Support open source creators by offering an alternative signing route

Hello @bluedust5410! 👋

Thanks for reaching out. On macOS, the 1Password app verifies the browser’s code signature for authentication when it establishes the connection between the app and the browser extension. This authentication is designed to make it difficult for other applications and malware to intercept the account information and encryption keys that are passed through the connection. Without this authentication process, 1Password is unable to verify the app that is trying to communicate with it.

To support authentication, 1Password leverages the native security technologies that exist on the macOS platform. You can read more here:

• Notarizing macOS software before distribution | Apple Developer Documentation
• Code Signing Services | Apple Developer Documentation

I recommend reaching out to Apple regarding your feedback for how the code signing and notarization process works on macOS.

Will you consider offering an alternative signing route

Can you clarify this a little further? Are you suggesting that 1Password setup a certificate authority of some sort? Or is there an alternate signing solution that already exists that you would like to see 1Password implement in the desktop app?

-Dave

I am suggesting you create a route to get open source applications that can't afford $99 to spend on a apple developer license to work with 1password's connect to browser functionality. I am intentionally trying to leave have how you do that open.

1password in the browser is a pretty terrible experience without the connection to the app.

How most of these work is just PK encryption, and the authority maintains a CA in that case, however that was just an example. Another approach might be that people making open source browsers just submit a hash to you of the build and you check that the binary matches that has before running it, obviously as a technical approach that's a lot more of a pain than using PK encryption. There are lots of options here, and I as someone external to your company can't really recommend which would work for you. This is not a novel and interesting problem, it is well solved.

I want to point out that you do not have to use Apples notarization process to authenticate browsers, you could have chosen a method that does not disadvantage those who are less well off. They didn't make you do this, unless there is something going on here that I have missed.

@bluedust5410

Thank you for the feedback. While I can't make any promises, I've shared your comments and requests with the appropriate teams internally. I appreciate you taking the time to write in with your suggestions. 🙂

-Dave

ref: PB-40964322