All accounts unlock is not consistent

I would be okay with this feature change IF when I go to unlock and am required to enter my password, the 1Password app would at least offer to allow me to enter passwords for ALL accounts. As is, I unlock and forget this change has happened and then am frustrated because the app isn't finding the password I know is there.

It seems bizarre to me that the team would choose to make this change, and then NOT offer an easy way to know you need to enter all of the account passwords.

This is poor app behavior (ease of use), and the idea that I should change my account passwords to be all the same is poor security since it is antithetical to the concept of one password to one account (the basic premise of this app).

Well, I don't need confirmation now. 1Password 8.8 does not offer the Touch ID/Watch option to unlock after a 2-week week authorization or manual lock. However, if I wait for the 1Password timed lock, it does offer the Touch ID/Watch unlock when waking the app. Basically there is no all account unlock option in the time span between a hard lock and the timeout lock. I guess I can change the timeout to 1 minute and change it back to 10 minutes later, but again, why, and why is this experience so much worse than 7.x?

What is the solution if a.) you can't use the same password for multiple vaults (for whatever reason, as the underlying reason isn't important) and b.) you don't have a computer with TouchID OR an Apple Watch?

Are such users basically SOL?

What about the idea of a device specific PIN for your vaults? For example, Vault A has password abc123XYZ!@# and Vault B has password #@!ZYX321cba. On Device 1 you've created a PIN code for Vault A that is 123456, and you've created the same PIN code for Vault B. Now when you go to unlock Vault A with PIN code 123456, that will also unlock Vault B, as even though their passwords are different, their PIN codes are the same. Most importantly this PIN code is device specific. Thus my Vault A and Vault B on Device 2 wouldn't unlock with the PIN code from Device 1. In addition, I could use a different PIN code on Device 2 (say 654321) and each the same results.

I am satisfied that the Touch ID/Watch unlock behaves as expected, and is a way to unlock all the accounts efficiently. Thank you for that explanation.

Would you confirm that if I return after a two-week timeout and enter the primary password to unlock 1Password, if I then lock it and use Touch ID/Watch unlock subsequently, all of the accounts will unlock again? That's an effective workaround to this situation.

I still disagree that using the same password for every 1Password account is a good practice to recommend. I do understand that these passwords are local, and there are more factors, but it's an inconsistent policy. What if 1Password were able to apply saved 1Password accounts passwords from the primary account? It already reads these to present the information when adding an account, so would it be possible to read them when unlocking?

It seems that 8.8 now more consistently provides the Touch ID and Watch button (and it more consistently works) to unlock that way after a timeout or manual lock.

Still, what's with all the crashing or just plain disappearing app window? Just happened to me again.

Jack,

Thanks for the reply but I think you are still missing the point.

How do I teach users that it is ok to reuse passwords sometimes?

As I stated before...

There is absolutely nothing you can say that will convince me that reusing passwords is a good idea.

I hear your responses, I hope you hear my strenuous objections and you change this policy.

cj

Hi @chrisjaffe:

We do not recommend using your 1Password account password anywhere else. As I mentioned earlier, we use Secure Remote Protocol to authenticate to the 1Password servers from the 1Password clients. When you enter your account password on my.1Password.com, it is not sent anywhere. The client (your browser with my.1Password.com open), and the 1Password.com servers both arrive at a shared session encryption key. my.1Password.com in your browser and the server both perform some derivation from secrets they already have to arrive at this session key, and neither your account password or Secret Key are sent over the internet during the process. The session key isn't able to be reversed into either your account password or Secret Key.

Jack

1P_Dave

I appreciate your response though I disagree with you adamantly.

Point 1 is not related to my objection. Let's assume that I use the same password for two 1pass accounts and also for my login at Target.com. While 1pass keeps my password on my computer, not all services do.

And how is it true that my password is always kept on my computer when I am logging in to 1password.com., which I have to do monthly to manage users or other account information. There is no way that you are never sending that password across the internet.

Point 2 is understood. Hopefully my users are not printing the secret keys out or writing them down in the same place as their password.

As an IT professional I spend most of my time worrying about my users passwords. Where have they written them, how secure are they, where are they reusing them...

There is absolutely nothing you can say that will convince me that reusing passwords is a good idea.

One day we will not need passwords, until then I rely on services like 1pass to help me keep my users secure.

cj

extensioncord

When you enable Touch ID or Apple Watch unlock for 1Password, 1Password stores an encrypted secret on disk. The secret is encrypted using an encryption key stored in the Secure Enclave which is a security component built into your Mac. This secret allows the 1Password app to unlock all of your accounts at once which makes enabling Touch ID or Apple Watch the best option for when you wish to conveniently unlock all accounts at once.

1Password removes that encrypted secret from disk if your fingerprint isn't recognized three times in a row and when you haven't entered your account password into the app for 2 weeks.

@chrisjaffe

If someone were to crack, steal or otherwise compromise one of my accounts they would all be compromised. The whole point of 1password is to keep people from reusing passwords. 1password should not be advocating differently.

1Password works differently from other accounts for two reasons:

1. As Jack mentioned, we use Secure Remote Password (SRP) to ensure that your account password never leaves your device.
2. Each of your accounts is protected by not only your account password but by a unique Secret Key as well. An attacker would need both your account password and unique Secret Key in order to access your account.

Our Principle Security Architect wrote in more detail on this subject in this thread: Two accounts - now needs two different passwords every time you login? — 1Password Support Community

-Dave

I second extensioncord's comments on v8 vs v7. V7 was much more user friendly and intuitive to use. One example not mentioned is that search now defaults to the first entry in the list and not finding all. For example, if I type gmail and click enter I used to see all of my gmail accounts, now I have to click ctrl + enter to see that.

But more importantly, I strongly disagree with the notion that 1password is now advocating for reusing passwords. And, no, the justification:

"It's important to note that this isn't quite the same as reusing a password for a regular website login, as not even a hashed form of your password leaves your device ever."

is not adequate. If someone were to crack, steal or otherwise compromise one of my accounts they would all be compromised. The whole point of 1password is to keep people from reusing passwords. 1password should not be advocating differently.

I guess you described the Touch ID/Apple Watch exceptional behavior in your reply, but I didn't follow it, because it didn't completely jibe with what I was seeing. What privileges biometric unlock over password unlock in the context of your justification for needing to individually unlock accounts? It seems that there is still the potential to override business account credential policies in that situation.