Josh Calvetti ⛰Mar 7
Dare Obasanjo

The only feature of 1Password that matters is their business dies overnight if they get hacked so they’ve thought harder about security than anyone you know.

You can’t vibe code that in two evenings no matter how much you ask Claude to “make it secure”

Mar 7 at 4:42pmWeb
Show threadKevin Karhan Mar 7

@carnage4life security is hard.
I did consider DIY but besides everyone including Bruce Schneier rightfully shouting "Bad idea, m8!" it would only be a clunkier CLI version of #Passbolt at best.

Show threadCybarbieMar 7

@carnage4life You mean you hope they have thought harder about security...

fwiw historical trend is for stocks of cybersecurity firms that have been hacked to increase. 😂

Show threadctrl-k xMar 7
@nf3xn @carnage4life Guaranteed they've thought more about it than that person.
Show threadCybarbieMar 7
@snowcrashmike @carnage4life It's frustrating but people like Satya are lying to them that they are programmers now. Imagine this guy but enthusiastic amateurs everywhere just wreaking absolute havoc in a multitude of different ways. Look at this guy, the consequences of this FAFO could be Shinyhunters ransomware wiping his entire company out. #CostOfAI
Show threadctrl-k xMar 7
@nf3xn @carnage4life I don't need to imagine it in my workplace. :(
Show threadSQLAllFatherMar 7

@carnage4life

He did 70% in two nights.

It's the remaining 300% that I'd like to hear about.

Show threadAndy GatesMar 7
@SQLAllFather @carnage4life "hey chat, define a pareto problem..."
Show threadblackcoatMar 7
@SQLAllFather @carnage4life I've written 'twitter' three or four times now. It's a well structured problem that I can use as a learning exercise for a new language/framework.
I could *probably* do it in less than a week in a new language. It would not be secure, scalable, or maintainable at all, but I could put something up.
Show thread0x575446, Fifth ColumnistMar 7
@carnage4life My work would buy that. Our new venture capital overlords love them some guttertrashware.
Show threadReid Mar 7
@carnage4life Making a password manager is easy. Making it secure is much harder, and secure code is where LLMs very consistently fail.
Show threadIanMar 7
@carnage4life I friend told me his co-worker used his own vibe coded password manager. It stored passwords in plain text files, fully unencrypted, and used a bespoke storage format instead of JSON or CSV.
Show threadjordanMar 7
@soviut @carnage4life I refuse to believe any non-toy LLM designed something like that. Unless he made it with ChatGPT 3.5 or something.
Show threadIanMar 8
@wagesj45 @carnage4life According to my friend, the guy isn't a very good developer hence him being all-in on AI coding. There's a good chance he both loves AI and also loves NIH (not invented here).
Show threadMartin SchultzMar 7
@carnage4life lastpass have been hacked several times and are still alive somehow…
Show threadBrad WilsonMar 7
@mshdk @carnage4life ...and that's why I'm on self-hosted (behind the firewall) @bitwarden now, after manually rotating 100+ passwords (and deleting a few dozen accounts).
Show threadlj·rkMar 11
@mshdk @carnage4life Yup. While I know that 1P is heavily investing in security... I unfortunately also know that, from a pure business perspective, customers don't care. They buy the most utter crap.
Show threadJeremy MonatMar 7
@carnage4life 1Password encrypts even the names of your bookmarks, so even if your data is stolen both your passwords and metadata should be safe (assuming your password is strong)
Show threadNickMar 8
@jemonat Even if your password isn't that strong, 1Password uses an additional secret to produce the vault encryption key, so I think it should still be pretty safe as long as that isn't exposed. @carnage4life
Show threadJeremy MonatMar 8
@internic @carnage4life Cool, not sure I knew or remembered that. I didn’t want to lull people into a false sense of security if they used a weak password.
Show threadNickMar 8

@jemonat Yeah, they call it your "Secret Key":
https://support.1password.com/secret-key-security/

This is an extra layer of protection for the vault when it's stored on the 1password servers that helps ensure resistance to offline password cracking and also makes the strength of the password less critical. It was one of the things that made me think their security model was suitably paranoid. 😄

But, yeah, I still totally agree that people absolutely should make a strong master password! You're putting a *lot* of eggs in that basket, so you still want to make sure that only you can access it, and on your own devices only the password is required to access the vault (I believe a copy of the Secret Key encrypted with just the master password is present there). I was only meaning that the copy of the server side is a bit safer. There may also be other caveats depending on what account recovery options you have enabled.

@carnage4life

About your Secret Key | 1Password Support

Your Secret Key keeps your 1Password account safe by adding another level of security on top of your 1Password account password.

1Password
Show threadwall-eMar 7

@carnage4life I mean sure, conceptually most things these companies create are relatively basic CRUD apps.
I'm sure you can vibe code something that mimics the core business logic pretty quickly...

But that's not the hard part

Show threadtuban_muzuruMar 7

@carnage4life

One word. Yubikey . There is no substitute

Show threadTim 🛥️🌈Mar 8
@tuban_muzuru @carnage4life
No substitute? What happens if you lose it?
Show threadtuban_muzuruMar 8

@spodlife @carnage4life

That's an excellent point - get two. One's the backup.

Show threadRandom Damage 🌻Mar 7

@carnage4life https://onerep.com/blog/1password-breach-what-happened-and-how-to-stay-safe

Um, I don't think that "feature" is applicable

1Password Breach: 2023–2025 Incidents And How To Stay Safe

Discover what happened in the 1Password breaches from 2023–2025, the risks involved, and how to keep your data protected.

Onerep
Show threadRandom Damage 🌻Mar 7
@carnage4life if they lose trust, they're dead, but people want to trust them
Show threadAlex HoffmannMar 7
@carnage4life @wendynather as someone who was there for the evolution of the security design and knows the people who designed it, who pen-tested it and improved it step-by-step, I wish this person the best of luck.
Show threadDana FriedMar 7

@carnage4life I can also write a server with a database that stores passwords and a login in a couple of evenings without a robot; I would never actually put my passwords in it 🤷🏻‍♀️

This is the sort of thing I used to do for fun.

In ASP.*

* no, not ASP.NET - the original "write a whole ass website in BASIC" one**

** though I did eventually port it to PHP

Show threadDana FriedMar 7

@carnage4life and, like, I get it if you just want your computer to do something new for you and you neither have the time nor the inclination to learn to code, or to spend the time on it.

What's wild about the post is that he thinks there's any value to anyone but him there - as if he's the first guy who thought up the idea of Temu 1Password and is now going to disrupt the industry with it.

Show threadVon XylofonMar 8

@tess @carnage4life It's the same people who think they can replace an application developed by 200 people with processes and an elaborate ticketing system with an application developed by 3 engineers and a vat of coffee over 3 days. You can, until someone actually uses it for the intended purpose.

Then they start putting processes in place, start using a ticketing system, and suddenly there's a team of 200.

Show threadTomMar 7
@carnage4life why companies would want to pay that much for something they can create in two evenings ?
Show threadGavinMar 7
@carnage4life He could have just switched password managers and not made a statement that will age horribly.
Show threadOliver D. ReithmaierMar 8
@carnage4life at least one would hope so
Show threadOrca 🌻 | 🎀 | 🪁 | 🏴🏳️‍⚧️Mar 8
@carnage4life
LastPass' still there, though, after being hacked extremely bad and tried to water down the consequences.
https://www.wired.com/story/lastpass-breach-vaults-password-managers/
LastPass Data Breach: It’s Time to Ditch This Password Manager

The password manager’s most recent data breach is so concerning, users need to take immediate steps to protect themselves.

WIRED
Show threadpatsplatMar 8
@carnage4life not to mention, if you don't care about security, one can replace 1password just by opening https://sheets.new
Show threadx0Mar 8
@carnage4life Would you mind adding alt text to this image, please?