Security implications of iCloud/MAS transition
Comments
-
Hi,
Sorry if I have missed something here, but can the developers please explain -- in everyman terms -- what the security implication differences are between using the two versions (Agilebits Site verus Appstore, iCloud Sync versus iCloud Drive)?
It jars with me somewhat that "we [AgileBits] do not use iCloud Drive and it is not currently feasible for our sync requirements" and that, to transition, "Each case will be different as there is no single solution for everybody because ... This is unfortunately a manual process".
Why manual? Surely with a user-base of over a few hundred that would be crippling for a company?
In 2011 your reported "Agile Crusader" (spokesperson/salesperson/evangelist?) estimated that you had over 60,000 registered users ("we have 61,786 registered members on our forums, and when you consider that only a handful of users, relatively speaking, sign up for forums, that's quite a lot" - {https://www.quora.com/How-many-users-does-1Password-have}). I expect you have grown since then?
So I am now not only interested in the security differences between the two applications generally (AgileBits Site version versus Appstore version), but also specifically in the resource/security implications of AgileBits now seeking to manually tailor the transition to the Apple iCloud of any registered user who wishes to do so.
Tens (or more) of thousands of individually tailored transitions?
Could you confirm please, given you are in public fora saying you need to do this individual-by-individual, how many you mean?
Could you explain also why anyone who wants to transition needs to be individually tailored by AgileBits?
Thank You for quick and clear clarity
0 -
I've split your conversation from the "megathread" so that we can be sure to give it the attention it deserves. For the questions and answers relevant to that thread, I've posted them there:
As for the rest of your questions:
what the security implication differences are between using the two versions (Agilebits Site verus Appstore, iCloud Sync versus iCloud Drive)
With the App Store, the application is reviewed by Apple prior to being made available to the public. Our AgileBits Store version is not. There are pros and cons either way.
We do not actually utilize iCloud Drive when syncing your 1Password data. We use an Apple technology called CloudKit, which is iOS 8 / OS X 10.10 exclusive and requires that iCloud Drive be enabled. This is the technology that Apple recommends for the kind of data we are storing going forward. You can read more about this here:
With either the "old" iCloud Sync ("Documents & Data") or the new iCloud CloudKit your 1Password data is encrypted by 1Password prior to being sent to Apple's servers.
Why manual? Surely with a user-base of over a few hundred that would be crippling for a company?
In short: yes. As you can glimpse from the activity on these forums, it is causing a lot of requests and long delays. We apologize for that, but it is really the only way we have to move folks to the App Store and we feel that is the right thing to do for our iCloud using customers [though we did warn that iCloud users should purchase from the App Store up front, and moving them now costs us out of pocket in many cases].
I expect you have grown since then?
I feel that is a reasonable assumption. It would be impossible to come up with an exact number of 1Password users, but I'd wager it is well over 60,000. I suspect more than ten times that.
security implications of AgileBits now seeking to manually tailor the transition to the Apple iCloud of any registered user who wishes to do so
I'm not sure I understand the question here.
Thanks.
Ben
0 -
I am an iCloud-preferring customer (who has had that function now disabled by 1Password), increasingly concerned about the security differences between the Webstore and AppleStore versions of your product.
To simply draw on your replies above:
First: I am comfortable with Apple inspecting and approving your application/code. The fact you now have two versions indicates Apple does not approve the webstore version. Please explain what is functional in the Webstore version that Apple will not allow in the AppleStore version.
Second: You appear to state that your webstore version no longer supports "the kind of data we are storing going forward". Please confirm exactly what data Agilebits is storing about or from its users.
Third: You are "not sure I understand the question" about the security implications of AgileBits seeking to manually tailor the transition to the Apple iCloud for users who no longer can. It is simple. Please explain what your staff manually tailoring Webstore versions to enable them to use iCloud involves, that users could not reasonably do themselves. And how this tailoring fits with Apple having refused the Webstore version as above.
I am a registered owner.
I want to use iCloud, not Dropbox or the others you are recommending, which I have no wish to use.
0 -
Hi @Unimpressed,
I am an iCloud-preferring customer (who has had that function now disabled by 1Password)
1Password 5 for Mac is a major release and one of the significant changes we made was a complete rewrite of iCloud syncing. 1Password 5 switched to the new Apple iCloud "CloudKit" technology which is only available on OS X Yosemite and iOS 8, and limited to Mac App Store apps only. After this change we were no longer able to offer iCloud syncing in the web store version of 1Password. We didn't simply "disable" iCloud sync in the web store version.
We've put together a FAQ page with more information here:
Web store and iCloud FAQ
I also want to make sure that you have a chance to review some more information on iCloud and why the Mac App Store is the only version that has access to that particular sync option. Roustem, one of our founders, has written a blog post on the iCloud rewrite and I’d like to share it with you:
About iCloud changes in 1Password 5
I am comfortable with Apple inspecting and approving your application/code. The fact you now have two versions indicates Apple does not approve the webstore version. Please explain what is functional in the Webstore version that Apple will not allow in the AppleStore version.
First of all, Apple has no access to the app's source code, they do not review that. Apple reviews the submitted application to ensure that it follows the Mac App Store guidelines, which can be found here: https://developer.apple.com/app-store/review/guidelines/mac/
The web store version is designed to be sold on our web store for users who prefer to purchase it there, so it's not necessary (or possible) for it to be allowed in the Mac App Store. For example, the web store version includes an in-app updater to install updates — this wouldn't be allowed in the Mac App Store since the updates are handled by the App Store instead. Also, the web store version isn't sandboxed, which lets us to work around a few limitations of sandboxing. This allows our in-app updater to work, and allows a few other improvements as well, such as auto-submit (if you use the Mac App Store version, you need to install a separate script to improve auto-submit — this isn't necessary in the web store version because we're able to include the functionality by default).
You appear to state that your webstore version no longer supports "the kind of data we are storing going forward". Please confirm exactly what data Agilebits is storing about or from its users.
The "the kind of data" Ben was referring to above is your 1Password data, which you are syncing via iCloud (or another sync provider). We are not the ones storing the data, you are storing your (encrypted) data with the sync provider.
The kind of data that needs to be stored for syncing works well with CloudKit, it's like a database. Other parts of iCloud are designed for different types of data — iCloud Drive is best used for syncing files and documents (like Pages, Numbers, and Keynote need).
The only data we have about our web store users is the information they provided when they purchased the app on our store (name, email, etc.) for licensing purposes.
Please explain what your staff manually tailoring Webstore versions to enable them to use iCloud involves, that users could not reasonably do themselves. And how this tailoring fits with Apple having refused the Webstore version as above.
It's not possible to use iCloud sync in the web store version. The only way to use iCloud in 1Password 5 is to purchase directly from the Mac App Store. The CloudKit API is only available to apps that are downloaded via the Mac App Store.
Unfortunately there is no way for us to transfer your purchase from our store to Apple's. I’m sorry we don't have a better migration path for you.
Please let us know if you have any other questions. We're always happy to help!
0
