Security concerns about 1password 8 for windows

Hi sj0123, thank you for this thoughtful response - and we do appreciate these suggestions.

This could be a pretty deep discussion, but for now I'll just say that your points are well-appreciated, and that protections against local attacks or insecurities are something we do put in place - for example, clipboard management, memory protections, code signature validation, and so on. When it comes to the Secret Key and why it can't be encrypted, you and 1P_Ben have already well covered that ground.

As I said in the first post, dedicated security chips such as TPM chips, secure enclave for IPhones, and arm trustzone technology, would be a great solution to achieve this as these chips run seperately from the main operating system and gaining access to protected data is extremely difficult, given that the user maintains a secure environment on there systems.

This is definitely something we're interested in. While I can't share much about forthcoming (hypothetical) features, this is definitely an area where we see some potential - both for security and convenience - and we'll hope that our future efforts here will delight you!

I should note as well that 1Password, even without using Windows Hello to unlock, still scores as very secure by most risk analyses. There's no such thing as "total security", and our security folks can speak more to the details of potential endpoint compromise scenarios, but I thought we should make sure to mention that. 👍

Thank you so much for your answer. I fully understand the fact that it isn’t possible to encrypt the secret key and it is possible for an attacker to gain access to stored secret key once he gets access to my computer. However, what I’m saying is that it should be as hard as possible for attackers to retrieve actual keys from a computer(not only the secret key, any information that might be stored in local devices which, if exposed, can be used in cracking attempts.
As I said in the first post, dedicated security chips such as TPM chips, secure enclave for IPhones, and arm trustzone technology, would be a great solution to achieve this as these chips run seperately from the main operating system and gaining access to protected data is extremely difficult, given that the user maintains a secure environment on there systems.
This also would make it possible to unlock 1password with faster methods, such as windows hello across reboots which isn't implemented yet.
This was more of a suggesstion. even if it isn't possible, I understand that, but I really hope I can unlock 1password using windows hello across reboots or process terminations, and 1password being more secure in general.
Thank you.

Hi sj0123

You are correct: there are minimal protections applied for the Secret Key on your computer. The Secret Key isn't intended to be secret within your system. It is intended to protect the encrypted data that is stored on our servers. The account password is what protects the data on your computer. We cover this in our about your Secret Key guide:

Your 1Password account password protects your data on your devices. Someone who has access to your devices or backups won’t be able to unlock 1Password without your account password, which only you know.
Your Secret Key protects your data off your devices. Someone who attempts a brute-force attack on our servers won’t be able to decrypt your data without your Secret Key, which we never have.

We also talk in more depth about this in the white paper under the "Malicious processes on your devices" heading ("Locally exposed Secret Keys" sub-heading), which as of writing is on page 74:

Because the Secret Key must be used to derive the user’s AUK it cannot be encrypted by the same AUK or by any key that is directly or indirectly encrypted with the AUK. Depending on client and client platform the Secret Key may be stored on the device using some of the protections offered by the operating system and may be lightly obfuscated. However, it should be assumed that an attacker who gains read access to the user’s disk will acquire the Secret Key

And there is a relevant footnote:

We are deliberately vague about this, as practice may change rapidly from version to version, including different behaviors on different operating system versions

As for your last question:

Also, it would be great to see the whitepaper about how 1password protects locally stored data and it's memory.

Agreed; documenting this is a work in progress. I hope these answers are helpful. :)

Ben