Forum Discussion

antoinejdd's avatar
antoinejdd
New Member
10 hours ago

Enable DNSSEC

1Password domain names are not signed with DNSSEC (at least 1password.com and 1password.eu). Customers are therefore potentially vulnerable to MITM attack. This means that when attempting to access t...
1password.com
feature request
1P_Dave's avatar
1P_Dave
Icon for Moderator rankModerator
3 hours ago

Hello antoinejdd​! 👋

Thanks for bringing this up! Our security white paper touches on this topic on page 52 under Transport Security- TLS: 

Neither certificate pinning nor DNSSec have been implemented. Given the mutual authentication described in "A modern approach to authentication", the marginal gain in security provided by such measures is not something we consider to be worth the risk of loss of availability should those extra measures fail in some way.

Regarding any other concerns, please send an email to support@1Password.com so that the relevant team can take a look and address your concerns directly. 

-Dave