Two accounts - now needs two different passwords every time you login?

Hey @Xacto:

Thanks for being with us for so long! This new behavior has a few benefits. If you're using multiple unique account passwords, it helps ensure you don't forget them. With the old approach, it would have been possible to unlock 1Password for months without ever using your second account password, and potentially being locked out of your second account. Additionally, because each account password only unlocks the account(s) it goes with, it allows for administrators to ensure that their password policies are being followed. Finally, it allows for a more consistent experience. The previous behavior unlocked using the first 1Password account added to the 1Password app, and if your accounts were added in a different order across your devices, you'd end up with different unlock passwords and not know why.

On Mac, Touch ID or Apple Watch unlock is able to unlock all 1Password accounts that have been unlocked with an account password (even if they're different), and similarly on Windows, Windows Hello is able to do that as well. We're pretty thrilled with what the new unlock behavior brings to the table, so it's unlikely the old unlock behavior will make a return, even as an option.

Jack

A few comments on this:

1. I don't even know the master passwords for some of my subsidiary accounts... because I store them in 1Password. They're 30 character random strings for increased security. Now every time I need to enter one of them, I need to remember to copy it to the clipboard (less secure) before bringing up the unlock screen (because there's no way to access passwords in an unlocked vault while that dialog is up, and then paste it.
2. Even if I set them all to the same (weaker) password, typing the same password over and over again to unlock them again every 10 minutes is still more of a hassle, not less. Yes, there are still people using Macs that can't authenticate with Apple Watch / Touch ID.
3. We’ve all collectively spent decades trying to get people to not reuse passwords. This really compromises that effort.

"Additionally, because each account password only unlocks the account(s) it goes with, it allows for administrators to ensure that their password policies are being followed." is at counter purposes with the recommendation to use the same master password for each account.

"The previous behavior unlocked using the first 1Password account added to the 1Password app, and if your accounts were added in a different order across your devices, you'd end up with different unlock passwords and not know why." is easily solved by letting the user choose which account should unlock the others.

"On Mac, Touch ID or Apple Watch unlock is able to unlock all 1Password accounts that have been unlocked with an account password (even if they're different), and similarly on Windows, Windows Hello is able to do that as well. We're pretty thrilled with what the new unlock behavior brings to the table, so it's unlikely the old unlock behavior will make a return, even as an option."

There are still millions of Macs out there that don't support this.

Here's another bad real-world use case. Someone asked me if I had a password for a shared account. I searched for it in 1Password on my Mac, and it didn't come up, so I told them I didn't have it. I realized later when I did a similar search on my phone that I did indeed have it, and it was in a shared vault that was locked on the Mac. Now, "of course", you might say, "how would it know what was in a locked vault?". Which misses the point. This is actively hostile UX.

@roustem I currently have both Personal and Work 1Password accounts logged into my client. I'm hesitant to have the vaults for both accounts share the same password because of the following scenario. Say, I am somehow coerced of forced into surrendering the password for the work account (which is the account I do not own, and do not pay for). The secrets in my personal account would then be compromised. This seems like a true security regression.

@HenryY I see where you are coming from. Please note that your account password alone, without the Secret Key, won't be enough to access the account.

It also would be very unusual for the business to demand your password. The administrators/owners of the business account already have an option of recovering access to the employee account if necessary.

However, the business policies are different everywhere. If you believe that your company could do something like this then it may not be a good idea to keep your personal data on the work device.

@fieldsny

is easily solved by letting the user choose which account should unlock the others.

I had to help many 1Password customers and computer users in general, including my family members. In so many cases, when prompted for a password, people have trouble understanding what password they need to enter. Adding more options would not make it easier.

And just a few days ago, we had a customer losing their data because for many months they unlocked 1Password with the password that was different from their real account password.

I don't even know the master passwords for some of my subsidiary accounts... because I store them in 1Password. They're 30 character random strings for increased security. Now every time I need to enter one of them, I need to remember to copy it to the clipboard (less secure) before bringing up the unlock screen (because there's no way to access passwords in an unlocked vault while that dialog is up, and then paste it.

I had a similar issue myself for one of the accounts that is rarely used. Quick Access (⌘⇧Space) can be very useful here.

Someone made a suggestion to let 1Password look up the account password in already unlocked account(s) and unlock it for you automatically. Perhaps that could be a solution?