Request for more technical release information

Hello @PaidUser0011! 👋

Thank you for reaching out. You can download 1Password for Mac from our website here: https://1password.com/downloads

The installer will automatically download and install the appropriate build for your system of the latest version of 1Password. I don't recommend that you install 1Password from any other source. You can verify the authenticity of 1Password using this guide: How to verify the authenticity of the 1Password app

The 1Password 8 installer is digitally signed and the macOS Gatekeeper security feature will only allow you to install 1Password 8 once it verifies that the app's digital signature is genuine and intact: App code signing process in macOS - Apple Support (CA)

The claim is that a public list of known releases helps with tracking signed binaries in the wild.

Can you tell me a little more about your specific concern regarding the 1Password website and what you mean by "signed binaries in the wild"?

I look forward to hearing from you.

-Dave

Hi Dave,

Thanks for the reply.

Regarding
"signed binaries in the wild"?

Having a list of signed binaries (specifically their sha256 checksums or equivalent) helps with zero trust auditing, especially for when things go wrong.

The security community can independently verify all production binaries of 1Password that has ever been released and detect "special builds" that aren't supposed to be released.

It is a statement an entity says to everyone - this is the only checksum for this version / architecture of 1Password, if you see any other checksum - send it to us so we can trackdown where it came from.

@PaidUser0011

Are you able to provide an example of another service that does this? If you can link to their webpage then I could share that example with the team.

It is a statement an entity says to everyone - this is the only checksum for this version / architecture of 1Password, if you see any other checksum - send it to us so we can trackdown where it came from.

As mentioned, 1Password for Mac is already code-signed and notarized. As long as a user hasn't disabled the Gatekeeper feature then they won't be able to run an unauthorized build of 1Password without dismissing the warning from Gatekeeper.

-Dave

@1P_Dave

Absolutely! I'm glad you got back to me.

Here is the requested example from KeePass; an experienced industry leader in password management (2003) 21 years and still going strong!

In this case KeePass declares to the community tracable versions for each architecture-version pariring.

This is because while signatures help verify source (such as Mac Gatekeeper), hash declarations such as SHA-256 enables zerotrust tracability.

https://keepass.info/integrity.html

KeePass-2.57-Setup.exe:
MD5: 4C1CAFC2 B3A38020 8548620A 3D53DBBA
SHA-1: A4C6AE22 0ECC6B90 7E562008 09EDAB3B CDC38B30
SHA-256: EA53F7F9 44FADA95 0CD7BB15 4DEB0781 23A357B7 BC5E2484 851762B3 552EB48B
Size: 4399360 B
Sig.: [OpenPGP ASC]

KeePass-2.56-Setup.exe:
MD5: 86A0D58D 2AE89C63 9D940DBD A48308DF
SHA-1: 1280F427 D149A8C5 CA797A9E A29E711A 3FA2B5EF
SHA-256: 92529DC0 E6449ECA 21688601 02045550 54628192 17B8E8D5 1F6E7B1D D05A69EF
Size: 4398304 B
Sig.: [OpenPGP ASC]

@1P_Dave Can you also please raise a gentle warning from me as a member of the development community?

https://www.reddit.com/r/apple/comments/1enep0a/comment/lh5q0jz

We as developers expect upmost trust in accountability and transparency regarding security products. It is disgraceful to hear the team for possibly accidental reasons, released patchnotes with missing CVE information. Do not hide anything regarding the security of your product.

To this regard, I would suggest adding SHA256 sums to all signed binaries more transparency.

Just dropping by to say I'm a bit disappointed 1Password haven't this seriously - I would really like to see an easily digestible public list of file hashes.

It's very common in security sensitive software to have a known-good hash to compare against.