After master password change on other device, able to view vault before reauthenticating on app

@TurnerBurn, thanks for getting back to us.

While it might seem odd, we actually do allow for the prompt to be dismissed in our applications. In 1Password for Windows, for example, there is an "x" button to dismiss the prompt. The data is available, but only what is already stored on the device. Not new items will be synced until the authentication with the new account password occurs.

Every device connected to your 1Password account will have a local cache of all vault data that is encrypted with the account password + Secret Key (along with a couple of other things). Here is a similar question from another customer that has several responses from our team that better explain the syncing and the security tradeoffs: https://1password.community/discussion/101453/changed-secret-key-still-able-to-access-vault

For most positive path cases, dismissing the prompt shouldn't be much of a concern, as you're not likely to want to if you're connected to the internet and know your updated password. Since you mentioned what would happen if you lost your device, here are some additional threads and documentation that would assist you with understanding those scenarios:
* https://1password.community/discussion/101453/changed-secret-key-still-able-to-access-vault
* https://support.1password.com/lost-device/#regenerate-your-secret-key-and-deauthorize-the-lost-device

Thanks, Timothy, but the concern here is that the 1password phone app still allowed me to view my vault even though it sensed a master password change done on my PC but not yet done on the phone app. I would expect it to force me to re-authenticate on my phone by providing my new credentials before allowing me to see the contents of my vault. Seems like a security hole to me.

Hi @TurnerBurn, thanks for writing in with this question.

If a device is lost or stolen we recommend regenerating your Secret Key and deauthorizing the device. Deauthorizing a device will automatically sign the account out of the 1Password app. If 1Password is unlocked on your device when you change your password, the app won't lock automatically or sign the account out like deauthorizing.

You can deauthorize devices from your account on 1Password.com by clicking your name > My Profile then clicking the gear icon next to a device and selecting "Deauthorize Device".

You can also set 1Password for Android to lock automatically anytime you switch focus away from the app to reduce the likelihood that anyone who picks up your phone might find an active session, with or without the password change:
1. Open and unlock 1Password for Android.
2. Tap the account or collection icon.
3. Tap Settings > Security.
4. Tap Auto-Lock on Exit
5. Select Immediately.

Let me know if there's anything I can help with!