BUILDING 1PASSWORD
Static analysis and constant time comparisons
At 1Password, we regularly hire outside experts to check our source code and look for security vulnerabilities. A recent penetration test by Cure53 identified a case where the 1Password server wasn’t using a constant-time comparison when it should. The fix, while trivial, created an interesting challenge for us: How can we confidently say that we …
Continue reading