Dare ObasanjoMar 7

The only feature of 1Password that matters is their business dies overnight if they get hacked so they’ve thought harder about security than anyone you know.

You can’t vibe code that in two evenings no matter how much you ask Claude to “make it secure”

Show threadJeremy MonatMar 7
@carnage4life 1Password encrypts even the names of your bookmarks, so even if your data is stolen both your passwords and metadata should be safe (assuming your password is strong)
Show threadNick
@jemonat Even if your password isn't that strong, 1Password uses an additional secret to produce the vault encryption key, so I think it should still be pretty safe as long as that isn't exposed. @carnage4life
Mar 8 at 1:28amWeb
Show threadJeremy MonatMar 8
@internic @carnage4life Cool, not sure I knew or remembered that. I didn’t want to lull people into a false sense of security if they used a weak password.
Show threadNickMar 8

@jemonat Yeah, they call it your "Secret Key":
https://support.1password.com/secret-key-security/

This is an extra layer of protection for the vault when it's stored on the 1password servers that helps ensure resistance to offline password cracking and also makes the strength of the password less critical. It was one of the things that made me think their security model was suitably paranoid. 😄

But, yeah, I still totally agree that people absolutely should make a strong master password! You're putting a *lot* of eggs in that basket, so you still want to make sure that only you can access it, and on your own devices only the password is required to access the vault (I believe a copy of the Secret Key encrypted with just the master password is present there). I was only meaning that the copy of the server side is a bit safer. There may also be other caveats depending on what account recovery options you have enabled.

@carnage4life

About your Secret Key | 1Password Support

Your Secret Key keeps your 1Password account safe by adding another level of security on top of your 1Password account password.

1Password