Please allow PIN unlock in 1P8 Android

Hello! Just adding onto this.
Me and my wife just moved from Lastpass to 1password. We long planned this.

My wife has a screen cover (glass) that essentially makes the fingerprint reader non-functional, unfortunately we can't remove that one since we have two children and the phone falls once per day.

Unfortunately with 1password she will now need to either: change the master password to a shorter, unsafe one, or type a long password every time she uses 1password to insert passwords (error prone).
I already increased the "keep unlocked" time to 30 minutes, but feel uncomfortable doing so.

I'd highly vote for this feature: it could use a PIN, or the phone "sign" to unlock, this would make it straightforward.

Thank you for your assistance.

Out of curiosity, how would PIN Unlock work?
- After reboot (or logout/login; e.g. Chromebook), I'd want to enter my 1pw before the PIN is automatically activated. [But maybe a Setting would allow users to disable this.]
- After X number of failed attempts, I'd want the PIN deactivated; such that I must enter my 1pw before the PIN is activated again. [User's may want a Setting to control X.]
- Would there be an option to have the PIN timeout? e.g. Y mins/hours/days. i.e. after the timeout, the PIN would be deactivated; after entering my 1pw it would be activated again.
- Would there be a way to quickly select PIN deactivate; i.e. I don't want to wait for the timeout or I'm not using the timeout feature.
- Would there be a minimum PIN length? e.g. 4 or 6? I assume the maximum length would be large; e.g. 20.
- Would setting up the PIN (and/or Watchdog) warn against a poor PIN? e.g. 1111 or 1234
- Would the PIN only be numeric, or can I have a character PIN? e.g. s#8J

I have an interest in the PIN for the Chromebook, since 1PW does not support biometrics on the Chromebook.

Hi @FireDragonDoL, thanks for sharing your feedback.

You raise a great use case here. I can certainly see the benefit of a PIN unlock option in this situation (and many others raised by folks here).

As long as the account password is unique and random, the Secret Key does most of the heavy lifting. That being said, I understand that typing even a ten character password repeatedly can be a pain on small screens. I've shared your use case and "+1" with the team.

Hi @robert1p, these are great questions and we are certainly considering some if not all of them as we discuss implementing PIN unlock on the mobile apps.

At the moment, I don't have answers for any of these questions but I can share some context as to how PIN unlock worked with 1Password 7 for Android.

With 1Passowrd 7, PINs were four numeric characters. You could set a PIN but it did not replace your account password to the same extent as Biometric unlock. With PIN unlock on, you could unlock 1Password with the PIN if the app was locked but still running in the background. If 1Password was removed from Recents, exited completely, the device restarted, the PIN was entered incorrectly enough times and in a few other situations, the account password was required to unlock the app.

If PIN unlock returns to 1Password 8, I'm excited to see how we optimize the feature with a balance between security and usability. Thanks for sharing your thoughts, I've passed them along to the team.

Thank you for your response @1P_Timothy

I remember in a different password manager, when using the fingerprint reader (native), there was the option to "use sign" (the phone sign from the lock screen). That would be sufficient too, I'm not sure if that's of any help, I thought it would be handled natively by the phone.

Either way, appreciated your time, having a response is really valuable, thank you 1password team.

FireDragonDoL raises an important feature design question.

Do the requestors of this feature:

(A) require an arbitrary PIN, because perhaps they're trying to keep folks who know their lock screen PIN from getting deeper access to their 1P credentials

or

(B) are satisfied with the lock screen credential (which might be more secure under the hood)? And how many are on Android 11 or higher, meaning the latter could be implemented using Keystore's AUTH_DEVICE_CREDENTIAL, delivering some real security?

My preference:

B, yes (13)

@1P_Timothy, Thanks for the info.

Regarding the "remove from Recent", I'd prefer that it not disable the PIN. Let it run in background and maintain PIN usability. I would expect Force Stop to disable, but not Recent. [Another case for a user Setting.]

You are very welcome @FireDragonDoL! Using some of the in-built unlock options such as PIN and pattern is a great idea and, to my knowledge, it's something we've looked into in the past as well.

@arbitraryreadwrite thanks for the additional input here. From the conversations I've had there are a lot of unique use cases and I imagine it will be challenging to get it exactly right for everyone. If we implement PIN unlock, we will certainly be striving for a balance between convenience and security while taking in some of the points you raised here. Perhaps an option to select either would be beneficial?

To clarify @robert1p, 1Password 7 for Android could continue using PIN unlock as long as the app stayed open in the background. If it was closed completely by force stopping, removing from Recents or through other methods, the account password would be required to unlock.

There are currently no specifics to provide regarding if PIN unlock will be added to 1Password 8 or how exactly it would work. I really appreciate your input however and have shared it with the team.

Thanks again everyone!

I believe you missed my point. My preference is to have the app remain open in the background after I remove if from Recents; i.e. there are plenty of apps that run in background when removed from Recents. Thus, I'd prefer 1Password continue in background so that I can still use the PIN.

Ah, thanks for adding that @robert1p. While features like Autofill will continue to function, removing 1Password for Android from Recents does, and has always locked the app. I'd be happy to pass along your interest in a change here though! Thanks again for sharing your feedback and taking the time to clarify things for me.

+1 - I am considering migrating from LastPass to 1Password, but I absolutely can't do that unless PIN unlock is an option. Biometric simply doesn't work for me. I would use the old version of the app, but I have no way to get a guaranteed safe version of the APK.