OnePass

OnePass
Name	OnePass
Type	Software
Developer	Proprietary
Initial release	2010s
Stable release	2020s
Platforms	Cross-platform
License	Commercial

OnePass

OnePass is a commercial digital credential and authentication product deployed by multiple technology companies and integrated into services operated by financial institutions, telecommunications companies, retail chains, and cloud providers. It consolidates password management, single sign-on, and credential vaulting into a unified service layer used by enterprises such as Amazon (company), Microsoft, Google, Apple Inc., and banks like JPMorgan Chase and HSBC. The product positioned itself amid competing offerings from firms such as LastPass, 1Password, Dashlane, and enterprise platforms like Okta and Centrify.

Introduction

OnePass launched as a response to rising breaches involving credentials exposed in incidents like the 2013 Yahoo data breaches and the 2014 Sony Pictures hack, aiming to reduce phishing, credential stuffing, and lateral movement in compromised networks. It offers browser extensions for Google Chrome, Mozilla Firefox, Microsoft Edge, and Safari (web browser), native apps for Android (operating system) and iOS, along with APIs for integration with Amazon Web Services, Microsoft Azure, and Google Cloud Platform. The service integrates with identity providers including Active Directory, LDAP, and SAML-based federations used by enterprises such as IBM and Oracle Corporation.

History and Development

Development began in the wake of notable breaches and regulatory shifts influenced by instruments like the European Union’s General Data Protection Regulation and guidance from bodies such as National Institute of Standards and Technology (NIST). Early engineering involved cryptographic research drawing on public work from Whitfield Diffie and Ronald Rivest and standards from the Internet Engineering Task Force (IETF). The product evolved through partnerships and acquisitions involving firms from the Silicon Valley ecosystem and venture rounds featuring investors like Sequoia Capital and Andreessen Horowitz. Major milestones included enterprise feature releases timed with large migrations by customers such as Walmart and Bank of America, and strategic integrations with identity platforms employed by Salesforce and ServiceNow.

Features and Functionality

OnePass provides vaulting of credentials, automated form filling, password generation, and policy-driven provisioning compatible with SCIM and OAuth 2.0 flows used by service providers like GitHub and Atlassian. Administrative consoles enable role-based access control interoperable with Okta, Ping Identity, and Azure Active Directory to mirror organizational hierarchies in corporations such as Siemens and General Electric. It supports multi-factor authentication leveraging hardware tokens from Yubico (YubiKey), authenticator apps like Google Authenticator, and biometric modalities on devices from Samsung and Apple Inc.. Enterprise automation features include secrets management for Kubernetes clusters orchestrated alongside Docker and integrations with CI/CD pipelines in Jenkins and GitLab. Users can synchronize vaults across consumer devices using encrypted key synchronization akin to systems used by Dropbox and Box (company).

Security and Privacy

Cryptographic design claims include zero-knowledge architecture and end-to-end encryption influenced by implementations described by researchers at MIT and Stanford University. Storage uses client-side encryption with keys derived via standards such as PBKDF2 and asymmetric schemes inspired by RSA (cryptosystem) and Elliptic-curve cryptography. Audit logging and compliance reporting integrate with governance tools used by firms like Deloitte and KPMG and support standards cited by ISO/IEC committees. Privacy controls enable segmentation for customers operating under regimes like California Consumer Privacy Act and UK Data Protection Act 2018. Security hardening references threat models discussed by organizations including Center for Internet Security and collaboration with incident-response teams such as Mandiant for tabletop exercises.

Adoption and Use Cases

Adopters span sectors: retail chains implement OnePass for point-of-sale operator credentials at corporations like Target, healthcare providers integrate with electronic health record systems from Epic Systems and Cerner to manage practitioner access, while financial services institutions use it for trader workstation access and API key governance in environments like Bloomberg terminals. Technology startups use OnePass to secure access to development infrastructure on GitHub and cloud accounts on Amazon Web Services. Higher-education institutions such as Harvard University and University of Oxford have piloted deployment for faculty and researcher credentials, and government agencies in jurisdictions including Canada and Australia have explored its use for contractor access under procurement frameworks.

Criticism and Controversies

Critics highlight centralization risks similar to debates around providers like LastPass and 1Password when breaches of large vault services occur, citing incidents that echoed the dynamics of the 2017 Equifax breach and the fallout from the 2016 Yahoo data breaches. Privacy advocates and civil society organizations such as Electronic Frontier Foundation have pointed to concerns about metadata collection and lawful access by states under statutes like the Investigatory Powers Act 2016 in the United Kingdom. Enterprise customers have raised issues about vendor lock-in and migration complexity compared with open-source alternatives such as KeePass. Security researchers at universities including University of Oxford and industry labs like Google Project Zero have published analyses prompting product hardening and patch releases.

Category:Password managers