User verification when signing in with a passkey

Hello ​@cr3! 👋

Thanks for reaching out! Whenever you visit a protected site, 1Password now checks the authentication level requested by the site and prompts you for additional verification when needed. This helps ensure that passkeys grant the right access to the right person every time.

Whether additional user verification is required is determined by the website that you’re signing into and not 1Password. 1Password just respects the authentication level that is enforced by the website in question.

That being said, our team will continue to work with our friends at the FIDO Alliance to make saving and signing in with passkeys as convenient as possible and all of your feedback is being tracked internally. 

-Dave

Thanks for the answer, that is at least clear. It is not a desirable behaviour; this is making sign in more difficult for websites that can now request this. But, if there is no plan to offer configuration to go back to the previous behaviour, I guess we’re gonna have to live with it.

Passkeys previously worked great for a long time with 1 click in the browser, please add a setting so we can go back to 1 click login with passkeys.

For some people the extra passkey security is great, but I’ve already unlocked my Mac and 1Password, so I should be able to continue logging in with passkeys with 1 click. This is a major downgrade to the ease of use. So exhausting having to lift my hand away from keyboard and mouse to use the TouchID sensor on Mac. 1Password used to be about ease of use, but lately there’s been so many extra steps just to login now. It’s so annoying having to use TouchID or Mac password to login to every website.

Respecting the website wanting to verify passkeys has little impact on the user on an iPhone with the quick FaceID, however on a Mac it downgrades the ease of use.

Because of this, I along with other users will now just downgrade back to using username and passwords for all of our logins because of the ease of use with 1 click login.

I would argue that if the current 1Password session has been biometrically authenticated once, it should not pop every time, even if the site requests it. 1Password can happily attest “yes, that’s the user”. We have various options to lock automatically lock 1Password to our own comfort.

From the spec, depending which you are citing, the intent of Passkey User Verification is “...to distinguish individual users”, which the 1Password session is already aware of and can attest to.

In essence, I disagree with 1P’s interpretation of the spec. It is surprisingly user unfriendly.

This needs to be changed. Every time I sign in with a passkey on my Mac, I get two boxes. First Apple's box asks me to click Continue. Then a second box says the site "requires authentication for this passkey" and makes me type my Mac password. It does this in both Edge and Safari.

The ironic thing is that I sign in to the same site with the same passkey in 1Password on Windows and it doesn't ask for anything. Same product, but you don’t follow the site’s request in Windows?  On Mac the site asks for verification and I have to type my Mac password every time, after already clicking through Apple's box.

I'm already signed in to 1Password. That should be enough. If the vault is unlocked, the site should just get the passkey. Making me type my computer password every time is annoying, and it makes passkeys worse than a regular password with autofill.
 

Adding my voice here. This change has made passkeys meaningfully worse than passwords for me, which seems like the opposite of what 1Password is trying to achieve.

As of this week, every passkey sign-in in Chrome on macOS triggers the system prompt ("1Password Browser Extension is trying to use a passkey") and asks for my Mac password. It happens every single time: whether 1Password is locked or unlocked, in a normal or incognito window, with no grace period and no "remember" option.

The result is absurd: signing in with a saved password and OTP is now faster and less friction than using the passkey. I already authenticated to 1Password. Being forced to re-authenticate to macOS on top of that for every login undoes the main reason I use a password manager and the main promise of passkeys.

I understand the intent of honoring a site's user-verification requirement, but there has to be a better balance. A few options that would fix it:

- Treat an unlocked 1Password vault (unlocked with biometrics or my account password) as satisfying user verification for a configurable window
- Add a grace period, e.g. don't re-prompt for X minutes after a successful verification
- Give users a setting to control this behavior

Right now the experience actively pushes me back toward passwords. Please reconsider or make this configurable.

Agree with all of the other comments here. This is unacceptable, fundamentally misunderstands the standard, and eliminates the primary advantage to passkeys. This is not something that needs changed at the FIDO alliance, this is 1password misinterpreting the requirement.

This change has me seriously considering abandoning passkeys in favor of password+otp. The change must be reverted or passkey use is going to suffer.

I agree with bs87--going back to passwords, as this misinformed implementation by 1Password negates the full benefit of a password manager.

Also agree with all of the user comments. I have now stopped using passkeys in favor of userid/password as it is much quicker/easier. As one comment noted, it’s not such a big deal on my iPhone with faceid, but on my Mac it’s totally annoying to have to use touch ID EVERY time I log in to a site. Since all of my hundreds of online services/accounts still have userid/password support, I’ll just go back to using that approach which is a shame. Passkeys are now a pain and shouldn’t be!

Agree with all of the other comments here. This is unacceptable, fundamentally misunderstands the standard, and eliminates the primary advantage to passkeys. This is not something that needs changed at the FIDO alliance, this is 1password misinterpreting the requirement.
This change has me seriously considering abandoning passkeys in favor of password+otp. The change must be reverted or passkey use is going to suffer.

+1 to this. This has me forgoing passkeys in situations where they would clearly increase security. The FIDO standard is clearly satisfied by biometric authentication within the 1pw session, rather than only at the instant of login.