Question

Add some more context to the Touch ID modal

4 replies
50 views

The above is the modal I got when asking Claude CLI (and giv “him” permissions to do so) to invoke this command:

op read "op://rgbunhumnzulmueaiee2yifbde/vpooj5dlrzeexf2uf3potehwvm/token"

In the world of AI and multiple process doing parallel work, it would be great for security if you could provide more and better context as to who requested access to what.

In the above example:

Ghostty is the terminal software used. It would be great, if possible, to instead have the name of the program for the process that invoked the given comman.
It would also be great if you could print some info on what command triggered this, e.g. `op` or even `op read`, `gh` etc.

1P_Gem

1Password Alum

Hi @bep, thanks for taking the time to share your feedback.

I can definitely understand how adding extra context to this prompt would allow users to make more informed security decisions about what is actually being authorised. I've filed a feature request with the team, with all of the details you've provided here.

P

pelmered

Yes, I have thought about this a lot for the last months as well. This becoming an increasingly serious problem with both all the agents and the recent supply chain attacks. Each of those would look exactly the same, and I have no idea what I am giving access to with this prompt. We need to see exactly what password/item is being asked about and as much additional context as possible(maybe under an accordian?).

Useful things to should would be things like the full command, and if possible what process/agent inside the terminal asked for this (is it an for example an agent, npm run *, or something else?).

I hope you can prioritize this, because it feels like it is just a matter of time before I either get hacked, my keys leak or my agent does something really stupid with any of the credentials in 1Password.

Trevor_1P

1Password Employee

Hi @pelmered,

Thank you for your thoughtful feedback. I’ve gone ahead and shared it with the team as well.

B

bepAuthor

What’s the status of this issue? Three months have gone and this issue is even more relevant today. I would call it a big security gap in the 1Password software.

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO