Custom pin unlock for 1Password 8 for iOS

Hello @Coden! 👋

Welcome to the community and thank you for the feature request! I've split your comment into a new thread since the older thread hasn't been active for three years now.

As far as I'm aware, there aren't any plans currently to bring a custom PIN feature to 1Password 8. Instead, our team released a device PIN unlock feature back in 2023 so that you can unlock 1Password using the same PIN that you use to unlock your iPhone. You can read more here: Use your device passcode, PIN, or pattern to unlock 1Password

That being said, I'll share your request and feedback internally with the rest of the team. Aside from device PIN unlock there are several other options currently offered through different plans that might fit your team's needs:

• Unlock using your account password.
• Unlock using a passkey (currently in beta): Unlock 1Password with a passkey (beta)
• Unlock using your identity provider: Get started with 1Password Unlock with SSO
• Unlock using biometrics: Use Face ID to unlock 1Password on your iPhone or iPad Pro
  
  

This doesn't even begin to mention medical situations, accessibility, biometric sensitivity (including the flaws and variation between devices), lack of policy control, etc.

Can you tell me a little more about your teams specific needs here? Does biometric unlock not work as an option for some of your users? Have you considered changing your account passwords so that they're easier to type in while still remaining random and secure: How to choose a good 1Password account password

And can you tell me a little more about what you mean by "lack of policy control"? I look forward to hearing from you.

-Dave

Hello @1P_Dave and 1Password team,

I would also like to see 1Password provide a unique PIN for unlocking vaults in the app.

I have been using 1Password on my iPhone for at least a decade.  I was originally sold by AgileBits whitepapers and their peer-recognized dedication to data security.  I still have not been convinced to trust another company to ensure my vault is as secure as 1Password engineers have demonstrated.  My entire family has used 1PW 7 well past its expiration because it works well and I waited (too) patiently for the community consensus on 1P 8 to indicate that all the bugs were ironed out.  I finally downloaded 1PW 8 to avoid seeing 1PW 7 discontinued or somehow exploited due to its age.  I will say that the switch was seamless, so thank you to the 1PW team for that.

So, it's quite disappointing that the unique unlock PIN of 1PW 7 was replaced with a device passcode/PIN in 1PW 8.  I'll give my reasons, though they've been mentioned by others.  This request has been made several times since 1 PW 8 and the device PIN update were released years ago.  Here are a few examples:
Feature Request: Unlock 1Password for iOS using a custom PIN and not the device passcode | 1Password Community
Feature Request - Use custom PIN for unlock | 1Password Community
revert PIN unlock fuctionality in 1P8 Android to how v7 worked | 1Password Community
Want to unlock 1Password App with pin, not vault master password OR device password | 1Password Community

For myself, I am very security aware, which is why I chose 1PW in the first place. 

If all my passwords are stored in a vault, why would I allow commonly known attack vectors to potentially expose the access keys?  You can certainly argue that I should just use my vault master password.  It technically solves the problem, but at a huge inconvenience to efficiency.  I need to access password-protected apps and information many times per day.  

1. Master password: As stated above, it's a technical solution, but inelegant and inconvenient given how often I need to unlock my vault to access a password.

2. Biometrics: Super convenient, but poor on security if someone wants to unlock my vault in my presence.  Yes, this would be from a higher level threat actor (i.e., they discover that my vault unlocks with biometrics and are willing to use me to access it), but it's still a threat.  You need only understand the permissive laws on border security devices searches to know that this can happen.  If you forget to lock your phone with a PIN at the border, they could then access your phone AND all your accounts via 1Password simply by detaining you and using your face/finger.

3. Device passcode: There have been sufficient stories in the news about shoulder surfing of passcodes, that I shouldn't have to argue that it's a risk.  Apple itself recognized the risk of stolen passcodes being used as authentication for account access beyond just the device itself and implemented Stolen Device Protection last year as mitigation.  Using the same passcode for your 1Password vault allows access to all your accounts just like biometrics except you don't even have to be present, so it's actually worse.  One might argue that a 1Password PIN could also be shoulder-surfed.  However, the odds of that happening are much lower than the device passcode/PIN getting shoulder-surfed based on the scenarios in which it typically occurs. 

This was already solved:
A simple solution to this problem already existed in 1Password 7 -- a unique PIN for vault access.  A unique PIN is not as easily surfed due to less frequent usage than the device passcode, particularly in situations that it typically occurs.  A PIN option cannot be "forced" like a biometric option.  Assuming the app enforces good practices to prevent brute force attacks on the PIN on the device itself (e.g., block high speed guessing), I get both security and speed for on-device access.

As a company founded on security-first principles, neither biometric nor device passcodes truly meet a high bar for security, particularly when it comes to accessing ALL my passwords!  Good UX should never be a replacement for excellent security in a product like this.  Concerns about customers that confuse their passcode with a unique PIN can be mitigated with carefully wording and UX.  1Password can do better.  Please consider re-implementing the unique PIN option for vault unlock as it was in 1PW 7.  

Thank you!