1Password 8: account password required every 2 weeks?

@philippemercure Have you considered ever making your Account Password a memorable Password from the generator? That's how I have mine set up, so much easier to remember and to type.

I would also like to had my voice to this. I have a master password of more than 50 characters, more then half of it that I don’t even know by hearts, since it is store in a Yubikey, the rest is in my head. I kinda consider my master password pretty strong. I also have a physical copy of my master password in the even of my death store somewhere that I could use if I wouldn’t remember my master password for xyz reason. For the sake of people already using strong passwords with 1Password, couldn’t you allow password above a certain length to not require the 2 week verification. If you think that 50 is not enough, pump it to 100 characters, I wouldn’t mind having a longer password. But I mind having the need to type my master password every 2 weeks because of people that are not able to remember their master password correctly. Thanks a lot. Philippe.

Thank you for adding your perspective to the thread. I also want to add a brief update that i believe others have mentioned as a suboptimal consequence of the "2 week" policy. I have had to change my master password to a easier-to-remember phrase as the insistence of my wife. Of course, that makes it less secure.

Hi Folks!
Thanks Backspaze for alerting me to this thread! There's seemingly a lot going on here, but am I to understand that next release of 1Password on iOS is going to force users to re-enter their master password every two weeks regardless of any other setting?

If that is the case, that would be (to keep it family friendly and put mildly) sub-optimal. Folks have raised significant points as to why that's just not a good idea here and in the https://1password.community/discussion/127160/never-option-removed-from-require-master-password. It would be a bizarre decision that is neither 'balanced' nor rooted in any scientific evidence of efficacy to achieve the stated 'users can't remember their passwords' goal. Moreover, and this is what is most troubling, it's making everyone more vulnerable and less secure.

To keep this solutions orientated though, I'll echo support for an 'enter MP once and it applies to all systems' type of scheme. Entering the password on a computer, even as unnecessary as it is there too if you've got biometrics, is far more preferable than trying to type complex passwords on a phone.

Hope they seriously reconsider this entire movement. Not sure even casual users are going to be okay with this. They do seem like they listen to folks every now and then, so maybe they'll see the pushback and adjust course.
[Note: to the support folks monitoring these threads; no anger directed at you all. You've got tough jobs, so thanks for hearing folks out and passing along feedback to the developers.]

Hi @tprattfl !

The 2 week requirement is a deal breaker for my wife and she wants to go back to the other password keeper. She wants a password keeper to "just work" and not bug her for the master password.
Same here! For me, it is okay to type in the master password. But my wife is using 1Password maybe only once a month. That means that she always has to enter the master password. Every time she has to enter it, I have to help her out because she is not remembering it. That's a pain for her and me... 😕

I want to add my voice to this discussion. We are new to 1Password coming from a competitor. The 2 week requirement is a deal breaker for my wife and she wants to go back to the other password keeper. She wants a password keeper to "just work" and not bug her for the master password. Please let us know if this is going to change so we can decide whether to stay or go. Thanks.

Hi @acarling:

Thanks for your additional thoughts on that!

Jack

Jack_P_1P

Thanks for your response, I just had a small additional thought about the ”2 weeks on any device” structure.

If you did that it would make sense to slightly tweak the timing based on type of device, to make cross-platform users most likely to have to enter their password on device with easier text input.

Suggestion:
Expire login on mac/pc/web after 14 days of no password entry on any platform.
Expire login on mobile/ipad after 17 days of no password entry on any platform.

(+3 days is intended to account for a full weekend of no computer use)

Hi Backspaze:

Thanks for following up! To clarify, even with TPM support enabled for 1Password 8 for Windows (creating a similar situation to "never"), after 2 weeks, you'll still be prompted to enter your account password. The same situation would apply if you hadn't restarted your device, or quit 1Password for 2 weeks if TPM support wasn't in use.

I think the ideal here would be 2 weeks after you entered your account password on any device, not just the device you're currently using. I'm not in a position to make promises here, but it is definitely something we're aware of.

I'll share your thoughts about "after device restart" being a selectable option for 1Password 8 for iOS as well.

Jack

DenalB thanks for bringing that up, as I wasn't aware of that thread. The discussion in that thread seems to have died out since the middle of March, but I noticed that @keinanesq had already mentioned some of the points I brought up in this thread as well, with the main inconsistent thin in all of this being the removal of the "never" option on iOS while at the same time adding the option on Windows. This inconsistency hasn't been addressed by AgileBits as far as I'm aware. Maybe @ag_kevin Jack_P_1P 1P_Ben or someone else from AgileBits could elaborate on this?

I might add that I don't need or want the "never" option, hence why I didn't even notice the removal of that option on iOS. I'm only interested in bringing back the option "after reboot" in 1Password 8 on iOS, as that was my preferred setting, but I understand the other use cases for those that want the "never" option as well. As long as it's implemented as an option tucked away in the settings, with (multiple) warnings when choosing the option, I don't see the problem. Hiding the setting somewhere deep down in a menu and having the warnings when enabling it should be enough to scare of the users who'll probably be most likely to forget their password. And if you do forget it you have to rely on the emergency kit and/or other family organizer/administrator for help with gaining access again.