Passkey unlocked using device passcode

I agree with the above scenario! Very worrisome that 1Password can be opened by only a phone's passcode, if I select the unlock with Passkey option! In my opinion, that is a big security design flaw! I will not be turning that option on.

Apple in the new iOS 17.3 beta, is finally implementing some protection if someone steals your phone and is able to obtain your phone's passcode. They have added much needed protection to critical elements of your phone. Like requiring only biometrics to unlock your iCloud (Keychain) password database. The iPhone's passcode is no longer a fallback to unlock your iCloud (Keychain) password database, unless you are at home or work. But this new protection in iOS 17.3 will not apply to 1Password.

In my opinion, having a phone's passcode to unlock 1Password is a big step backwards in security for 1Password.

This is a fantastic question! I have this same concern. Using long and complex passwords for mobile devices can often be impractical, so I’d imagine that for the average 1Password user, their account will be less secure if they go down this passkey-only route (especially if they are using multiple devices).

I think having an option to disable the fallback and only unlock with biometrics would be vital. (There are always the recovery codes if something really goes wrong anyways).

I’m a big fan of passkeys for other logins through 1Password, but a password manager is only as secure as the master password and with this approach it will now be only as strong as your iPhone or Apple Watch passcodes.

The process for unlocking 1Password with a passkey is described as: “…you can unlock 1Password by using biometrics or, as a fallback, the passcode that protects your device.”

When using an iPhone, does this mean that 1Password operates by first using Face ID to unlock the application – and, if that fails, then it accepts the device passcode (i.e., the PIN used to unlock the phone)?

If so, is there an option to configure 1Password on iOS to accept a user-specified PIN in place of the device passcode?

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser: Not Provided

So, it’s not only me having this concern!

Hopefully someone from 1Password will clarify the actual behaviour and the reasoning behind.

I also share the concern and if it is indeed the case that no extra PIN can be set and the telephone PIN cannot be switched off as a fallback, I would not use the function.

It seems that this feature depends on the secure element of the phone, just like the screen lock. Perhaps 1Password support can confirm or deny this.

More details from Dave here:
https://1password.community/discussion/143256/why-passkey-login-to-1password#latest

I’m afraid I’ll stick to master password to protect my 1Password.

There is a middle ground here

If 1P allowed use of yubikey passkey on android then you could store the passkey in a yubikey and not rely on android security to protect you

But so far yubikey only works on windows and not android

iPhone I've no idea

Hello everyone! 👋

Thank you for the questions! If you choose to sign up for the passkey unlock beta then you'll need to store your passkey somewhere safe like iCloud Keychain or Google Password Manager. To add your 1Password account to a new device you'll then need two things:

1. Your saved passkey.
2. Authentication from an existing trusted device where you're already using your 1Password account.

After you add your account, how you'll access your passkey for 1Password will depend on where you've stored it. If you've stored your passkey in iCloud Keychain then you'll use Face ID or Touch ID to access your passkey. If Face ID or Touch ID fails then iCloud Keychain will fallback to your device passcode which can be made more complex if you wish: Use a passcode with your iPhone, iPad, or iPod touch - Apple Support (CA)

The device passcode is required by iCloud Keychain, where you've saved your passkey to unlock 1Password. The prompt to use your device passcode does not come from 1Password itself.

If using your device passcode to access the passkey that unlocks 1Password doesn't fit your threat model then you can continue to use an account password and Secret Key to unlock your 1Password account instead.

Let me know if you have any questions. 🙂

-Dave

Thanks for your answer Dave.

If I understand correctly:
- the passkey needed to unlock 1Password resides outside of 1Password itself, of course.
- The policy to secure that passkey is demanded to who hold it, iCloud Keychain in this case.
- Apple policy is to fall back to device passcode is biometric fails.

If I rely on Apple iCloud keychain to unlock 1Password, it is like having all my credentials stored there, security-wise, as it will be possible to access all 1Password vault content with the security policy used to protect the passkey, falling back a 6-digits code for example.

With this in mind, I will personally stay with master password for 1Password.

Thanks for your time explaining this!