1Password 8: account password required every 2 weeks?

1P_Ben
I really don't want to be forced to ever type my master password. I can use biometrics or yubikey but please don't force me to type the master password every 2/3 weeks. I like the idea of adding this as a hidden feature under some developer options for power users if you don't want to make it available for everyone.

I just don't get the reason you want to force users to type their passwords. When I created an account I was instructed by 1Password that I should make a copy or print the password and store it in a safe place. I've generated secure, long master password because it's the most important password after all. If someone has access to it, they have access to all my passwords. I don't want to change my master password to something sort/easy so that I can type it quickly, especially on mobile.

Btw have you considered a case where the 1Password user wants to login onto some website and they are forced to enter their master password in a place like a bus or other place where someone may be watching what you're typing? A thief can just see the master password that way, then stole the device and access whatever they want.

It seems like LastPass found a better, more convenient way for handling this:

skatch You're setup is very similar to mine, I agree if I'm typing it out on my computer constantly, would prefer less on mobile with the Pin option.

1P_Ben thanks for keeping us updated on this!

Fingers crossed. 🤞 😃

Ben

Their suggestion was that the timer reset be synced, but that we set the timeout to 3 weeks on mobile and 2 weeks on desktop.

This seems like a good idea! 🙂

1P_Ben
Thanks for your suggestion. I think it will help a lot, although it's not that perfect as it sounds. But it is better than typing the password on every device after 2 weeks... 👍

EDIT:

but that we set the timeout to 3 weeks on mobile and 2 weeks on desktop
Sounds much much better. 😘

Backspaze

Thanks for that. I don't know that "after reboot" is completely off the table, but based on the current discussion I think this proposal is more likely to be the one to run the gauntlet.

skatch

Great idea. One of our developers had thoughts along the same lines. Their suggestion was that the timer reset be synced, but that we set the timeout to 3 weeks on mobile and 2 weeks on desktop. This would make it much more likely that the prompt for MP hits your desktop devices vs mobile devices, particularly for those such as yourself that are regularly using a desktop.

Ben

1P_Ben thanks for following up and pushing for this. My opinion is that syncing the 2 week password entry period across devices would be a significant improvement over each device having an independent 2 week expiration timer. However it would still be a pain if the 2 weeks ended when I'm using my iPhone, and avoidable in my case since I use 1Password on my computer all the time. If possible, I'd rather see a system that takes into account the device type, and prioritizes password entry on physical keyboard-based devices.

This is my situation:
- I use 1Password on 2 computers every single day. I don't mind having to type my password here occasionally.
- I use 1Password on my phone a couple times a week. I never want to manually type my password here for the reasons already stated (allowing for rare circumstances – e.g. my device's biometric enrollment has changed).

I know that what I'm suggesting is more complicated than what you've proposed (needs thought around a lot of different device type combos & usage frequencies). But if the goal is to make the use of a password manager frictionless, I feel that taking into account where password entry is requested is important. However, if this level of nuance isn't possible, then your "sync 2 week entry period across devices" proposal would at least do a lot to reduce the pain of the currently implemented biometric timeout.

1P_Ben I'll quote myself below from https://1password.community/discussion/comment/636642/#Comment_636642, but if that request is out of the question, then sure, I'm all for syncing unlock time. Anything is better than the current state.

I'm only interested in bringing back the option "after reboot" in 1Password 8 on iOS, as that was my preferred setting, but I understand the other use cases for those that want the "never" option as well. As long as it's implemented as an option tucked away in the settings, with (multiple) warnings when choosing the option, I don't see the problem. Hiding the setting somewhere deep down in a menu and having the warnings when enabling it should be enough to scare of the users who'll probably be most likely to forget their password.

Awesome. Thanks @volcom45. It is something I'm pushing for us to try out, if feasible. 🤞

Ben

1P_Ben This would be huge for me! I'd love that idea entirely. I hope that you guys are able to put something like that in place. :)