Skip to main content

1Password iOS app

See All Stories

PSA: Beware 1Password web features can leak your browsing history, may show up in Google search

1password

AgileBits has promised to beef up the security of 1Password after a Microsoft software engineer discovered that details of which websites you visit are unencrypted and indexed by Google if you use the 1PasswordAnywhere feature. Dale Myers said that he discovered this by chance after a sync problem led him to investigate the files used to store the metadata.

It turns out that your metadata isn’t encrypted [allowing someone to] go through and find out exactly what shady sites I have accounts on, what software I have licences for, the bank card and accounts I hold, the titles of any secure notes I have, any anything else I’ve decided to store in there.

While passwords remain secure, privacy is placed at risk and the data obtained could, says Myers, be used in a phishing attempt.

Thanks to people having links for easy access to their keychain on their websites, Google has indexed some of these. A simple search brings up results. By looking at one of these it was a simple matter to identify the owner of the keychain and where he lived. I know what his job is. I even know the names of his wife and children. If I was malicious, it would be easy to convince someone that I had compromised their account and had access to all of their credentials.

AgileBits said that the decision not to encrypt metadata was taken back in 2008, when decryption on mobile devices involved significant performance and battery-drain issues, and that it introduced a secure file format in 2012, but that it didn’t want to break compatibility with older versions by making that format the default.

The company said that work on making the secure file format the default was already in hand.

We’ve already started making changes to use OPVault as the default format. In fact, the latest beta of 1Password for Windows does this already. Similar changes are coming to Mac and iOS soon, and we’re planning on using the new format in Android in the future. Once all of these things are complete, we will add an automatic migration for all 1Password users.

For those who don’t want to wait, the company has posted instructions for manually migrating to the new format.

The 1Password iOS app was updated last month with a new design, new password-generation features and iOS 9 features. If you’re not yet using a password manager, check out our how-to guide.

Via Engadget

9to5Toys Last Call: iPad Air 2 Wi-Fi 16GB $400, SanDisk 128GB USB2 flash drive $28, 1Password for Mac $35, more

Keep up with the best gear and deals on the web by signing up for the 9to5Toys Newsletter. Also, be sure to check us out on: TwitterRSS FeedFacebookGoogle+ and Safari push notifications.

Today’s can’t miss deals:

Last Call Updates:

apple-ipad-air-2

ipad-air-deal-9to5toys

Daily Deals: iPad Air 128GB Wi-Fi + LTE $530, Logitech iPad Air Bluetooth keyboard case $25, more

sandisk-cruzer-128gb-flash-drive1

Amazon Gold Box – SanDisk storage up to 40% off: 128GB USB 2.0 flash drive $28, 64GB microSDXC $25, more

1password-devices

1Password 5 for Mac is on sale for $35 (Reg. $50) – stop using weak passwords right now

catch-the-throne-2-itunes-banner

Get ready for Game of Thrones season 5 w/ free iTunes music from Method Man, many more

iTunes HD movie downloads: Divergent $4 (Reg. $20), Ghostbusters $5 (Reg. $13)

carved-live-edge-iphone-case

Small States Review: Carved’s Live Edge iPhone 6 cases ensconce your device in one-of-a-kind raw wood, multiple giveaways

More new gear from today:

omaker-huge-battery-sale

Big USB battery/flashlight combos: Omaker 15,600mAh: $25, Power Vault 18000mAh: $30 shipped

More deals still alive:parallels-1password-mac-bundle

Mac app bundle w/ Parallels 10, 1Password 5 and more for $80 ($270 value)

airport-extreme-macbook-air

iTunes Free App of the Week: 8bit Doves ($3 value)

13-inch Retina MacBook Pro (Mid-2014) 2.6GHz/8GB/128GB $1,060 (orig. $1,299), more

Apple extends deeper discounts to its refurbished store: AirPort Extreme $129, 13″ MacBook Air from $719, more

Apple laptops up to 25% off: MacBook Air from $750 w/ .edu, Pro w/ Retina display from $1,100 w/ .edu

Updated Apple TV pricing gets passed down as players refurbished by Apple hit a new low of $59

New products & more:

atlas-wearables-watch1

The Atlas Wristband can discern between different fitness activities