If the 1Password website were somehow already compromised when I
created an account, couldn't an attacker have the info they need from
me now to decrypt my data, or am I missing something?
YES. And not only would you be vulnerable to this type of attack when you create your account – but, you would be vulnerable to this type of attack any time you login in to your account through 1Password’s web interface. This is because of the infamous browser crypto chicken-and-egg problem.
1Password acknowledges this. On Oct 29, 2021 I sent the following email to firstname.lastname@example.org:
Hello 1Password Support, I’m emailing you today with a question for
your security team.
On your page at https://1password.com/security/, it reads, ‘Only you
have access to your 1Password data’. Also, your whitepaper at
https://1password.com/files/1Password-White-Paper.pdf makes a similar
claim on page 2, where it reads, ‘Server ignorance - We are never in
the position of learning your Master Password or your cryptographic
However, with regard to 1Password’s web app, it would seem that if
1Password were to ‘go rogue’ (or if 1Password were to be coerced, or
if an attacker were to gain access to 1Password’s servers, etc.), it
would be possible for 1Password to modify the client-side code served
by 1Password’s servers, such that the code captures the user’s master
password or private keys, and sends these keys back to 1Password’s
server (or somewhere else). As you may know, this problem was coined
'The Browser Crypto Chicken and Egg Problem' by security researcher
Thomas Ptecek in 2011. In other words, if users can’t trust the server
with their secrets, then how can users trust the server to serve
secure crypto code?
I’m curious if 1Password has any comment on this subject.
Specifically, if 1Password were to go rogue, would it be possible for
1Password to access users’ secrets by modifying the client-side code
that you serve? If so, has 1Password considered any solutions to this
1Password’s response was interesting:
Thank you for contacting us. While anything is possible to do, this
would completely destroy our business overnight. Because of the size
of 1Password and our commitment to being as secure as possible, we are
audited regularly. If an attempt was made to add this functionality to
our program it would be detected and disclosed. There also is no
"switch" we could flip to allow such behavior as well. Well
technically a patch could be released with this functionality, again
this would be detected quickly.
As a password manager, our whole business model revolves around trust
and security. breaking either of these would mean almost certain death
of our company and almost certainly legal consequences. Again, while
this "is possible" the likelihood of this happening is practically
zero because of the checks and balances put in place.
Please let us know if you have any other questions.
As you can see, the representative acknowledges that such attack is technically possible, but cites legal and business reasons why it would not be in 1Password’s interests to ‘go rogue’.
But, the fact remains that users inherently do not trust 1Password's servers with their secrets. This is why they use 1Password in the first place. They rely on 1Password's "zero knowledge" solution to encrypt their secrets on the client side, so that these secrets never reach 1Password's servers. Yet, ironically, these users rely on these same servers that they do not trust, to serve them secure crypto code that does the above. It's the 'browser crypto chicken and egg problem' in action.
In fairness to 1Password, they are not the only service provider affected by this problem. Any provider that uses client-side crypto (or ‘in-browser crypto’) in a web application to build a 'zero-access' (or 'zero-knowledge') service is faced with this problem – and will continue to be faced with this problem until we have a viable solution to the 'browser crypto chicken and egg problem'. For some interesting reading on this problem, and some ideas around possible solutions, see:
Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?