1Password 8: account password required every 2 weeks?

Hi @Backspaze:

Thanks for following up! To clarify, even with TPM support enabled for 1Password 8 for Windows (creating a similar situation to "never"), after 2 weeks, you'll still be prompted to enter your account password. The same situation would apply if you hadn't restarted your device, or quit 1Password for 2 weeks if TPM support wasn't in use.

I think the ideal here would be 2 weeks after you entered your account password on any device, not just the device you're currently using. I'm not in a position to make promises here, but it is definitely something we're aware of.

I'll share your thoughts about "after device restart" being a selectable option for 1Password 8 for iOS as well.

Jack

@Jack_P_1P

Thanks for your response, I just had a small additional thought about the ”2 weeks on any device” structure.

If you did that it would make sense to slightly tweak the timing based on type of device, to make cross-platform users most likely to have to enter their password on device with easier text input.

Suggestion:
Expire login on mac/pc/web after 14 days of no password entry on any platform.
Expire login on mobile/ipad after 17 days of no password entry on any platform.

(+3 days is intended to account for a full weekend of no computer use)

Hi @acarling:

Thanks for your additional thoughts on that!

Jack

I want to add my voice to this discussion. We are new to 1Password coming from a competitor. The 2 week requirement is a deal breaker for my wife and she wants to go back to the other password keeper. She wants a password keeper to "just work" and not bug her for the master password. Please let us know if this is going to change so we can decide whether to stay or go. Thanks.

Hi @tprattfl !

The 2 week requirement is a deal breaker for my wife and she wants to go back to the other password keeper. She wants a password keeper to "just work" and not bug her for the master password.
Same here! For me, it is okay to type in the master password. But my wife is using 1Password maybe only once a month. That means that she always has to enter the master password. Every time she has to enter it, I have to help her out because she is not remembering it. That's a pain for her and me... 😕

Hi Folks!
Thanks @Backspaze for alerting me to this thread! There's seemingly a lot going on here, but am I to understand that next release of 1Password on iOS is going to force users to re-enter their master password every two weeks regardless of any other setting?

If that is the case, that would be (to keep it family friendly and put mildly) sub-optimal. Folks have raised significant points as to why that's just not a good idea here and in the https://1password.community/discussion/127160/never-option-removed-from-require-master-password. It would be a bizarre decision that is neither 'balanced' nor rooted in any scientific evidence of efficacy to achieve the stated 'users can't remember their passwords' goal. Moreover, and this is what is most troubling, it's making everyone more vulnerable and less secure.

To keep this solutions orientated though, I'll echo support for an 'enter MP once and it applies to all systems' type of scheme. Entering the password on a computer, even as unnecessary as it is there too if you've got biometrics, is far more preferable than trying to type complex passwords on a phone.

Hope they seriously reconsider this entire movement. Not sure even casual users are going to be okay with this. They do seem like they listen to folks every now and then, so maybe they'll see the pushback and adjust course.
[Note: to the support folks monitoring these threads; no anger directed at you all. You've got tough jobs, so thanks for hearing folks out and passing along feedback to the developers.]

Thank you for adding your perspective to the thread. I also want to add a brief update that i believe others have mentioned as a suboptimal consequence of the "2 week" policy. I have had to change my master password to a easier-to-remember phrase as the insistence of my wife. Of course, that makes it less secure.

I would also like to had my voice to this. I have a master password of more than 50 characters, more then half of it that I don’t even know by hearts, since it is store in a Yubikey, the rest is in my head. I kinda consider my master password pretty strong. I also have a physical copy of my master password in the even of my death store somewhere that I could use if I wouldn’t remember my master password for xyz reason. For the sake of people already using strong passwords with 1Password, couldn’t you allow password above a certain length to not require the 2 week verification. If you think that 50 is not enough, pump it to 100 characters, I wouldn’t mind having a longer password. But I mind having the need to type my master password every 2 weeks because of people that are not able to remember their master password correctly. Thanks a lot. Philippe.

@philippemercure Have you considered ever making your Account Password a memorable Password from the generator? That's how I have mine set up, so much easier to remember and to type.

@tomatoshadow2 the beauty of my password is that even under torture, I couldn’t give you my password, 😛, just a fun fact. And also, I only need to remember part of my password, 😀.