Pedro Canahuati, chief technology officer of the hugely popular password management platform 1Password, has published confirmation of a security incident. The October 23 posting states that suspicious activity was detected on a system that manages employee-facing applications. This does not mean that 1Password has been hacked, nor does it mean your passwords are at risk of exposure. Indeed, Canahuati makes it clear that “no 1Password user data was accessed.”
The 1Password Security Incident Explained
Although the statement from Canahuati was short, there is enough detail contained to know that this incident relates to suspicious activity on an Okta system used to manage access to employee applications. The activity was detected on September 29, at which point it was terminated immediately and an investigation began. This found “no compromise of user data or other sensitive systems.”
The investigation continued and as of October 20 was able to confirm that the initial compromise vector was a breach of Okta’s support system. This breach involved “adversarial activity that leveraged access to a stolen credential to access Okta’s support case management system,” according to a statement by Okta’s chief security officer, David Bradbury.
How Secure Are Your Passwords With 1Password?
Canahuati says that the 1Password systems and policies were “able to identify and terminate this attack, and we are continuously enhancing our security measures to keep you and your data safe.” Beyond the ‘we take your security seriously’ response that is standard fare following any incident disclosure these days, 1Password does actually have some impressive technology behind the claims.
Beyond the use of end-to-end encryption for data in transit, the 256-bit AES data encryption, the cryptographically secure pseudorandom number generators used for encryption keys, initialization vectors and nonces, key derivation strengthening to make it even harder to brute force a master password, there’s the secret key.
Data in a 1Password account has this additional layer of protection through a 128-bit secret key that must be used in conjunction with your master password to decrypt anything. This is created using your own device and is not known to 1Password.
Think of your master password as protecting your password vault on your device, meaning someone with physical access to it would need to know it to access your passwords. The secret key does a similar thing but with regards to data stored on 1Password servers. If an attacker brute-forces those servers, they still won’t be able to decrypt your password data unless they have the secret key, which 1Password doesn’t have.
In other words, your 1Password passwords are safe.
I reached out to 1Password for a statement but had not heard back at the time of publication.
Read the full article here
