1pw8 not needing to be unlocked to input a user and pass?

Hello @hawklet00, thanks for letting us know about the issue you've seen with 1Password 8 on your device.

With Auto-Lock on Exit set to Immediately, 1Password 8 should lock any time you switch focus away from 1Password or lock your device. If you have Show filling suggestions on, you will see linked suggestions after tapping a login field but filling them should require you to unlock 1Password 8.

If that's not the case for you, I'd like to ask you to try the following to help give us a better idea where the issue may lie:
1. Open and unlock 1Password 8.
2. Tap Settings > Security.
3. Confirm Auto-Lock on Exit is set to Immediately.
4. Return to 1Password's home screen.
5. Tap your account icon > Lock.
6. Open a website and tap the filling suggestion.

After tapping the suggested Login are you required to unlock 1Password? If you turn Show filling suggestions off from Settings > Autofill then repeat steps 4-6 do you see the same behavior? Thanks again!

thanks for following up, here is what i found:

Scenario 1: when toggling the show filling suggestions to off when i tap on a user or pw field, i am prompted to unlock 1pw
Scenario 2: when toggling the show filling suggestions to on i am not prompted to unlock 1pw to see my user and pass

I've attached screenshots to this thread to show both scenarios so you can see what i am seeing, the first is scenario 1 and the second is scenario 2

Hello @hawklet00 thanks very much for including the screenshots and I apologize for the delay in response.

The behavior you've described in both scenarios is expected assuming that after you tap a suggested item in scenario 2 you are prompted to enter your password or biometrics (if 1Password is locked). The Show filling suggestions setting works similarly to the Autofill previews section in 1Password 7 for Android. Both reveal the name and username of any item linked to the website or app after tapping a sign-in field. If you prefer this information to be revealed only after unlocking 1Password you can turn Show filling suggestions off.

Let us know if we can help with anything else!

it seems counter intuitive that login information is being shows while 1pass is locked. why was it designed to show that way?

Hi @hawklet00, with Show filling suggestions on, you can preview your linked Logins' titles and username before selecting them to Autofill. This provides the option to quickly select and fill the right account when you might have multiple Logins for the same site. If 1Password is locked, your account password will be required to fill this information. If you prefer this information not to be previewed, you can set Show filling suggestions off.

@1P_Timothy I actually have the opposite problem. I have fingerprint enabled and auto lock set to the maximum of 8 hours. But anytime I switch focus away and use autofill, I always have to use my fingerprint. For me, this is very annoying. I wish apps could sense that authentication was used to bypass the lock screen instead of constantly requiring re-authentication using fingerprints. It's almost as if my app is set to instantly lock, ignoring the 8-hour window. Literally, within seconds, if I switch to another app and then use autofill again I have to re-authenticate.

@1P_Timothy ahh, i missed that. my apologies. thank you for your help!

Happy to help @hawklet00!

@RobMendez, thanks for letting us know about this issue on your device. If 1Password is running and unlocked in the background, it should re-open or Autofill without your account password (or fingerprint).

I'd like to ask a few question to help determine the issue:
* What steps do you typically take to switch focus? Is 1Password still in your recents when you switch focus?
* If you re-open 1Password is your fingerprint required, or only for Autofill?
* What is the make and model of your device?

@1P_Timothy apologies for the late reply. It should re-open and autofill without authentication, but it doesn't.

• I usually switch focus by sliding up halfway and going back to 1Password (still in the recents). But I'm not sure if it asks me w/1Password in the recents or not. I'll have to pay closer attention and get back to you. I do know I have the settings set to password every 30 days and auto-lock after 8 hours, but I still get asked for a password (maybe after 2 weeks) and authenticate way less than 8 hours.

• When I re-open 1Password, I still have to reauth w/my fingerprint (within the 8 hours).

• I'm using a Google Pixel 6 Pro on the latest Android (OS 13, Security Oct 5, Play System Sep 1) and 1Password (8.9.3) versions.

I can't pin the app in the recents like I could on my previous OnePlus phone (Google's App Pinning seems to be an always on stuck on that app or nothing at all).

My guess is that while the app may still be shown in the recents, if I've opened a lot of other apps, maybe the OS and/or app doesn't consider itself still "open" and then requires a reauth. I'll have to test that theory (still works w/o reauth after I opened 16 other apps, so maybe it is a timing issue).

Should I send diagnostics right after it happens next time?

Hi @RobMendez,

Thanks for your reply.

I was able to reproduce this issue on my own Android 13 device and your assumption appears to be correct from what I seen in my testing.

I opened 1Password 8 for Android, with auto-lock set to 8 hours and for master password to be required every 30 days. I then closed out of the 1Password 8 for Android app (showing as the only opened app in my Recents). I then opened my device Settings, tapped System > Developer options > Running Services > tapped the three dots in the top right and tapped Show Cached Processes.
From here I was able to see that 1Password is kept running as a cached process when the app isn't being used, but is still open in my Recents menu. If I open 1Password again from my Recents menu at this point, it opens without asking me to unlock using my account password or biometrics.

I then opened 13 random apps in a row, then checked the Show Cached Processes in Running Services in Developer Options and noticed 1Password was no longer showing as a cached or active process in Running Services. When I open 1Password 8 for Android from my Recents at this point, I am prompted to unlock the app via biometrics. Once I unlock the app, 1Password appears as a cached process again in Running Services.

To conclude, it appears the opening then closing of multiple apps at once, but leaving them in the Recents menu causes 1Password to be "pushed out" as one of the cached process, leading to the app being treated as being opened for the first time again, leading to an account password, or biometric unlock being required to activate the process again.

I've filed an issue for this with our development team to make them aware of the issue and I appreciate you for bringing it to our attention.

In terms of pinning the app. I am currently using a custom ROM and I was able to lock the 1Password for Android app in the Recents menu, by opening Recents, then tapping the lock icon below the 1Password for Android app. This prevent the issue outlined above from occurring, but I suspect this feature may be a different way of app pinning or locking added to the developers of the custom ROM I'm using, which may be why it is behaving differently than you've experienced on your device.

Apologies for the very long response, but I hope it helps. :)

-- Brendan

ref: dev/core/core#18114