Craig HockenberryMar 6, 2024

EXTREME HEADS UP

I just go phished on my 1Password account from an email talking about unconfirmed users. Clicked a link to:

httpx://mkt-lnk.1password.co/n/

And it's on a Family Account that's managed by my wife who's currently in Kuwait.

FUCK!

/cc @1password

Show threadCraig HockenberryMar 6, 2024
Related: https://www.troyhunt.com/thanks-fedex-this-is-why-we-keep-getting-phished/
Thanks FedEx, This is Why we Keep Getting Phished

I've been getting a lot of those "your parcel couldn't be delivered" phishing attacks lately and if you're a human with a phone, you probably have been too. Just as a brief reminder, they look like this: These get through all the technical controls that exist at my telco and

Troy Hunt
Show threadCraig HockenberryMar 6, 2024

So the “phishing link" with the .co domain was a valid link and documented as such:

https://support.1password.com/email-domains/

But I still find it inexcusable.

That link caused 30 minutes of complete panic. I know enough about how phishing works to know how absolutely fucked I'd be if that link hadn’t just been to track my click in the email.

I am just now starting to recover from the episode.

1Password email and marketing domains

Learn which domains 1Password uses to send emails and what links are used for marketing, so you can validate messages you receive and make sure they're not marked as spam.

1Password
Show threadFelix Krause
@chockenberry 1Password really speed-running losing all the trust they’ve build up over a century
Mar 8, 2024 at 12:30pmIvory for iOS
Show threadJonathan WillingMar 8, 2024

@KrauseFx @chockenberry What’s the best alternative these days?

I’ve used 1P for what seems like forever, but I’ve about reached my limit.

Show threadFelix KrauseMar 8, 2024
@willing I don't know, but will also soon need to switch
Show threadColin WheelerMar 8, 2024
@KrauseFx @willing I switched from 1P to Bitwarden which has a decently generous free tier, though I pay a tiny bit for TOTP/Security key support, only thing it’s lacking is passkey support on iOS which is due any day now. Apples built in Password manager is also pretty good and should be sufficient to hold you over until you figure out what you want to go with.
Show threadCraig HockenberryMar 8, 2024

@willing @KrauseFx iCloud Keychain is pretty great now that you can share passwords with another Apple ID. No storage for secrets like Passport numbers and such - but you can easily put that stuff in secure notes.

https://simonbs.dev/posts/moving-from-1password-to-icloud-keychain/

Moving from 1Password to iCloud Keychain

Here's how to easily move your passwords from 1Password to iCloud Keychain

Simon B. Støvring
Show threadJonathan WillingMar 8, 2024
@chockenberry @KrauseFx Thanks for the rec. I’ll have to consider it. With that said, I’ve had enough data loss/corruption in the past with iCloud that my confidence in it is at an all time low.
Show threadCraig HockenberryMar 8, 2024
@KrauseFx It's race between them and Dropbox.