SSL Decryption Deployment

Hello @Zaka7! 👋

Thanks for the question! It's indeed pretty common for corporate environments to install security appliances that can inspect TLS/SSL traffic, it's one of the ways that professional and sensitive environments protect their data from malicious attackers.

The items that you store in 1Password cannot be intercepted and viewed in-transit using TLS/SSL inspection. 1Password does not only rely on TLS but uses three layers of encryption that work independently:

1. TLS Encryption.
2. Secure Remote Password (SRP) authentication and session encryption.
3. The core end-to-end 256-bit AES encryption which uses your account password and Secret Key to encrypt your data and then only decrypt that data locally once it arrives on your device.

Your 1Password data can't be viewed using TLS inspection because of this cryptographic architecture. Let me know if you have any questions. 🙂

-Dave

@Zaka7

Once you've filled your login credentials (or other data) into a website then 1Password's role ends and it's up to the security of that particular website itself to securely handle and transmit the filled data. Most websites will just use TLS if they encrypt their traffic which can be viewed using TLS inspection if your employer uses that on your device.

Are there any risks you’re aware of with this set up? Appreciating you can’t comment on the specifics of my company. But just in general.

In my opinion, TLS inspection has both pros and cons. For security, there is a great argument to be made that TLS inspection can help protect employees. For example, a link to malware can be caught before an employee even clicks on it. But if that link is encrypted, and not visible to an employer's security appliances, then the undetected malicious link could launch an attack on that employee, device, or network.

As someone who is concerned with privacy, the announcement by an employer that they will begin to inspect all TLS traffic on work devices would likely lead me to silo my use of the device. For example, I'd use the work device strictly for work purposes but would do things like banking and checking my personal email on my own personal devices.

Your employer can likely provide more specific guidance, including information on the scope of the data that is being inspected, how long that data is stored (if it is), and who potentially has access to that data (usually a very limited group of trusted staff security specialists).

-Dave

Thanks for the questions and conversation! 🙂

-Dave