Michael Tsai
Landon Fuller
@mjtsai I'm just surprised they're using TCP, since local IPC mechanisms provide access to peer user/process credentials.
1Password’s Cleartext IPC: http://mjtsai.com/blog/2016/03/02/1passwords-cleartext-ipc/ … #mjtsaiblog
-
-
- View other replies
-
@landonfuller@mjtsai If I had to wager an uneducated guess, possibly browser plugins can’t use all the good APIs (for security, ironically) -
@ameaijou@landonfuller That is my understanding as well. -
@mjtsai@ameaijou Looks like there are options: https://developer.chrome.com/extensions/nativeMessaging … && https://developer.apple.com/library/safari/documentation/Tools/Conceptual/SafariExtensionGuide/CommunicatingwithyourOSXApplication/CommunicatingwithyourOSXApplication.html#//apple_ref/doc/uid/TP40009977-CH23-SW4 … &&https://developer.mozilla.org/en-US/docs/Mozilla/js-ctypes/js-ctypes_reference … -
@landonfuller@mjtsai But now you’ve wiped out _any_ hope of using common code across browsers, much less platforms. - View other replies
-
-
@landonfuller@mjtsai In theory, agreed. In practice, 1Password has to security-check all of their code heavily. More platform support (1/N) -
@landonfuller@mjtsai means more code to review and more chance for mistakes. Given that you can’t eavesdrop on loopback without root (2/N) - View other replies
- Show more
-
-
-
@leebennett@mjtsai That would indeed be the official response from my Chief Defender.
Gwynne Raskind
Lee Bennett
1Password
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.