Feture Request: modern app unlock
Hi,
I'm a happy 1password user, but, I have a big concern about how to unlock it and I will explain why and give a suggestion about it, would be great if 1password team make it, I think it would be an extra level of security.
The actual problem is that if an attacker gets access to my computer and my 1password password, he can easily get access to all my vaults. This could be done very easily if someone plugs a physical keylogger on my work computer's keyboard for example. It's easy, simple and very effective. I know that is impossible to provide 100% security, but we should try to make it harder, take longer time or expensive to break the security. A malware and a software keylogger could also give my computer access to a attacker.
The solution 1: Yubikey passkey. This would be great, as no malware, remote access or keylogger could unlock my vaults. This is my favorite solution.
Solution 2: Password + TOTP (not the same TOTP as the account), this TOPT would work just for vault unlock. As some users don't have a security key, they could use mobile phone TOTP app to unlock the vault.
Solution 3: Unlock confirmation using mobile phone. A notification and a simple confirmation could do the trick.
If I could choose what to implement, I would do all the 3 options, as they cover different type of user's needs. The recover method, also could be as simple as the account password + secret key + TOTP (if TOTP is activated) so the user could disable this extra feature and go back to simple password unlock or register a new passkey or new unlock TOTP or whatever...
I know that a attacker that has access to my computer could exploit the possibility to copy unencrypted data while 1password is unlocked, but this involves another level of knowledge, more time and maybe more money. Because, in the way it is now, an attackers can buy a cheap USB keylogger and hide it in our computers making a big disaster knowing my 1password password and this is a real concern. Check more about it on https://en.wikipedia.org/wiki/Hardware_keylogger
Thanks in advance!