Educational: TypeScript implementation of 1Password's security model + interactive explainer

Hi all!

Not sure if this fits here, but since this concerns a TypeScript library I wrote, the 'developer' category seemed appropriate.

--

I recently dove into the 1Password white paper and built a TypeScript library that implements the security model it describes. This was a purely educational exercise for me to gain a deeper grasp on how password managers, and 1Password in particular, work. I'm a web developer, not a cryptographer or security expert, so please don't use it in production or trust it with real credentials. I'm also not affiliated with 1Password or AgileBits, though they did greenlight publication of the library, which I really appreciate.

I verified the implementation is fully compatible with real vault data by testing against actual API responses from the official web application, which I think proves I actually learned something :) and that the white paper is very complete and pretty digestible.

After finishing the library, I built an interactive explainer[1] based on it, that walks through the security model step-by-step, hoping others might learn from it as well.

The library is open source[2], and I've written a blog post[3] giving some more context.

I'd love to hear any feedback on claims, terminologies, or other issues I got wrong, suggestions for improvement, whatever you've got.

Thanks again to the 1Password team for publishing their excellent white paper, which enabled this learning opportunity!

Cheers,

Ely

[1] https://passwords.lgtm.it
[2] https://github.com/edeckers/lib1password-unofficial
[3] https://medium.branie.it/stopping-bad-actors-inside-1passwords-security-model-8c65c6acb9ff