Protect what matters – even after you're gone. Make a plan for your digital legacy today.
Forum Discussion
1Password Account marked Vulnerable
I recently ran a workshop to help Mac users get savvy with 1Password. Among 9 participants, after enabling Check for vulnerable passwords in the app's Privacy settings, at least 2 found that their 1P...
1P_Timothy
Community Manager
Community ManagerHi earthsaver, thanks for writing in! That sounds like a great workshop.
I'm not aware of a bug causing passwords to be erroneously flagged as vulnerable. Were your participants seeing this in 1Password for Mac, the 1Password extension, on 1Password.com, or somewhere else? I'd also like to ask to confirm if you're referring specifically to the "Vulnerable password" banner (example below) and not another Watchtower alert category?
Without revealing any specifics about the passwords in question, could you share any more details about why it seemed odd that these passwords were marked as Vulnerable?
Thanks again!
Thanks for your response, Timothy! My participants experienced this in 1Password for Mac. I encouraged them to enable the check for vulnerable passwords and they immediately found their 1Password Account item listed in this Watchtower category.
One disabled and reenable the setting and found the item disappeared from the list. The other's record remained in the list. The first oddity for this user is that they never used this password for anything else nor shared it with anyone. Further, though, they changed their account password to something else unique and still the record appeared in the Vulnerable list.
- 1P_Timothy
Thanks for sharing those details earthsaver!
Even if a password is only used as an account password, and hasn't been shared it could still appear in a breach if it was somewhat generic. For example, if a participant was a fan of space travel and chose the password rockettothemoon they would find it was vulnerable (appearing in 104 breaches according to Have I Been Pwned) even if that's the only place they used it.
If it was still showing as vulnerable after updating to something unique that our password generator might create, such as abrupt-vita-starve-bouquet, that would suggest to me something may not be working as expected on our end.
This sort of behaviour can be difficulty to diagnose second hand. We would be happy to help both participants if they're interested in getting in contact with our team. They can open a ticket with our chatbot, or email support@1password.com with a description of the issue.
Let us know what you think, and thanks again!
