1Password's use of Secure Input

Hey @volts:

Thanks for your additional feedback. As Ben mentioned, this is something we'll share with the product teams as we work to make 1Password the best it can be.

Jack

I'm in favor of less security and more compatibility with Text Expander or Typinator.

Let's say someone has installed a screen grabber or keystroke recorder on my machine. Well, they're going to need to send that captured data somewhere where they can use it for malicious purposes. This is why I have Little Snitch and subscribe to rules that block known malicious sites. I have very minimal fear of security issues that would be worth giving up functionality and compatibility with Text Expander or Typinator or other such text macro programs.

Edit 20 minutes later: a second restart has fixed this on the M1 mini, to the extent that I can now use TextExpander while editing a 1Password entry. This all seems a bit random.

Another frustrated TextExpander user here. I’m struggling to understand how this behaviour with Secure Input is changing:

• as compared to 1Password 7,
• between the different versions of 1Password 8, and
• on different Macs.

In 1Password 7, for instance, I was accustomed to being unable to use TextExpander only while editing a 1Password entry. That seemed perfectly reasonable. So why is it necessary to change the way 1Password 8 behaves?

In 1Password 8, meanwhile, I’ve had occasional problems with Secure Input in the past, but for a while everything has been OK. Now with 8.8.0 80800126, Secure Input is not happy, and it’s behaving differently on two different Macs.

On my M1 mini (Monterey), Secure Input has locked up completely, even after quitting 1Password.

On my Intel MacBook (Monterey), Secure Input seems to be behaving as expected. However, 1Password is giving an annoying “That didn’t work…” message when I’ve made no attempt to enter a password. Not elegant.

Would it help if, in the 1Password login window, it were possible to move focus away from the master password field? When I’ve had problems in the past I’ve sometimes felt that that password field is holding the whole system to ransom.

Another strangeness: I’ve also previously found that TextExpander works when I am editing entries in 1Password 8. This is welcome, as long as it doesn’t compromise security, but doesn’t sound to me like expected behaviour :-)

@FogCityNative

I'm in favor of less security and more compatibility with Text Expander or Typinator.

I don't think it would be fair for us to assume that our customer base as a whole would agree here. I wouldn't suspect the majority use macro utilities and outbound firewalls. Security and convenience tend to be opposing factors. We try to strike the best balance for the most common use case. When there is no balance to be found, we do have a tendency to favor security.

@Charles_Butcher

Would it help if, in the 1Password login window, it were possible to move focus away from the master password field? When I’ve had problems in the past I’ve sometimes felt that that password field is holding the whole system to ransom.

What would we move the focus to instead? I'd suggest in cases like this it may make the most sense to close the 1Password window. It is possible to keep the app running in the background without the window being open.

Another strangeness: I’ve also previously found that TextExpander works when I am editing entries in 1Password 8. This is welcome, as long as it doesn’t compromise security, but doesn’t sound to me like expected behaviour :-)

The only recent changes we've made that I'm aware of with regard to our usage of Secure Input are related to the search field. 🤔 I'll do some checking with my colleagues to see if anyone is able to reproduce this. Thanks for bringing it to our attention.

Ben

Just confirmed with one of my colleagues: we have reduced our usage of Secure Input in 1Password 8. We no longer activate Secure Input in username, text, address, or notes fields. We also no longer activate Secure Input in the search bar. It will continue to be activated for the most sensitive fields such as passwords.

Ben

Good news. Most websites use my e-mail as my user name. My e-mail is public knowledge. I use Typinator to type my long e-mail address by typing a three letter code. 1PW was blocking that and now it won’t do that anymore. I am happy with your decision. As long as 1PW can paste my password I don’t need Typinator to make any entries to a password field. That is the function of 1PW.

Thanks @1P_Ben – although I found this issue hard to reproduce, it did cause me some problems. I assume the changes you refer to have appeared in version 80800143, and I certainly haven't seen any problems recently. Great work!

Big improvement! Thank You @1P_Ben and all involved.

Glad to hear the improvement has helped! ❤️

Ben