change request: "Password required every two weeks" - remove, change or make optional

You're very welcome rmpel! We appreciate feedback like yours as we work to make 1Password even better. 😀

Jack

EnerJi
I suspect at least one company I work for has a 1P4B account at work as they have precise control over who gets to see which vault. And I'm sorry, I'm mixing up the words vault and account. We used to have only 1 vault per account (I'm THAT old).

My Primary account is a personal one, with only 1 vault, and have a secondary and tertiary (and for a brief time a quaternary) account with multiple vaults. At current time, I unlock with my personal account for which I simplified the password to a memorable one, instead of 32 random characters -- which reduces security. Then I need to get the password for the other accounts from 1Pass itself.
It's doable, but annoying.

A "full unlock" with the primary account password would therefore be a great solution, and, if memory serves, in 1P 7 and before, this used to be the case.

Your remark about this feature being for "availability", I can understand that point of view. But I don't want to use rememberable passwords. If I can remember it, I can leak it.
And with that comes repetition; my dad (79) uses LastPass (because it's Dutch, not because it's good -- sidenote; when are you translating to Dutch please, 1P ?? I offered to help a few times a while back, doing so again now ;) ). Even with LP, he uses the same password practically everywhere. ... why? because he can remember it.

Anyways, I digress.

Jack_P_1P
I understand biometry can fail, but so does a persons mind. So for security/continuity, the primary password should be stored in hardcopy in a safe anyways (again; in my opinion ;) ), or with a family member (assuming you can trust them, obviously).

The trick with "same passwords for all accounts", I will use, although that too feels far less secure, because now I have 3 accounts with the same rememberable password ...

As for the article by Jeffrey; I understand! (good read by the way, and I can relate to much if not all of the history ;) )
But I also agree fully with the words of shadcollins in that thread.

Maybe it's just a matter of getting used to it, I don't know. But the comfort and ease of use I experienced with 1P before is diminished by this "feature". I don't like it. I might have to get to like it, I probably don't have a choice, but a diminished UX nonetheless.

Anyways, thank you all for your time, appreciate it!

Remon.

Hey rmpel:

The short version is we never want you to forget your account password as EnerJi mentioned (thanks for the assist! 😎). Biometry is great, but there are situations where for whatever reason or another, biometry fails, and in that situation you'd have to enter your account password to unlock 1Password. Without remembering your password, there's a risk of being permanently locked out of your 1Password account.

As for why accounts can no longer unlock each other, and instead require to be unlocked with each individual account password (generally speaking, we'd recommend using a single account password across all 1Password accounts you may have), our Principal Security Architect Jeffrey Goldberg has written a much better explanation of why the change than I could: https://1password.community/discussion/comment/608291/#Comment_608291

Let me know if that makes sense, or if you'd like me to dig into it further with you!

Jack

Interesting situation, rmpel. Am I right in assuming your company has a 1Password for Business subscription? I was under the impression that 1Pw for Business had flexible sharing of vaults, so it surprises me that you need to keep track of multiple passwords for multiple different vaults. But I haven't used 1PW for Business, so perhaps I'm not clear how it's supposed to work.

Would it be an option for you have one vault to which you remember the password, and then store the passwords for the other vaults inside that one vault? In general, I believe the requirement for a maximum 2-week unlock period isn't for security per se, it's for availability. It's to ensure that people have to type their password periodically so that they don't forget it.