6

In light of the recent heartbleed vulnerability, I'm thinking of switching to a service like 1Password. However, I don't know how to evaluate the risk of NSA (or other government) spying. So, two questions: how can I evaluate the risk of such spying, and is 1Password secure from it?

EDIT: I thought it went without saying, but I'm interested in answers that explain the rationale used. I'm not interested in baseless opinion about 1Password (like "1Password sucks!"), but I am interested in impartial criticism, with an emphasis on how one can evaluate services like it with respect to this vulnerability. Also, please back up any opinions with facts and references.

EDIT 2: I realize that asking for definitive proof of spying is unrealistic. I'm asking for a way of evaluating the risks. For example, if they claimed to be free of government spying, that would be useful information. (They make no such claim, as far as I can tell.) Or perhaps it is significant that they are a Canadian company. I don't know, and I would appreciate help from you security experts.

Improve this question
4
  • 1
    I would like this question to be reopened. The Don't Ask page details the sorts of subjective questions that don't belong on this site. My question is not one of those. On the same page, it lists criteria for constructive subjective questions that do belong on this site, and my question meets all of these criteria, especially after the edit.
    – Jeff Terrell Ph.D.
    Apr 12, 2014 at 12:56
  • I don't know 1password, but lastpass for instance never stores your passwords, and are always encrypted if stored locally, so I would ask how 1password stores passwords. at least if they don't store them it'd be impossible for the NSA/CIA to get them unless they do a MITM attack or put in a keylogger, which is much more difficult then giving 1password a subpoena
    – TruthOf42
    Apr 14, 2014 at 20:17
  • Personally, I don;t think this qualifies for reopening, as there is not going to be a valid answer, just opinions. Your second edit helps, but you will need to completely edit the question. I am guessing you want to ask "How can I evaluate the security of a piece of software?" - which may be answerable as long as you don't want an answer stating 'this is safe' or 'this is unsafe'
    – Rory Alsop ♦
    Apr 14, 2014 at 23:17
  • This could have been the basis for a good, objective, relevant answer: Who Has Your Back? A Report from the Electronic Frontier Foundation
    – Jeff Terrell Ph.D.
    May 17, 2014 at 0:12

2 Answers 2

Reset to default
13

If some three-letter agency is after you, personally, then you are doomed. They already put a microphone in your home, maybe even a video camera with a good view on your screen and keyboard.

If the same three-letter agency does its job properly (and you should hope for it, since it is paid with your tax money), then knowing whether they bribed any given online service cannot be answered: a positive answer, one way or the other, would be a proof of incompetence of the said agency.

In any case, what makes you believe that a random guy on the Internet like me would be trustworthy ? There is no way that your question may find here an answer that you can count upon. Be rational in your paranoia !

Improve this answer
3
  • 5
    Maybe you are in fact not a black bear, but an NSA agent :O
    – Lucas Kauffman
    Apr 10, 2014 at 16:10
  • Why can't he be both!? Mice study us while we think our scientists study them, bears have even bigger brains, think about it!
    – Darsstar
    Apr 10, 2014 at 17:02
  • black bear? What is blackbear?
    – user4951
    Oct 2, 2018 at 17:20
3

By definition, if you could evaluate their spying, then it's not spying.

And, if you had the mean to actually find out whether they are spying on you, they you are definitely worth spying on - and there's your answer.

On the other hand, 1Password does you the same good than, say, installing a two-factor biometric keypad on your front door during a flood. If your password is "secure" but an attacker can read it directly from a server's memory you're barking up the wrong tree.

Improve this answer
1
  • Good answer, but I thought it's "barking up the wrong tree" ;)
    – Alex Ixeras
    Sep 6, 2017 at 2:18

Not the answer you're looking for? Browse other questions tagged .