Forum Discussion

antoinejdd's avatar
antoinejdd
New Member
8 hours ago

Enable DNSSEC

1Password domain names are not signed with DNSSEC (at least 1password.com and 1password.eu). Customers are therefore potentially vulnerable to MITM attack. This means that when attempting to access the password manager's online services, an attacker could falsify DNS resolution responses and redirect the client to a fake server.

https://internet.nl/site/my.1password.com/3801661

https://internet.nl/site/my.1password.eu/3801663

In addition to the absence of DNSSEC, these links will inform you that certain best practices are missing from your web server configuration.

1password.com
feature request

1 Reply

  • 1P_Dave's avatar
    1P_Dave
    Icon for Moderator rankModerator
    1 hour ago

    Hello antoinejdd​! 👋

    Thanks for bringing this up! Our security white paper touches on this topic on page 52 under Transport Security- TLS: 

    Neither certificate pinning nor DNSSec have been implemented. Given the mutual authentication described in "A modern approach to authentication", the marginal gain in security provided by such measures is not something we consider to be worth the risk of loss of availability should those extra measures fail in some way.

    Regarding any other concerns, please send an email to support@1Password.com so that the relevant team can take a look and address your concerns directly. 

    -Dave