download issue 24 here - Help Net Security

Once unlocked, you can read all information,
but no changes are allowed to the content of
1Password. It would not be wise to have the
1Password data in many places as it is still
vulnerable to offline password cracking attacks.
Hence, the master password complexity
is key to the security of your 1Password data.
The problems
1Password works very well in most cases. The
trouble begins with indexed passwords. Take
Direct Line as an example. To login to their
system you have to enter your email address
and postcode. Then on the next page you are
asked to enter the 2nd and 4th character from
your password (for example). 1Password has
no way of knowing which character the website
wants. In this case, the workflow is little
more complicated. I need to open 1Password,
look up the website entry and display the
password for it.
Another issue I have with the software is that it
does not work well all the time. This is espe-
cially true on complex websites where the
login or registration form is driven by java
script. I have had some websites that simply
did not work. To the credit of the developers I
must say that they promptly checked the website
and sometimes updated the software in
the next versions.
1Password on the iPhone
I do not always have my Mac with me, but I do
have an iPhone. The perfect companion to
1Password on my Mac is 1Password Touch
Pro. This application synchronizes all 1Password
data to the iPhone.
The security model is slightly different here.
The entry to the 1Password Touch application
is secured by 4-digit passcode.
Each entry in the 1Password database then
has a flag to indicate whether another password
is needed to unlock this entry in1Password
Touch application.
www.insecuremag.com 26