Online vault browser and cache security

Options
pistachiomatt
pistachiomatt
Community Member
edited December 2022 in 1Password in the Browser

With the outrageous incompetence of LastPass storing user data in plaintext (so glad to be here!) it made me question how the online vault viewer works.

I understand SRP secures the login. Once my vault is unlocked, does the server have access to unencrypted data to transmit to my browser for viewing? I’d also imagine usual response caching and indexing for the search box— how are those data stored? And when does it get wiped?

Last question: previously saved vault item data only appears online; is that stored in the vault or elsewhere?

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser:_ Not Provided

Comments

  • GreyM1P
    GreyM1P
    Options

    Hi there @pistachiomatt

    Once my vault is unlocked, does the server have access to unencrypted data to transmit to my browser for viewing?

    No. All decryption is done locally. Your browser fetches your 1Password data in encrypted form, which is then decrypted on your device.

    I’d also imagine usual response caching and indexing for the search box— how are those data stored?

    They're not stored. All searching is done on the local data too, just like decryption. When you close the tab, it's gone.

    Last question: previously saved vault item data only appears online; is that stored in the vault or elsewhere?

    We save all previous versions of an item within the structure of the item itself, a bit like how modern word processors can save a revision history of a document, and you can go back to those previous versions.

    I hope that answers everything, but if you have any follow-up questions or would like any more detail, do let me know. :)

    — Grey

This discussion has been closed.