A critical security issue in 1Password for Mac left credentials vulnerable to attack

AppleInsider

1Password has disclosed a now patched critical security flaw in its software that could give attackers access to users' unlock keys and credentials. Here's what to do to keep your data safe.

1Password has disclosed a critical security flaw present in older versions of its popular password manager

In a security post, 1Password has revealed the exact details of the vulnerability, and which application versions are susceptible to attacks.

According to the company, all versions of 1Password for Mac before version 8.10.36 (July 2024) are vulnerable to the exploit. Thankfully, the issue can be resolved with relative ease by updating the 1Password application to version 8.10.36, which has already been made available.

There are currently no indications that the exploit has been used in the wild. The issue was discovered during an independent security assessment of the app by the Red Robinhood team, after which it was reported to 1Password.

Even so, the previously-mentioned security post recommends that users update their 1Password app if they are still using an affected version, which is any version of 1Password for Mac before 8.10.36.

1Password has also explained in detail how the exploit works:

An issue has been identified in 1Password for Mac that affects the app's platform security protections. This issue enables a malicious process running locally on a machine to bypass inter-process communication protections.

To exploit the issue, an attacker must run malicious software on a computer specifically targeting 1Password for Mac. An attacker is able to misuse missing macOS-specific inter-process validations to hijack or impersonate a trusted 1Password integration such as the 1Password browser extension or CLI. This would permit the malicious software to exfiltrate vault items, as well as obtain derived values used to sign in to 1Password, specifically the account unlock key and "SRP-x."

As mentioned earlier, the vulnerability can be patched by updating the 1Password for Mac application to version 8.10.36, as is recommended by the company.



Read on AppleInsider

CaptainQ

sadly... a lot of people are still using the V7 because they do not want to pay a subscription, will it be patched?

prof

CaptainQ said:

sadly... a lot of people are still using the V7 because they do not want to pay a subscription, will it be patched?

Pretty much certainly not. Having said that, that vulnerability is a godsend, my better half unexpectedly passed away and I could really use access to her 1password vault... Any idea where to find an exploit?

CaptainQ

prof said:

CaptainQ said:

sadly... a lot of people are still using the V7 because they do not want to pay a subscription, will it be patched?

Pretty much certainly not. Having said that, that vulnerability is a godsend, my better half unexpectedly passed away and I could really use access to her 1password vault... Any idea where to find an exploit?

Depends on where you live, but even if the person died, it might still be illegal to do so if it wasn't explicitly mentionned in the wishes. 

Xed

AppleInsider said:

In a security post, 1Password has revealed the exact details of the vulnerability, and which application versions are susceptible to attacks.

According to the company, all versions of 1Password for Mac before version 8.10.36 (July 2024) are vulnerable to the exploit. Thankfully, the issue can be resolved with relative ease by updating the 1Password application to version 8.10.36, which has already been made available.

According to this company, this only affects iPassword 8 for Mac. That is an important distinction over the AI article. As someone who is still on version 9 because of all the missing features and wonky way of working in version 8 you had me scared that I was going to need to make a choice between security or utility. In that case I'm probably going to switch to a different solution because 1Password 8 for Mac sucks balls.

tenfingers

They had one job. They have been too focused on extracting more money out of users. I’m really hoping the new Apple password manager removes any need for a 3rd party app. 

prof

I've started to switch from 1Password/Dropbox to Bitwarden with a selfhosted server. The latter is a lot clunkier and way less refined, even the 1Password data import is total shite, but at least I've regained full control over the solution.

Xed

prof said:

I've started to switch from 1Password/Dropbox to Bitwarden with a selfhosted server. The latter is a lot clunkier and way less refined, even the 1Password data import is total shite, but at least I've regained full control over the solution.

This notion that 1Password no longer allows you to sync in the ways you had previously comes up every time 1Password is mentioned. Is simply offering an optional subscription really that offensive to people? I now use it because of the added benefit of being able to share certain vaults with the dozen people on my Family Plan for $1 per month per user, but, again, that's an option. I also use one of the "old" ways shown below for my personal vault.

So why did you choose to move from a self-hosted server with 1Password to a self-hosted server with Bitwarden?

Xed

tenfingers said:

They had one job. They have been too focused on extracting more money out of users. I’m really hoping the new Apple password manager removes any need for a 3rd party app. 

If you're used to a robot password manager then Apple's solution doesn't cut it. It does have a basic password suggestion and at least orders an OTP field, but that's it. It also has a basic feature to detect weak passwords but it's not in the same ballpark as 1Password's Watchtower feature.

It's certainly nicer than Keychain for the average user, but that's about it for benefits at this stage.

dewme

Hopefully Apple’s upcoming password vault will be easier to use than Keychain. I personally like 1Password and the subscription fee does not bother me at all. It’s kind of like seeking out someone to repair your car or system in your home or finding a doctor to perform a medical procedure. Finding the cheapest service provider for anything you consider critical may not be the wisest approach. 

That said, even when you pick who or what you believe to be the best with little regard to price, failure can still occur. 

This is why any software vendor’s claims of “never been hacked” always needs to be viewed as a statement of intent and not a statement of fact. As someone who’s been involved with software development for a long time I always add “yet” to any such claims, even with Apple. 

Xed

dewme said:

Hopefully Apple’s upcoming password vault will be easier to use than Keychain. I personally like 1Password and the subscription fee does not bother me at all. It’s kind of like seeking out someone to repair your car or system in your home or finding a doctor to perform a medical procedure. Finding the cheapest service provider for anything you consider critical may not be the wisest approach. 

That said, even when you pick who or what you believe to be the best with little regard to price, failure can still occur. 

This is why any software vendor’s claims of “never been hacked” always needs to be viewed as a statement of intent and not a statement of fact. As someone who’s been involved with software development for a long time I always add “yet” to any such claims, even with Apple. 

1) It's much easier and nicer. You don't have all those certificates and keys — which is something I've never had to mess with in my decades of using a Mac. It looks like it was borne out of the Reminders app. I think it'll be fine for man users that find Keychain too daunting -and- find 3rd-party solutions too confusing. Personally, if it gets one person to start saving their credentials and start using random and unique passwords then it's a win.

2) I do like that it includes your WiFi passwords and SSIDs, but I've never had a problem with how those are stored in Network Settings.

3) I just noticed that there is a Share option. I wonder if that will dynamically update passwords and allow for read-only, edit, and owner modes for the info.

xyzzy-xxx

I am using Safe+ which has no subscriptions, offers Wi-Fi sync and supports offline passwords / pins for ATMs etc.

PopeAlchemyIV

1Password has always been rock solid for me. No complaints. Like anything else, it takes a little work to set it up and organize it. 

prof

This notion that 1Password no longer allows you to sync in the ways you had previously comes up every time 1Password is mentioned. Is simply offering an optional subscription really that offensive to people? I now use it because of the added benefit of being able to share certain vaults with the dozen people on my Family Plan for $1 per month per user, but, again, that's an option. I also use one of the "old" ways shown below for my personal vault.

So why did you choose to move from a self-hosted server with 1Password to a self-hosted server with Bitwarden?

Two reasons:

1. I don't trust cloud services. Privacy is not a problem in this particular case (probably), but reliability and long time availability is always a concern. I've been bitten by this so many times that I avoid "cloud" offerings like the pest.
2. I don't like subscriptions for life essential things. Even if I go broke or die or the operator of the service ceases to exist or gets the Google treatment, life has to go on without me (or someone else) having to scramble to find suitable replacement for many people and devices.

1Password has been really hostile to the non-cloud/subscription approach. I've been a strong supporter since version 2 (or 3) and bought each version for the whole family; I have absolutely no problem forking out some dough, one-time, to get a decent product which works for many years to come. But then came the "no standalone vaults" policy for mac with 1Password 7 and the huge kerfuffle on pulling the old app from the app store and not allowing to use standalone vaults in the new version on iOS (which they back-paddled later a bit) which really annoyed the heck out of me. On Mac I was stuck with 1Password 6 which became really annoying with its inefficiency on ARM and dropping browser support.

Ever since 1Password 7 I've been looking for a replacement and I've decided to real life test Bitwarden a few weeks ago.

Don't get me wrong. Even 1Password 6 is a much better product than Bitwarden is today, the user interface of the latter on Mac is utter shite -- it's really just about bearable; the iOS version is a lot more usable but still lacking in features. 1Password quite literally forced me to quit them with the unacceptable cloud and subscription policy and if they ever decide to reverse course and offer standalone usable versions again, I'll be first in line to buy them.

prof

dewme said:

That said, even when you pick who or what you believe to be the best with little regard to price, failure can still occur. 

This is why any software vendor’s claims of “never been hacked” always needs to be viewed as a statement of intent and not a statement of fact. As someone who’s been involved with software development for a long time I always add “yet” to any such claims, even with Apple. 

Cost is not the main issue, I want freedom of choice and more importantly control. 1Password forces a subscription and a cloud service on me and I like neither. A password manager is not like Netflix where you pay your subscription just to consume random stuff on the fly; passwords are life essential, if the service was shuttered or broken into and the data lost, I'd be seriously fscked! I have been bitten by this many times already, albeit not with quite as critical services and commodities, so I'm super aware of what's at stake here.

I totally believe and trust that 1Password has the expertise (unlike other services) to keep the data secure and private (in fact, too strong security is kind of an issue in itself currently with my deceased partner), but I don't have any trust in data safety (loss and corruption) as well as operations contingency of some random cloud service. I do trust my own capabilities, however, to host my own services and data and keep the show running until I kick the bucket (and some time beyond that); is the whole system inpenetrable? Nah, certainly not, but it'll be a good challenge for anyone just to get behind the first line of defence...