More magic than a mere Twitter bio can contain 
Michael Tsai
1Password’s Cleartext IPC: http://mjtsai.com/blog/2016/03/02/1passwords-cleartext-ipc/ … #mjtsaiblog
-
@mjtsai I'm just surprised they're using TCP, since local IPC mechanisms provide access to peer user/process credentials.
Landon Fuller
Gwynne Raskind
@landonfuller @mjtsai If I had to wager an uneducated guess, possibly browser plugins can’t use all the good APIs (for security, ironically)
-
-
@ameaijou@landonfuller That is my understanding as well. -
@mjtsai@ameaijou Looks like there are options: https://developer.chrome.com/extensions/nativeMessaging … && https://developer.apple.com/library/safari/documentation/Tools/Conceptual/SafariExtensionGuide/CommunicatingwithyourOSXApplication/CommunicatingwithyourOSXApplication.html#//apple_ref/doc/uid/TP40009977-CH23-SW4 … &&https://developer.mozilla.org/en-US/docs/Mozilla/js-ctypes/js-ctypes_reference … -
@landonfuller@mjtsai But now you’ve wiped out _any_ hope of using common code across browsers, much less platforms. - View other replies
-
-
@landonfuller@mjtsai In theory, agreed. In practice, 1Password has to security-check all of their code heavily. More platform support (1/N) -
@landonfuller@mjtsai means more code to review and more chance for mistakes. Given that you can’t eavesdrop on loopback without root (2/N) - View other replies
-
@landonfuller@mjtsai anyway, I think it’s a reasonable compromise for the sake of less code to maintain (and the solutions you linked (3/N) -
@landonfuller@mjtsai , while correct, involve a good bit of complexity of deployment. Might well be something they’re planning to do (4/5) - Show more
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.