1Password traffic invisible / unstoppable thru Little Snitch?

General discussions about Little Snitch
KankaLetegui
Posts: 2
Joined: Wed Mar 22, 2017 5:03 pm

1Password traffic invisible / unstoppable thru Little Snitch?

Postby KankaLetegui » Wed Mar 22, 2017 5:33 pm

(für Deutsch, runter scrollen)

I use the "W-LAN-SERVER" Feature of 1Password to sync passwords between my Mac and an iPad. But this data transfer is invisible to - and therefore impossible to stop by - Little Snitch. How can that be?

Curiously enough, there is neither traffic nor any kind of program or system process visible in the network monitor when successfully syncing between the two devices.
There is a helper called "1Password mini" on my Mac, but its completely forbidden to have any kind of network connection, I can see that it's successfully blocked, and AFAIK its only use is to enter passwords while surfing the web. Also, syncing with iCloud is disabled.
The program itself (1Password) is not even showing up in the list above the network monitor, and there is no other programm/task sending or receiving data when syncing. The line in the network monitor is completely flat.

How is it possible that syncing between my Mac and an iPad is "invisible" to Little Snitch?

I'm pretty sure that there is no direct connection of any kind between Mac and iPad, but that instead the data is going thru our Wireless Router from one device to the other. Syncing doesn't work if the Router is off, the programs show an error message.

How can there be data transmitted from my Mac to my Router (via Wireless LAN) without showing up on the LS Network Monitor?
And could this be happening also for other programs without my knowledge? - Programs which then communicate to the Internet?


Mac: macOS 10.12.3, LittleSnitch 3.7.2, 1Password 6.6.3
iPad: iOS 10.2.1, 1Password 6.5.3



AUF DEUTSCH:

Ich verwende den "W-LAN-SERVER" von 1Password, um Passwörter zwischen meinem Mac und einem iPad synchron zu halten. Aber diese Kommunikation ist unsichtbar - und damit unaufhaltsam - für Little Snitch. Wie kann das sein?

Der Netzwerkmonitor zeigt weder aktive Programme noch irgendeinen Datentransfer wenn ich erfolgreich meine Passwörter zwischen Mac und iPad synchronisiere.
1Passwort enthält einen Hintergrundprozess namens "1Password mini", aber diesem ist bei mir jegliche Art der Kommunikation untersagt, und ich kann sehen dass diese blockiert wird. Außerdem dient er meines Wissens nur dazu, Passwörter auf Webseiten einzutragen. Synchronisierung via iCloud ist ebenfalls abgeschaltet.
Das Programm selbst (1Password) taucht nicht einmal in meiner Liste der kommunizierenden Programme im Netzwerkmonitor auf, und während der Synchronisation gibt es keinerlei Datenverkehr im Netzwerkmonitor von irgendeinem Programm oder Prozess. Die Linie ist komplett auf Null.

Wie kann es sein, dass mein iPad und mein Mac kommunizieren, ohne dass LittleSnitch irgendetwas davon mitbekommt?

Ich bin sicher dass es keine direkte Verbindung zwischen Mac und iPad gibt, sondern dass diese über den heimischen W-LAN-Router läuft. Die Synchronisierung funktioniert bei ausgeschaltetem Router nicht, und das Programm gibt eine Fehlermeldung heraus.

Wie kann es sein, dass mein Mac über W-LAN Daten an meinen Router schickt, ohne dass diese in LittleSnitch zu sehen sind?
Und könnte dies auch bei anderen Programmen der Fall sein? - Die dann eventuell mit dem Internet kommunizieren?


Mac: macOS 10.12.3, LittleSnitch 3.7.2, 1Password 6.6.3
iPad: iOS 10.2.1, 1Password 6.5.3

meevoo
Posts: 1
Joined: Fri Mar 24, 2017 12:54 pm

Re: 1Password traffic invisible / unstoppable thru Little Snitch?

Postby meevoo » Fri Mar 24, 2017 12:58 pm

It's default rules - if you remove/change the rules under any process for the following in the rules configuration tool

Allow outgoing connections to local network
Allow incoming connections ...

Then you should start to see those connections (plus lots of others which may annoy you...I guess thats why its the default!)

binaryanomaly
Posts: 2
Joined: Sun Mar 19, 2017 12:03 am

Re: 1Password traffic invisible / unstoppable thru Little Snitch?

Postby binaryanomaly » Sat Mar 25, 2017 12:52 am

meevoo wrote:It's default rules - if you remove/change the rules under any process for the following in the rules configuration tool

Allow outgoing connections to local network
Allow incoming connections ...

Then you should start to see those connections (plus lots of others which may annoy you...I guess thats why its the default!)


Yep you're right. I find these default settings actually quite dangerous. Not exactly a safe default when you're outside your "home" or "work" environment.

KankaLetegui
Posts: 2
Joined: Wed Mar 22, 2017 5:03 pm

Re: 1Password traffic invisible / unstoppable thru Little Snitch?

Postby KankaLetegui » Wed Apr 05, 2017 10:59 pm

I find this explanation difficult to believe. To my knowledge, *every* traffic, even local one, is visible in the network monitor. So even if 1Passwords communicates on the local level only, its data should still be visible in the timeline at the bottom of the network monitor (the red and green bars).
Even the communication between my Mac and my Printer via Wireless LAN is visible there. (Which is permitted.) And I can also see the process which are used for printing, as they move to the top of the listed programs.

So, even if the default setting of allowing local communication is the reason why syncing my devices works is true, this still would not explain why this traffic is invisible, both on the upper list of communicating process, as well as on the lower bar diagram.

From the viewpoint of LittleSnitch, the software/process used for syncing 1Password simply seems to be inexistent, even though they clearly communicate.
And if that would be true, there could be other programs communicating locally or with the Internet as well, which are not shown in or even recognized in any way by Little Snitch.


Return to “Little Snitch General”

Who is online

Users browsing this forum: No registered users and 10 guests