1Password Firefox Extension Security Review https://git.yuv.al/1pass-analysis/atom/README.md?h=main 2026-02-26T08:13:23Z 2026-02-26T08:13:23Z Yuval Adam _@yuv.al 2026-02-26T08:13:23Z urn:sha1:7b609fffddf3ae138cdf301c97bad805fc508616 New document: - key-hierarchy.md: Full key derivation model, MUK lifecycle, SRP auth, biometric unlock, Duo MFA, dSecret bypass, delegated sessions, password timebox mechanism, crypto algorithm inventory Major updates: - architecture.md: Expanded WASM section with confirmed 80+ rA.* methods, clarified WASM is portability layer not security boundary - trust-boundaries.md: Corrected Zone A (keys in JS heap not just WASM), Zone D (confirmed native messaging protocol with biometry messages), Zone F (WASM is NOT a privilege boundary), detailed sensitive data table with confirmed storage locations, new Critical attack surface category - message-catalog.md: Added native messaging protocol (biometry save/unlock/ remove, availability check), desktop connection messages, server notification events - TODO.md: Marked completed items, added key material exposure assessment section, authentication & session security section 2026-02-26T07:58:17Z Yuval Adam _@yuv.al 2026-02-26T07:58:17Z urn:sha1:54adf11e1c8905c97512fcf29d8b3d75aa9eb0cb Static analysis of the extracted XPI covering: - Architecture: runtime topology, WASM modules, boot sequence, permissions - Message catalog: ~50 background handlers, per-file content script messages - WebAuthn analysis: page-world monkey-patching, postMessage IPC protocol - Trust boundaries: 8 zones, 7 crossings, data lifecycle, attack surfaces - Telemetry: Snowplow, Sentry, DNS privacy proxy, opt-out controls - TODO: prioritized future work plan