Secret Key storage in iCloud keychain -- toggle?

12 replies
128 views

Hi there,

I have read through some explanations of why the Secret Key is safe to be stored in the iCloud keychain by default, but I'd really rather it just weren't. Is there any way to turn this behavior off?

If not, can you give me a good explanation of why you think the iCloud keychain is so secure that it warrants this kind of privilege? It has 2fa, requires my password, I'm aware of all that -- I'm pretty happy with iCloud keychain security -- but I choose 1password to store my passwords in because I've been happier with yours, but not needing my secret key on a new device doesn't make me happy.

It seems utterly bizarre to me that a company so focused on security would not have it be an option, but it looks to me like it's not -- I'm hoping it's just not obvious where it is.

Please let me know how to turn it off :) :) :)

Pinned Reply By 1P_Dave

Hello @onlyanegg! 👋

Welcome to the community! When you add your 1Password account to the 1Password app on one of your Apple devices (such as a Mac, iPhone, or iPad), 1Password stores an encrypted version of your Secret Key in the iCloud Keychain which is securely synced to all of your Apple devices. The next time that you need to add your 1Password account to another device you'll only be asked for your account password since the 1Password app will retrieve your Secret Key from iCloud Keychain.

The Secret Key is stored encrypted and can only be accessed by you. This process safely and securely backs up your Secret Key and saves you from having to type it into all of your devices. You'll always need to enter your account password, which isn't stored, in order to decrypt your data and access your passwords and other items.

The only way to stop the encrypted version of your Secret Key from syncing to iCloud Keychain would be to turn off iCloud Keychain on all of your Apple devices. Then, the Secret Key would still be saved to the local keychain but it wouldn't be synced to your Apple account.

-Dave

View in thread

1P_DavePinned

1Password Employee

Hello @onlyanegg! 👋

Welcome to the community! When you add your 1Password account to the 1Password app on one of your Apple devices (such as a Mac, iPhone, or iPad), 1Password stores an encrypted version of your Secret Key in the iCloud Keychain which is securely synced to all of your Apple devices. The next time that you need to add your 1Password account to another device you'll only be asked for your account password since the 1Password app will retrieve your Secret Key from iCloud Keychain.

The Secret Key is stored encrypted and can only be accessed by you. This process safely and securely backs up your Secret Key and saves you from having to type it into all of your devices. You'll always need to enter your account password, which isn't stored, in order to decrypt your data and access your passwords and other items.

The only way to stop the encrypted version of your Secret Key from syncing to iCloud Keychain would be to turn off iCloud Keychain on all of your Apple devices. Then, the Secret Key would still be saved to the local keychain but it wouldn't be synced to your Apple account.

-Dave

pquimo

I humbly request adding a toggle to turn this off please. I also do not want this behavior. You have lots of settings to let us choose between convenience and security, and this is a case where I want the option.

1P_Dave

1Password Employee

@pquimo

Your Secret Key is stored in the Apple Keychain in an encrypted form protected by Apple’s platform security architecture. Access to Keychain items is restricted by the operating system and tied to the security of the user’s device and account.

Importantly, the Keychain data alone is not sufficient to add your 1Password account to another device. Your account password is always required to decrypt your account data, and if two-factor authentication is enabled, that authentication is also required before the account can be added to a new Apple device signed in using your Apple Account.

That being said, can you tell me a little more about your concerns? I would be happy to share your feedback with our team.

-Dave

pquimo

I'd be happy to share more about my concerns. Just for context, I am a software developer and security consultant, so I understand the tradeoffs and options reasonably well. I understand the other layers of protection in place, and that this only skips one of them and only when I authenticate my Apple account.

For me, it's a question of me being the one to make the decision. I want to decide who I trust and how much. I admit, I trust Apple far more than Google or Microsoft or probably any other massive tech company. But I trust you folks at 1Password more. I chose 1Password back in I think 2013, and have never regretted the choice. I teach online security to my friends, family and in my podcast. I enthusiastically recommend 1Password. I choose 1Password, not Apple, to trust with my passwords. You deciding to extend that trust to Apple without warning me, asking my consent, and what's worst of all, without providing an option to decline that consent, I find disappointing.

You've continued to add options that users can choose to balance between convenience and security, like the ability to unlock your vault with your device. I'm so grateful that's an option, because I will never turn it on. I just want this to be an option too, like so many others you have.

To be clear, I am not demanding this. This is not remotely a deal breaker for me, especially since there's a relatively easy work around by disabling the Keychain syncing. But I see little downside to adding this option. Obviously I don't know the internal code of 1Password, but I know coding well enough in general to have some level of confidence in asserting that it would not be a huge work effort to add this option. Therefore, I once again humbly request you add the option to toggle this off.

Thanks for listening. The 1Password community forum is definitely one item on my (very long) list of reasons I love and promote 1Password frequently.

pquimo

Thank you for that additional information. It's a good point. I have a close friend who used a different password manager a few years back, and ended up losing access to all their passwords. Helping customers avoid having this happen to them is definitely a priority, and probably even a reasonable default (I grudgingly concede :), given the tradeoffs for the average user. Most people would probably find it a welcome surprise to have it work on a new device with just their master password or even more likely not be surprised at all because by the time they setup a new device, they have forgotten entirely about the Secret Key being needed.

I'm sure it would be tough to explain these tradeoffs effectively especially without scaring or confusing people. Tricky.

Thank you.

1P_Dave

1Password Employee

Thank you again for the thoughtful feedback and for sharing your thoughts on how 1Password can be improved in the future. 🙂

-Dave

J

jbclements

I very much agree with this concern; I recently got a new mac, and when it only asked me for my master password, and not my secret key, I was appalled; it was a bit as though someone had helpfully unlocked my house while I was out.

More specifically, as a user of 1Password I really really want to know what an attacker needs in order to sign into 1Password on a new device; that would be unbelievably bad. Until today, I believed that even if an attacker had my secret password and could log into my Apple ID, there would still be no way for them to obtain access to my 1Password vaults. You’re now telling me that that is *wrong*, and that an attacker with my master password and the ability to log into my Apple ID has access to my entire 1Password vault.

To be fair, you’re telling me that I’ve been wrong for a long time, so perhaps that’s on me. At a minimum, I think it would be a really good idea for 1Password’s security whitepaper to clarify what an attacker needs in order to obtain access to all of my passwords. TIL that master password + Apple ID access is enough.

J

jbclements

As I mentioned in a separate thread, I think that 1Password should clearly state that someone with access to your iCloud keychain and your master password can obtain your secret key, and therefore access to all of your secret data.

1P_Dave

1Password Employee

@jbclements

Welcome to the community! Your 1Password account can only be accessed if you have all three of the following:

Your email address.
Your Secret Key.
Your account password.

Encrypted copies of your Secret Key are stored in your device backups and keychains to provide data loss protection and to make setting up 1Password on another Apple device where you’re signed into the same Apple account easier. Someone would need to access your Apple Account and also already know your 1Password account password in order to access your 1Password account. The information stored in the iCloud Keychain is accessible only to you and not even Apple is able to access it.

You can find this documented here:

Our support website: About your Secret Key
Our security white paper: White Paper (section A.10.2: Locally exposed Secret Keys)

Note: You have to be signed into an Apple Account and have iCloud Keychain turned on for this feature to work. If you wish, you can choose to turn off iCloud Keychain sync on all of your Apple devices if having your Keychain synced to your other Apple devices doesn’t meet your personal threat model: How to turn on iCloud Keychain

You can also consider enabling two-factor authentication for your 1Password account to add another requirement to setup 1Password on a new device: Turn on two-factor authentication for your 1Password account

-Dave

J

jbclements

Thanks for your reply! As far as I can tell, you’re agreeing with me. If an attacker has access to my Apple ID, and my secret password, they can get access to my secret key, and then to all of the passwords contained in 1Password.

It sounds like you’re saying that Apple IDs are very secure, and it would be quite difficult for an attacker to obtain access to your Apple ID, so your passwords are relatively secure. This isn’t a terrible security model, but if it’s your security model, then I would make these two observations:

Your security whitepaper should definitely state that an attacker with access to your Apple ID and secret password can obtain your secret key, and access to your 1Password account.
If using 1Password requires that I trust that my Apple ID is secure, then what you really seem to be saying is that I should just store my passwords in my iCloud keychain, and stop paying money for 1Password. Historically, the reason I’ve found it worth paying for 1Password is that it represents a stand-alone single most-secure point of security. If this is not the case, then I see no reason to pay for 1Password.

1P_Dave

1Password Employee

@jbclements

Thank you for the reply. Our support page already documents this feature:

Have peace of mind if you lose a device. Encrypted copies of your Secret Key are stored in your device backups and keychains to provide data loss protection. If you have iCloud Keychain turned on and lose your Mac, iPhone, or iPad, you can restore from a backup and unlock 1Password with just your account password. It’s the same for Android backups.

If this feature doesn’t fit your personal security threat model, you can disable iCloud Keychain sync. This feature is enabled when you sign in to your Apple devices with an Apple Account. Once disabled, your Secret Key won’t sync to your other Apple devices.

Even if someone gained access to your Apple Account, they would still need your 1Password account password and, if multi-factor authentication is enabled, your 1Password account’s second factor. The Secret Key stored in iCloud Keychain alone isn’t enough to access your 1Password account.

I’ll also share your feedback about our documentation and security white paper with our technical writing team. I hope this helps clarify things.

-Dave

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO