+ 8 Password Manager Options for Mac and iOS Posted on September 27th, 2012 by and Passwords are like undergarments: it’s good to keep them hidden, and you should change them often. Likewise, if someone sees your password it may leave you feeling exposed and uncomfortable. As we mentioned in our post, it's important to create complex, unique passwords so they're more difficult to crack. Unfortunately, the more complicated your passwords, the easier they are to forget.
Jul 15, 2012 - How to Password Protect Files or Folders On Your Mac. Pro for Your Home Projects TodayDownload on Google Play HomeAdvisor App . Folder Password Lock Pro, free and safe download. Folder Password Lock Pro latest version: Software for Enhanced Folder Protection and Privacy.
How do you securely keep track of all your different passwords? With a password manager, of course!
There's a lot more to love about password managers than not having to remember so many passwords. The blog linked above (“Even 1Password doesn’t measure up to LastPass on security features alone”) appears to base its entire security claim on the use of multi-factor in LastPass. It’s kindof an apples-to-oranges comparison, though, because 1Password data (stored locally) does not require “authentication”, but “decryption” as explained at the last subheading here: (1Password users should wait a bit before trying Dropbox’s two-step verification). LastPass is not authenticating you in order to unlock your encrypted blob, it is authenticating you in order to decide whether you can retrieve the blob from the remote server where it is stored. Both systems perform the actual decryption of the keystore on your local machine, and the security of that is controlled entirely by the security of your passphrase.
Also, while the linked article is over a year old (and so maybe LastPass has caught up by now), it does note that 1Password employs PBKDF2 and LastPass doesn’t. I’d rather have the security of PBKDF2 effectively preventing brute-force attacks against my keystore, than the orthogonal and irrelevant “protection” that 2-factor auth with LastPass offers. As Tommy Knowlton mentioned, 1Password technically doesn’t even perform “one-factor” authentication since it is an.encryption. app. 🙂 Multistep authentication has clear and obvious security benefits. So it is more than natural for people to ask why 1Password doesn’t employ it. We’re planning to write a more detailed explanation of our developing thoughts on it, but let’s discuss the difference between authentication and decryption.
When you connect to some service, like Dropbox, you or your system has to prove that it really has the rights to log in as you. That process is called “authentication”. It is the process of proving to the Dropbox servers in this case that you are really you. You can do this through a username and password; you can do this through a username, password, and code sent to your phone; you can do this by having a particular “token” stored on your computer. Authentication always involves (at least) two parties talking to each other. One party (the client) is under your control; the other (the server) is under someone else’s control.
1Password, however, involves the 1Password application (under your control) talking to your 1Password data (under your control) on your local disk (again, under your control). This is not an authentication process. So 1Password doesn’t even do one-step authentication. It does no authentication at all. 1Password doesn’t gain its security through an authentication process.
Folder Password App Mac
Instead the security is through encryption. Your data on your disk is encrypted. To decrypt it you need your 1Password master password. There are great advantages to this design: Your data and your decryption of it doesn’t require our participation in any way once you have 1Password.
Your data is yours. Even if AgileBits were to get abducted by aliens tomorrow, you would still have access to your data since we never store it on our servers. However, one disadvantage of this design is that the kinds of techniques used for multi-step authentication are entirely inapplicable to 1Password. Those techniques are designed to add requirements to an.authentication. process, but unlocking your 1Password data is.not an authentication process at all.
Because there is no 1Password “server”, there are no (additional) steps we can insist on as part of a (non-existent) login process. 1Password is decrypting data stored locally on your system, it is not authenticating against some service. So in truth, we don’t even have 1 factor authentication, as there is no authentication in the first place. So typical approaches to MFA won’t work. However that doesn’t mean that it is impossible for us to do something that.looks like MFA. There are roughly two approaches (each simpler than PKI). One of them is key splitting.
That is the result of processing your Master Password doesn’t actually get you a working key to decrypt further, instead that result would need to be XORed with another 128-bit key. So it is simply a case of storing that other “half” of the key on some other device.
1Password would need to be able to read that device, which may be tricky on iOS, but it isn’t insoluble. The other approach would be to move the keyfile. 1Password (on the desktop) has a file called encryptionKey.js.
That file contains an encrypted key, which is what gets decrypted by the key derived from your master password. That file (and some backups of it) are part of your 1Password.agilekeychian (which is actually a folder bundle, which looks like a single file on the Mac). It would be possible for us to allow that file (and its backups) to reside on some device or location. Both that file and the Master Password are required to get any further. We are more inclined to do key splitting rather than having a movable keyfile. The real technical difficulty is getting this to work on every platform.
Again, because this is all about data decryption and.not authentication., we can’t just implement this on one platform (if it were to be anything other than just for show). So while this isn’t insurmountable it means that even the “simple” approaches that I described would be tricky. But the real reasons that we haven’t put in substantial effort in that direction is because for every case where someone reports that their computer or device has been stolen, we get probably a hundred more of “I forgot my Master Password” or “I damaged my data and didn’t have usable backups”.
My fear is that key splitting or keyfile moving wouldn’t just double the rate of people getting locked out, but would increase it much more. The threat of data lose becomes very substantial. Again, because we aren’t running a system that people authenticate against, there is nothing we can do the help people recover their data if they damage a key or forget their Master Passwords.
Now of course we could make it an advanced option with lots of warnings, but we know that people will always dial up security settings to 11 whether it is in their interest or not. Remember that 1Password is a mass market product. It’s great that security geeks use and respect it, but we don’t want to give our users rope to hang themselves with.
I’m just spelling out why, to date, we have resisted calls for MFA. It’s harder to get right for a decryption system than for an authentication system, and we think that it might do more harm than good. None of this is written in stone. The threat landscape, patterns of usage, and device capabilities change. So while there are no immediate plans add this, we are leaving the door open in the design of our new data format. Khad Young, AgileBits,. Disclosure: I work for AgileBits, the makers of 1Password.
You are absolutely correct that there is growing demand and need for things like multi-factor authentication for password managers, and this is something that 1Password doesn’t provide. But I find it odd that you wrote, “It’s not clear why, but 1Password does not support multi-factor authentication.” There are reasons for this described in our blog, but the main summary is that unlocking your 1Password data isn’t an authentication process; instead it is a decryption process. So we don’t really even do “single factor auth”, as authentication just isn’t part of the process. Thus the usual methods for adding a second factor are not applicable. This is because you never go through any service/server of ours to get at your data; so there is no “extra” gate we can add to getting authorized by some service of ours.
Also because a user is decrypting data stored locally, many of the threats that MFA defends against aren’t threats to 1Password data. When you authenticate to a service, you may be doing so over an insecure network or even from a computer that you can’t trust. Those situations don’t arise nearly as much with 1Password’s design of just decrypting local data. Of course, those details may not matter to ordinary users, but this is exactly why many users must rely on expert evaluation.
Anyway the analogue for multi-factor auth when using decryption instead of authentication is “key splitting”. That is the Master Password would need to be combined with some decryption key that is stored separately (say a USB device) to derive the actual key that is used to unlock the 1Password data. I won’t repeat why we haven’t moved on this (yet), but it is something that is under consideration. Basically we need to find a way to do this that won’t lead to unacceptable rates of people losing access to their data. Unlike authentication where tokens can be reset server side, if someone loses or damages this second factor there is absolutely no way to ever unlock the data again.
I also found it odd when you said, “But for its price, it better focus heavily on security in addition to looking great on Macs, right?” Just because 1Password is beautiful don’t imagine that it doesn’t have brains. In evaluating the security of password managers, it is important to look at the actual design of the system carefully. It’s not simply a list of user visible security features. Everyone uses AES, so listing it as a “security” feature of some password managers while omitting it from others can be confusing for readers. From a security perspective questions like what encryption modes are used with AES or how initialization vectors are generated is often far more important that issues of key size.
(This is, everyone uses AES, but it is in these other sorts of design questions where people make mistakes.) There are many other issues as well. There are issues of how much data is ever decrypted at any one time, or key derivation, or source of entropy for initialization vectors, and so on. To suggest that 1Password is “less secure” because it doesn’t do MFA is, I think, a disservice to your readers, particularly if you didn’t consider so many other things that go into data security. If you do a proper evaluation of the security of password managers, it will certainly be possible to find fault with 1Password (and the others). Indeed, there are a number of substantial changes that need to be made in our data format design. We’ve fully acknowledged those and are preparing a new data design. But despite those, I’m confident that 1Password will come out well in any systematic and proper analysis of the security of password mangers We are all working to help Mac users remain secure.
There will be times (like this) when we (at AgileBits) disagree with you (at Intego) on some things. But I know that personally, I will continue to direct people here for great news and explanations about Mac security. Cheers, -j. So, is Intego vouching for these apps? Have they been fully vetted from a security standpoint? Right off the bat I see some issues – Wallet by Acrylic Software has ceased development according to their website.
SplashID has been around for many years yet it was only recently discovered that the password protection was basically non-existant, as it apparently relied on a universal key that was hard coded into the app! Apparently, that issue has been fixed, but it goes to show that just because an app throws terms around like AES, security, military grade encryption, that there are lots of potential mistakes that can be made resulting in an insecure password manager.