Experiment #3 - Nearby Items

Hi likethesky, I worked on the iOS aspects of this labs experiment so am answering these queries from that perspective, if you are using Android, let us know and we will ask an Android developer to help.

What kind of battery drain will this app cause on my phone if I enable “always allow?”

We don't continually track a users location in real time or at all when the app is in the background. We only currently request an updated location from the device in very specific circumstances in order to minimize any impact on battery life.

For example, if the nearby tile is enabled, we only request a location when the app unlocks or when the user loads their home screen. If the "Nearby" tile is not enabled on the home screen, we dont request a location from the device on unlock or when the home screen is loaded. We also have some time based filters in there too, to avoid it being checked too often.

We are using and testing this features ourselves and have had no reported issues to date with respect to impact on device battery life.

do you log my location in any way

1Password does not log a users location in any way. Your location is only used to a) assign "current location" to an encrypted item, and b) used to compute the distance between you and your items. For those not comfortable using their system maps provider, we've made that aspect opt-in so that you maintain full control over your item location data.

Please let us know if you have any more questions.

It's really interesting to read about what others think. I want to reply to some things that Maubro mentioned, because they talked about use cases which I also talked about before. Of course I can only speak about my personal experience.

If I read it’s handy to have my PIN code directly at hand when I’m at the ATM, my first thought is, “Are there really so many people who can’t remember their PIN code. How often is this feature really going to be used?”

I rarely need to get cash at an ATM, maybe once or twice a year, which is why I never know my PIN code. On top of that, I have more than a dozen cards for various reasons and each of them has a different PIN code. No chance that I'll remember all of them. For the feature to be actually helpful though I would need to be able to enter several locations for my most-visited ATMs instead of just one.

Insurance card at the medical doctor’s office. How often in a year do you really need to show that? Is it so much work to do a search in 1password when you need this information?

I live in Germany and how it works here is that prescriptions can be saved on your insurance card and you may need to enter the PIN two times, once at the doctor's office and again at the pharmacy. I rarely need to visit the doctor but when I do I usually get some kind of medication and never know my PIN code.

Passwords per location, why? 1Password automatically fills in the password for me wherever I am. I don’t need to search for it and then fill it in, making it convenient that my office passwords are visible first when I’m there.

I work three jobs, one is remote first and I visit the office about once every two months, the other one has me visiting the office about once a month. For both jobs there are physical keys to enter the building but whenever I need to access something else, I need to retrieve keys from a key safe locked with a code (one 8-digit alphanumerical, one 6-digit numerical). On top of that, there are shared company vehicles that, although they are unlocked with my smartphone, require a PIN-code before I can start driving. I am already using the location-based feature for these occasions and it's really handy.

Maybe it’s a cultural difference why I don’t see it. That could be. In Amsterdam, we hardly do anything with cash anymore (read here we rarely go to the ATM and know PIN codes by heart), here we maybe go to a doctor less annually, post offices here have almost all disappeared, smart locks for houses are available, but in general we just lend the physical key directly.

Welcome to Germany, where everything is analogue-first :D just joking (well, maybe not so much), but actually I've only encountered a smart lock in Germany once and even then it was PIN-code based. Unfortunately, we also heavily rely on cash payments and the whole health-sector is just gradually being digitised (we only dropped paper prescriptions at the end of 2023 and the migration is still not completely finished).

Hey figurehead,

Thanks a lot for adding your +1's to the feature requests!
Much appreciated!

Benji

Hello Maubro,

Great feedback to receive, thank you for providing such a thorough follow-up 👍🏻.

1Password not only seeks feedback from the community for new experiments but also actively responds

You bet! It's important to us that we are able to discuss these experiments and our app in general with those who rely upon it and want to help improve 1Password in which ever form this takes.

I was really searching for where I could edit and add “items”.
Thanks for letting us know the confusion with 'items', up-until this thread, I'd never heard of the hesitance of this term and it has absolutely been spurring conversations for me as to how might we address this.

Eventually, I figured it out.
Ah, superb - that's good to hear!

I started to think about how this feature could actually benefit me. What is truly interesting for me about this feature? Something I’ve always run into that this now finally makes possible? After pondering it for a few more days, the answer ultimately was. No idea.

Thank you, for taking the time to mull it over and share this with us. Not every feature or idea we concept/provide as an experiment will be for everyone. There are parts to this feature we've been discussing internally that we've not yet got to a state we're ready to share so while it might not inspire in it's current form, there are ways and means that we see this addressing a number of needs for for those using 1Password inside and outside of their working days, with family or simply them on their own.

It’s super nice to see the positive reactions and even nicer to see 1Password react so enthusiastically. That it really adds value for 1Password.

Oh you... Thank you again. This is great to hear, and is very encouraging.

Yet, I still don’t see a superior advantage in this feature.
.. Go on...

And that’s why I thought it’s important to share my view on this as well.
I'm super grateful!

(Without stepping on the toes of other enthusiasts, I do bring in some examples from them to bolster my arguments. So please don’t feel attacked, as that’s not my intention.)
This is a community space for everyone to share their opinions with respect for others. A safe space if you will. You're good. :)

Security is the core activity of AgileBits in the form of the app 1Password.
Sure is! We're here to ensure that security is first and foremost of what we do, yet making it convenient for those who may not feel comfortable around 'security' without compromising it.

A feature like this, in my opinion, deviates from the core quality of AgileBits.
👀

This feature is about “convenience,” and as I see it now, this feature has nothing to do with the core of security. Maybe because I don’t see it, that could certainly also be the case, but then please explain to me where the “security” aspect of this is.

The idea that inspired this, was a story of a highly security conscious couple who use 1Password for everything, and a code for an alarm box which was 'buried within 1Password' when she needed to turn the alarm off and didn't have the code to hand.

What if, that code could have been there for her right when and where she needed it. Sure, he could have just sent the code to her in a message, yet that requires time and that alarm was blaring and she needed that code — and — let's focus on using a security app for this and I'm using an alarm code for a shed as a very simple metaphor for other more critical cases where there might be a need for finding things.

This is a convenience feature and it is a security feature for promoting better habits for users. Removing potential weak links in the chain so to speak. After all, 1Password should be used and hopefully loved by those using it frequently. If you're not using it, and you're relying on sharing things in plain text.... You know the rest of that story. So we must make it approachable and convenient so it can provide security for those who are using it.

If you ask me, I’d say: AgileBits, stick to what you are incredibly good at; 1password's security. And don’t add extra nice to haves to your app because that only distracts from what it should really be about.

Thank you for sharing this, however please remember that our focus is always on security.
You've got to make the unfamiliar, familiar, to those who need things in a secure manner or they're going to take another path where things may not be as secure. Convenience in a secure manner is good security to ensure you're providing a secure option to as many as you can or you're alienating those with poor security habits.

Additionally, my advice to 1Password for every (new) feature you roll out in the lab would also be to assign a rating according to the Moscow method to the experiment in “The primary questions I'm trying to answer.”

Thank you again for this also, we do follow similar practices in workflow already. That said, today I've learned about 'The Moscow Method' as a name for this practice.

Cheers and please do keep the feedback coming.
Benji

I have been using this feature now for the last few weeks and am quite happy with it, and would definitely like to see this make it into a permanent option (obviously with the possibility to switch it off for those who would prefer not to use it). The two requests I would have for improvement (both already mentioned by others):
1. Multiple locations per item.
2. Link with barcodes.

Hello everyone,

First off all, I find it impressive to see that 1Password not only seeks feedback from the community for new experiments but also actively responds to the community's reactions. 👍🏻
When I enabled the feature, I initially had the same experience that “johnjamesjacoby” refers to in his first comment.
I was really searching for where I could edit and add “items”.
However, after 5-10 minutes of exploring and trying things out, I suddenly realized that maybe I needed to activate it for my “item” and per item itself. Eventually, I figured it out.
After that, I started to think about how this feature could actually benefit me. What is truly interesting for me about this feature? Something I’ve always run into that this now finally makes possible? After pondering it for a few more days, the answer ultimately was. No idea. At least, no real “Wow, this is genuinely going to help me” kind of idea.
Then I thought, maybe I’ve forgotten, maybe if I read the community feedback I’ll think “oh yes… that’s useful!”
Now, having read through the entire community feedback, I see a lot of enthusiasts responding and coming up with ideas.
It’s super nice to see the positive reactions and even nicer to see 1Password react so enthusiastically. That it really adds value for 1Password.
Yet, I still don’t see a superior advantage in this feature.
And that’s why I thought it’s important to share my view on this as well. (Without stepping on the toes of other enthusiasts, I do bring in some examples from them to bolster my arguments. So please don’t feel attacked, as that’s not my intention.)

My view on this feature:
To be honest, I must say that when it comes to features, I’m conservative. I have been working with 1Password for years, and in my business, I advise and implement this password manager for my clients. Why 1Password? Unlike many other password managers, the companies behind them often have other activities, and password management is just another product of such a company.
Security is the core activity of AgileBits in the form of the app 1Password. Here, they are truly masters. (As all community members will attest)
A feature like this, in my opinion, deviates from the core quality of AgileBits.
This feature is about “convenience,” and as I see it now, this feature has nothing to do with the core of security.
Maybe because I don’t see it, that could certainly also be the case, but then please explain to me where the “security” aspect of this is.
If I read it’s handy to have my PIN code directly at hand when I’m at the ATM, my first thought is, “Are there really so many people who can’t remember their PIN code. How often is this feature really going to be used?”
Insurance card at the medical doctor’s office. How often in a year do you really need to show that? Is it so much work to do a search in 1password when you need this information?
Passwords per location, why? 1Password automatically fills in the password for me wherever I am. I don’t need to search for it and then fill it in, making it convenient that my office passwords are visible first when I’m there.
Maybe it’s a cultural difference why I don’t see it. That could be. In Amsterdam, we hardly do anything with cash anymore (read here we rarely go to the ATM and know PIN codes by heart), here we maybe go to a doctor less annually, post offices here have almost all disappeared, smart locks for houses are available, but in general we just lend the physical key directly.
If you ask me, I’d say: AgileBits, stick to what you are incredibly good at; 1password's security.
And don’t add extra nice to haves to your app because that only distracts from what it should really be about.

Additionally, my advice to 1Password for every (new) feature you roll out in the lab would also be to assign a rating according to the Moscow method to the experiment in “The primary questions I'm trying to answer.”
* Must have
* Should have
* Could have
* Won't have
This also gives a good insight into how important people actually find the feature.
For now, my importance for this feature is: Won’t have

All the best to everyone.

I have two items I’d like to comment on regarding this feature. They’re the first two things that I always think about whenever an app wants my location. First one probably more important, but they’re both important:

1) What kind of battery drain will this app cause on my phone if I enable “always allow?” I often won’t allow it for smaller companies who build mobile apps, because they often get this wrong and add significant drain on my phone, in the background, enough to make them useless often. So…, if I were the product team working on this feature, I’d be sure to set battery drain goals for this feature and strive to improve on those goals and also just make sure it passes the “does it drain rapidly” smell test for sure...

2) This follows naturally from “always allow” location, and that’s: do you log my location in any way—other than of course knowing where my preset locations are for using passwords or other stored info from 1P? I’m fine with you knowing where I use passwords—though even that is quite sensitive—but I’d want to know a lot about your encryption and destruction of “moving around logs” of my GPS location. In fact, can you just have Apple’s Secure Enclave just notify you when I’m near a place, and you never see my movements, just when I’m near a place I’ve set?

I’d want to learn about both of these two items above, once it’s out of beta before taking the plunge and using it.

My $0.0199 worth!

Cheers
~ Brad

pleaseopensource1p Great question, it really depends on the platform since they all interact with their mapping services slightly differently. On iOS and macOS, we are using the built-in mapping framework provided by Apple. The framework itself may make remote calls to Apple's mapping backend (we only call the framework, we don't control its behaviour, remote or otherwise). It's a similar story on Android where the Google Map service is used. While we haven't made a decision about Windows or Linux, since those platforms don't have built-in mapping frameworks, it would require us to make calls to an external mapping service ourselves.

Thanks for the quick response! That is reassuring. Re #3, does this also happen on-device as far as 1password is concerned?

Hi pleaseopensource1p 👋

We've built this feature in a way that maximizes your control over your location data.

1. For those looking for maximum privacy, they don't have to give 1Password permission to use their location. They can still add locations to their items (by entering in the latitude/longitude) and they can use (for example) Open in Maps if they want to see that location in using an external mapping service.
2. For those comfortable giving 1Password permission to use their location, they'll be able to make use of showing Nearby Items (items physically close to you). Your location is only used to compute distances between you and your items and isn't saved or logged, and it doesn't leave your device.
3. For those comfortable with using a Mapping service, we will show your item on a map inside 1Password. Since this involves a non-1Password technology (e.g Apple's MapKit on iOS, Google Maps on Android) we make this opt-in so that you maintain full control over your item location data.

Hopefully this helps explain how we use your data (we worked really hard to give you the most control), please let us know if you have any more questions.