Syncing is performed via Dropbox

martinez

Hello,



today i bought my third 1password product/licence. I am using nowadays 1P for windows 7 and Ipad. After the first steps i wanted to sync my backups from Windows machine with my Ipad but i got following error:

Failed to restore, incorrect backup file. The file header does not start with 'SQLite format'



On Windows i dont have the possibility to sync like on a mac over wifi with the security code, so i tried it this way without success.



I must admit that i am not willing to use any Online hoster like dropbox for my 1P files!



Am i really not able to sync on windows machines without leaving my data into the WWW?



martinez

khad

Welcome to the forums, Martinez!



At this time, [url="http://help.agile.ws/1Password3/cloud_syncing_with_dropbox.html"]1Password for Windows syncs with our other 1Password products via Dropbox[/url].



Please keep in mind that your secrets in your 1Password data are safe wherever they are stored. Although we don’t recommend making your 1Password database publicly available to the world, we have designed it so that your username and password data (along with other secret data stored within it) is protected no matter whose hands they fall into. For this and other reasons we are very confident when we recommend cloud syncing of 1Password data with Dropbox.



Our "[url="http://help.agile.ws/1Password3/cloud_storage_security.html"]Security of storing 1Password data in the Cloud[/url]" document goes into greater technical detail regarding why we at Agile all use Dropbox syncing for our securely encrypted data every day. I would encourage you to read the entire document before dismissing Dropbox syncing outright. All 1Password encryption and decryption is done on your own device or computer. Neither Dropbox nor anyone would would ever have access to Dropbox can decrypt your data file without your master password.



Only you can decide what is right for you, but if you have any other questions or concerns, please let us know.



We are always here to help!

martinez

Hello khad,



thank your for your link.

I am concerned of the fact, that if someone can get access to dropbox you a) will not know that and <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/cool.gif' class='bbc_emoticon' alt='B)' /> the attacker would have enough time to crack my password.

Maybe you know what I am thinking know? The most recent example:

[url="http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/"]http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/[/url]

Or what happens if the 1Password itself has an Bug that allows the attacker to open the 1P Backup files?



The more popular Dropbox is, the more people will try to get on the files on it. And Dropbox is vulnerable <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/unsure.gif' class='bbc_emoticon' alt=':unsure:' />



I cant use any Truecrypt container File to protect my files on Dropbox, because 1P wouldn't be able to recognize it.











[b]Is there no other way on a windows machine to transfer (just one time) my Windows 1P Data onto my Ipad?[/b]

khad

Thanks for your continued interest in this, Martinez. It is always good to be thinking about these things.



[quote]I am concerned of the fact, that if someone can get access to dropbox you a) will not know that and b ) the attacker would have enough time to crack my password.[/quote]

This is discussed in the aforelinked "[url="http://help.agile.ws/1Password3/cloud_storage_security.html"]Security of storing 1Password data in the Cloud[/url]" document. Please read the "[url="http://help.agile.ws/1Password3/cloud_storage_security.html#key_strengthening"]Key strengthening[/url]" section under "Agile keychain security."



Also, from the [url="http://www.nist.gov/public_affairs/releases/g01-111.cfm#AES"]National Institute of Standards and Technology[/url] via our "[url="http://help.agile.ws/1Password3/agile_keychain_design.html"]Agile Keychain Design[/url]" document:



[quote]In the late 1990s, specialized “DES Cracker” machines were built that could recover a DES key after a few hours. In other words, by trying possible key values, the hardware could determine which key was used to encrypt a message.



Assuming that one could build a machine that could recover a DES key in a second (i.e., try 255 keys per second), it would take that machine approximately 149 thousand billion (149 trillion) years to crack a 128-bit AES key. To put that into perspective, the universe is believed to be fewer than 15 billion years old.[/quote]

1Password uses 128-bit AES.



[quote]Maybe you know what I am thinking know? The most recent example:

http://dereknewton.c...tatic-host-ids/[/quote]

This has been discussed quite a bit, as you can imagine, [url="http://forum.agile.ws/index.php?/topic/4451-security-dropbox-authentication/"]here in our forums[/url], [url="http://blog.agile.ws/2011/04/dropbox-security-questions/"]in a recent post on our blog[/url], and — if you haven't detected a pattern yet <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/skype_smile.png' class='bbc_emoticon' alt=':-)' /> — in the aforelinked "[url="http://help.agile.ws/1Password3/cloud_storage_security.html#dropbox_securityl"]Security of storing 1Password data in the Cloud[/url]" document.



[quote]Or what happens if the 1Password itself has an Bug that allows the attacker to open the 1P Backup files?[/quote]

Dropbox syncing does not require your backup files to be located in your Dropbox folder, but the backups are every bit as secure as your data file. They are essentially just compressed copies of your data file protected by the same [url="http://forum.agile.ws/index.php?/topic/1774-choosing-a-good-master-password/"]strong, unique master password[/url] (that you have not shared with anyone) which is used to encrypt a 128-bit AES key strengthened by [url="http://en.wikipedia.org/wiki/PBKDF2"]PBKDF2[/url].



[quote]The more popular Dropbox is, the more people will try to get on the files on it. And Dropbox is vulnerable [/quote]

Of course Dropbox is vulnerable. [url="http://blog.agile.ws/2011/04/looking-ahead-in-security/"]Security is a process, not a product.[/url] I would argue Dropbox is [url="http://xkcd.com/538/"]less vulnerable than other vectors of attack[/url], though. <img src='http://forum.agile.ws/public/style_emoticons/<#EMO_DIR#>/skype_smile.png' class='bbc_emoticon' alt=':-)' />



[quote]I cant use any Truecrypt container File to protect my files on Dropbox, because 1P wouldn't be able to recognize it.[/quote]

There is no need to encrypt everything twice. Your sensitive data is already encrypted by 1Password.



[quote]Is there no other way on a windows machine to transfer (just one time) my Windows 1P Data onto my Ipad?[/quote]

As I mentioned in my previous post, 1Password for Windows syncs with our other 1Password products via Dropbox. Please feel free to transfer the data you need and then remove your data file from Dropbox, though. Removing your data file from Dropbox will "break" syncing, but will not remove and data already transferred.



Please let me know if reading the "[url="http://help.agile.ws/1Password3/cloud_storage_security.html"]Security of storing 1Password data in the Cloud[/url]" document brings to mind anything else.



Cheers!