Feature request: Always ask for biometrics in the browser

Forum|Forum|2 years ago
October 20, 2023
3 replies
193 views

It would be awesome to have the option to require biometric confirmation to autofill fields in a browser, just like safari asks for touchID to autofill from the iCloud Keychain. This would increase the security of the browser extension and the overall feeling native on macOS.

When to require biometric confirmation:
- when I click on a email, password, credit card or identity field, 1 password shows a menu of the saved items I can choose between. When I choose the one I want to autofill by highlighting it with the mouse (without clicking it), if I put my finger on the fingerprint reader the field is filled with the highlighted item.

The same confirmation should be asked when logging in with passkeys.

if I click on the item, the browser prompts a touchid request.

1Password Version: 8.10.18
Extension Version: 2.16.0
OS Version: MacOS 14.0
Browser: Chrome (Arc)

Browser Extension

Pinned Reply By 1P_Dave

@gkford

Thank you for the feedback! 1Password in the browser is designed to protect your information, you can read about some of the safeguards that we’ve implemented here: About the security of 1Password in your browser

You can choose how often 1Password locks by adjusting your auto-lock settings. That being said, I’ve shared your feedback with our team internally and they’ll consider adding additional auto-lock options to 1Password in the browser in the future.

You might also be interested in our new support for macOS AutoFill: macOS AutoFill is now available to everyone!

-Dave

1

1P_Evon

1Password Employee

Hello @TinhoLoco,

Thanks for reaching out! You can unlock the browser extensions through TouchID if it's integrated with the 1Password desktop app.

For some context, the 1Password extension connects to the 1Password desktop app through a feature called Shared Lock State. With this feature, when you sign into the app, you'll also be signed into the extension.

If TouchID is set in the 1Password desktop app and integration is enabled, the browser extension will prompt for TouchID through the desktop app so they can unlock at the same time.

May I ask if you have TouchID enabled in the 1Password desktop app? If so, can you check if the integration settings are enabled. Here's how -> https://support.1password.com/connect-1password-browser-app/#check-your-settings.

I look forward to hearing back from you.

G

gkford

Hi I feel like the response here misunderstood the user’s intent. The request was for an option for autofill of passkeys, passwords and/or other details to always require TouchID as an additional security step, not for allowing touchID integration (which already exists).

Given the likelihood of further critical zero days being found on browsers that could compromise an open password browser extension + the growing potential for agentic-browser-use-jailbreak shananigans, I am also looking for this functionality. (I am currently a 1password subscriber and trying to configure it in line with my increased security concerns)

Such a feature would also mitigate the concerns about clickjacking (atleast for those with touchID as an option)

This feature would match the security level available via apple passwords for password autofill, and extend it to passkeys.

Alternatively, if a user could autolock 1password extension immediately after autofilling a page, that would result in approximately the same outcome. Currently the most secure option available is setting 1password to autolock after 1 minute of idle time, which can still result in the extension remaining unlocked for many hours.

Ultimately the setup I would prefer would be that the browser extension was always locked and accounts/ passwords etc could not be viewed from within the browser - I would handle any editing or viewing of passwords in the standalone app which ideally could also be touchID protected and set to immediately lock when out of focus (rather than only after periods of idleness). At the moment the 1password macOS app doesn’t even lock when you quit and reopen it! You have to actually specifically lock it.

Thanks,

Graeme

1P_Dave