Lack of classic extension?

I see there was an update available now, seems to be working for me. Any chance on clarification why it only works on single-matching items?

That's a known issue at the moment, @george_perez. The default behavior is to automatically fill your item, rather than opening a menu, but if there are multiple matching items we need to show a menu and that's not wired up yet. We'll get it fixed.

ref: dev/core/core#9376

I absolutely detest the 'inline' UI. It covers up important fields, and risks a user entering part or all of their master passphrase somewhere else on the form.

Worse, it's only a matter of time before a malicious site takes the next step and pops up a completely fake 1P prompt, captures the passphrase, posts a fake error, and then redirects to the actual site - the user will assume they just entered the passphrase wrong. Having the unlock separate from the data entry fields is a vastly more secure and better user experience.

Having the unlock separate from the data entry fields is a vastly more secure and better user experience.

Hey, @dougl, I'd love to get some clarification on what you're looking for here. We never ask for your account password in the inline menu.

Right there - it's only a matter of time before someone either accidentally types in their passphase into the login field, or a malicious actor puts up a fake 1P box that does capture the passphrase right on the page. It shouldn't appear anywhere inside the browser window - needs to be a completely separate UI element (like hitting the toolbar icon).

The new Safari extension is so slow to load (on the order of three seconds), it’s too frustrating to even give it a fair shake.

@dougl sorry, I think I'm still confused. There's no password field in the 1Password UI. Are you saying the fact that a 1Password icon is shown will cause someone to just start typing their account password?

Folks who are using this on a regular basis will not be expecting to type a password at all because we never ask them to, so it's not a muscle memory thing. And I have a hard time believing that folks who don't use this UI regularly will just assume they should type their password here.

As for a malicious actor, yeah, that will always be a threat, whether or not we have an inline menu.

@tiltowaitt yeah I think we have some things to work on there. Have you tried Chrome, Firefox, or Brave? I use Brave as a daily driver, and the extension is pretty snappy there.

@1P_Rob I have not. I don’t use those browsers.

@1P_Rob exactly. That in-line prompt will be weaponized at some point so it does show a password prompt, and a substantial minority of users will just think it's an upgrade (how many people still click links in inbound emails after all). It doesn't provide any real utility, causes UI problems when it pops up, and adds risk.

At the very least we need a way to turn it off and just use the toolbar icon.

That in-line prompt will be weaponized at some point so it does show a password prompt,

I see what you're saying. I just don't see the risk as that much greater than if the thing never existed. Either way people could/would just see it as a new feature. The best we can do is provide a consistent way to actually unlock 1Password so that anything different from that is regarded with suspicion.

At the very least we need a way to turn it off and just use the toolbar icon.

Ah, that you can do, at least partially. In the settings for 1Password in your browser, turn off "Show autofill menu on field focus":