've got further thoughts, we'd love to hear them!
0 -
Definitely will give a read to your link.
That said, I think this definitely serves to highlight something that we've believed for some time and have said when it seemed appropriate: that keeping data out of "the cloud" isn't a guarantee of security.
No, of course not. But the cloud is another vector for an attack. So instead one vector with a local file there are now two vectors.
In fact, it's not even evidence that doing so provides provably more security than not doing so, as threat vectors appear that have nothing to do with "the cloud" (ours or anyone else's) specifically, but rather by their nature can potentially appear in the very heart of each of our own systems, as individual computer-users.
Right - this is not a cloud flaw per se. But, getting into the weeds, there really is no "cloud". It's a mental construct. There are just computers sitting someplace else that hold all my data. And it appears that a massive vulnerability has just been discovered that will affect those computers.
In this case, as we use AWS as our host for 1password.com...
Yes, and if AWS knows about any new vulnerabilities that come out before a bad actor can exploit them; and if there is a patch available; and if they install them all properly, then we're good. A lot of ifs there though...
As for all the encryption being done client-side, then could now an exploit be written that grabs my data on my computer as it is being shunted around RAM in preparation for being uploaded? If so, sure, that could happen I suppose to my regular non-uploaded data. But as I've said before...that's one vector. Now we have two.
But I'll read the thing and report back something equally paranoid. :)
In any case, the real point is here is...we wake up one day and find out that we aren't nearly as protected as we all thought we were...
0
