Collecting 1Password password hashes

1Password is another cloud-based service, similar to LastPass but with some significant architectural differences. 1Password includes a secret key value that is not known to 1Password, which theoretically mitigates the risk of a stolen vault from 1Password directly; however, this secret key is used by the local app or browser extension, which means that this additional protection is really for the cloud infrastructure. We will focus on retrieval from the local vaults in this section.

Creating an account on 1password.com requires you to set the vault password. Unlike LastPass, 1Password only requires a password of 10 characters, with no complexity requirements, as shown in Figure 9.10:

Figure 9.10 – Vault password requirements for 1Password

This means that a password created in 1Password can theoretically be weaker than that of LastPass, given the current construction requirements. 1Password vaults exist to...