Documents download handling

austin

I completely agree.

I quite deliberately called it a workaround and it was a bit of a fun exercise.

Using a separate solution that requires that we rename our documents and configure the system differently is not a solution at all. It is incumbent on 1Password to remedy this security regression correctly. The default download should be to a temporary location (erased when 1Password locks) and there should be an option to "Save As…" to a different location. Anything else is by definition less secure. I’m not even sure why this was done this badly in the first place, given the company’s general reputation and stance on security (this never should have passed by the Dark Arts).

On my iMac it was easier to use Automator, I've pasted it below. Happy to answer any questions about it and great to hear if anyone can think of any enhancements. I did also setup a Smart Search in Finder as an easy way to check.

To be honest this is probably overkill for a relatively minor security issue but it has been a bit of fun to do and has given me inspiration for a file based task that is a bit repetitive I can probably now automate :-)

Thank you, OlivierP and iwaddo. We appreciate your contributions here on how this might be implemented in practice. Salute from the 1Password team!

Hello everyone,

For the Windows side:
- there is an EFS option in 1P7 not in 1P8. It may be a good thing to bring it back (while BitLocker should also be activated on the drive but this is another concern)

• best would be a good option to have a way to (pre) view documents saved in vaults without leaving 1P8, at least in read only (txt, pics, PDF and eventually docx, xlsx). Accessing/reading a sensible info inside a document would be protected that way.

My bests to all,

Olivier

So I do have a rather clunky workaround.

Steps
1. Rename all the documents in 1P with an identifier, for example add 1P- as a prefix
2. Use a Folder Action to watch the Downloads folder and then move the downloaded document to a folder that I've excluded from all my backups

After the move
* I can create a Notification
* open the folder in Finder
* create a Saved Search Query to my Finder Sidebar to help me check whether I've still any downloaded secure documents

The options are probably endless, you can do whatever takes your fancy.

Hi iwaddo, thank you for sharing this with us.

While I don't have anything definite to share on this yet, we are considering how document download handling might be done in future versions of 1Password. We do take the security implications of this feature seriously, and are looking at how to implement this in a user-friendly way that mitigates security and privacy concerns under a number of different scenarios. Thanks for contributing to the discussion here!

ref: dev/core/core#10857

I was about to start a new thread but luckily I found this one.

As mentioned above the data security leak caused by 1PW8 is just unacceptable, I have just realised that a document I 'viewed' has been copied up to backBlaze, added to Time Machine and my regular Carbon Copy clone - I know these backup are in themselves encrypted but that is not the point. I now need to take positive action to remove the document from each of these backups. I should not have to do this.

I already have a 'do not backup' folder on my iMac which, funnily is not backed up. It was there originally for when I have some large transient documents that just do not need to clog my backups but I do also occasionally use it for sensitive files.

As a minimum I think 1PW8 needs an urgent patch to allow me to specify the default download folder.

I am off to consider downgrading to 1PW7 for the time being.

Thank you for your help.

Until this is resolved, I will be recommending against upgrading to 1Password 8, as this is a real reduction in security.

Hi folks! While as @ben said, any potential changes may have to wait until after the Stable release, I have filed your requests for more download options and different download handling with our developers, so that this can be considered by the team in course. Thanks for taking the time to share with us what you think would work best. 👍

ref: dev/projects/customer-feature-requests/#898