Request: Turn off username guessing in the apps [RESOLVED]

Hey iwaddo ,
Great questions!

The permissions description that are given by the browser(s) is very general and vague, and I can definitely understand why you find it threatening.
Although our permissions article is a tad outdated (it lists the permissions for the 1Password 7 extension in Safari), it is still relevant here: https://support.1password.com/browser-permissions/

You'll want to look at Firefox/Chrome/Edge/Brave's permissions there as they are more relevant to the new extension's permissions in Safari.

The gist of it is that 1Password needs permission to do very specific tasks, but there are no specific descriptions for such permissions, only several major and general permissions descriptions that the browsers provide. So if 1Password needs to be able to autofill on a page, it will need to be able to read the page's content, locate the relevant fields, then inject your data into the fields. Simple, right?

Well, from a permissions perspective, that translates to "1Password needs to be able to read the data on all webpages you visit and modify data" - sounds much scarier than it actually is.

To answer some of your other questions:
- Some other extensions require the same permissions, other require other permissions. Depending on the extension's purpose and what it does. For example, an extension that keeps the browser from being idle will not need access to web pages content so there's no need for the permission to read/write all websites data. But an extension that blocks ads will indeed require that permission.
- 1Password for Safari does require more permissions than the 1Password 7 extension because it is an independent extension that can function without the desktop app, and therefor requires it own permissions. The 1Password 7 extension is bundled up in the desktop app, to which you already granted permissions on your computer.

At the end of the day, it is great that you remain vigilant and are not blindingly approving stuff and granting permissions without asking questions. You just need to make sure that you know and trust the vendor of the software you are granting permissions to, and that you have installed the official software from that vendor and not some dubious knockoff/fake version that might be malicious.