Access Log?

Hello @CVZ! 👋

Thanks for the question! You can see a list of authenticated sign-ins to your 1Password account (and when that device or browser last connected to your account) by following these steps:

1. Log in to your 1Password account on 1Password.com (in the browser, not the app)
2. Click your name and then My Profile.
3. Scroll down to Trusted Devices and Browsers.

Let me know if that helps. 🙂

-Dave

Hi Dave, thanks very much for getting back to me.

That is helpful but not quite what I need.

If I can describe my issue hopefully that will elucidate my need.

On Wednesday 1st May at 21:23 I received a notification on my phone from 'Google' of a 2FA verification code. To get this far with a Google log in, the password to the Google account needs to be known. This, of course, is tucked away safely in 1Password.

But, if this is a genuine 2FA notification, is there any chance my 1Password master password has been compromised? I am 99.999% sure it hasn't but I still wanted to check that there hadn't been any access to my Vaults around that time.

With the Trusted Device and Browsers list I am unable to interrogate by time - only by time last accessed by device. As it happens there is no access by a device I don't recognise after May 1st. However, if there were access by a device I don't recognise after this date, then its (potential) access on 1st May 21:23 would not be visible.

I realise that there is a data storage overhead on recording all log ins but, nevertheless, access logs on security software would seem to be base-level functionality, and it would be useful in my scenario (and others yet unthought!) which would give me peace of mind that there hasn't been any unauthorised access.

If such a feature doesn't exist, could this be added to a 'desired' list and then voted on by users (if that is possible)?

Thanks again, Dave.

@CVZ

Thanks for the reply. Just to clarify, is there something in particular that leads you to believe that your 1Password account has been compromised? If it had been that you would see an unknown device listed on the Trusted Devices and Browsers page that I mentioned.

As it happens there is no access by a device I don't recognise after May 1st. However, if there were access by a device I don't recognise after this date, then its (potential) access on 1st May 21:23 would not be visible.

I'm not sure that I understand. If an unknown device had accessed your 1Password account then you would see it listed on this page. Could you clarify what information is missing?

You also would have received an email letting you know that your 1Password account had been accessed from a new device. Have you received an email like that?

I look forward to hearing from you.

-Dave

Hi Dave, thanks for your reply.

I wasn't aware that an unknown device, i.e. untrusted, would appear in the Trusted Devices and Browsers page. I've never seen such an entry I guess because it's never happened before.

That's good to know though (and the email notification) so I can check that list if I get any more (likely scam) messages that imply access to my 1Password vaults.

Thanks for your prompt support - really appreciated.

Cheers,
Chris

@CVZ

I'm happy to help! An attacker would need both your 1Password account password and Secret Key to log into your 1Password account and decrypt the data within it. Any successful sign in attempt on a new device or browser, using your account password and Secret Key, will always result in the following:

1. The device/browser being added to the Trusted Devices and Browsers page.
2. An email being sent to your email address alerting you to the sign-in.

If you are concerned about the security of your 1Password account then you can always send an email to support+security@1Password.com and our team would be happy to take a look. 🙂

-Dave