How to protect against compromised iPhone passcode

[#NNP-45619-569]

Will do - thanks!

I just noticed there is also about 10 items in iOS settings>passwords that all have the website 1password.com, but each item contains a login for various things like instagram, outlook.com etc. all with the website address 1password.com or my.1password.com

Rene123

1Password isn't able to write to that list, so something else must be going on. Send us an email at support+forum@1password.com and you'll receive an auto-reply from 🤖 BitBot. It will contain a conversation number, which looks like [#ABC-12345-123] – post that here and I'll be able to make sure your message goes to the right team and we can look into that with you. I look forward to hearing from you. :)

Your 1Password items shouldn't be appearing here! If you imported your passwords from iCloud Keychain, but didn't delete them from Keychain afterwards, that may explain it, but 1Password does not put anything in that list.

Ok, I'm not so sure. Even recently created 1pw items appear in the iOS settings>passwords list. I never click on "save password" iOS prompt so it's not that

Your iPhone passcode cannot unlock 1Password. You need your account password or biometrics (Face ID or Touch ID) to unlock it.

I did not realize this. I thought failed Face ID would always allow iPhone passcode to bypass. If you can't get in to 1Password without master password or FaceID, I don't think there is an issue.

As to be forced to reveal, really I think the compromised pass code (e.g. by inadvertently being captured on camera), followed by an iPhone theft, is what is more likely (though not very likely at all).

Hi all.

Just wanted to address a couple of points in this thread:

Let's say I am forced to reveal my iPhone passcode and turnover my iPhone. The unlocked iPhone now has access to all my 1Password stored accounts

Your iPhone passcode cannot unlock 1Password. You need your account password or biometrics (Face ID or Touch ID) to unlock it. It's worth mentioning, though, that if you're already in a situation where someone has threatened you to make you reveal one secret (your iPhone passcode), it's quite plausible they'll also want a second (your 1Password account password).

By that point, if someone is that determined, there isn't really anything you can do.

With the basic phone passcode they can see all 1Password passwords, as they show up under iOS settings>Passwords!

Your 1Password items shouldn't be appearing here! If you imported your passwords from iCloud Keychain, but didn't delete them from Keychain afterwards, that may explain it, but 1Password does not put anything in that list.

— Grey

Does anyone know whether a hardware key with apple 2FA prevents reseting Apple ID with just a trusted device?

If you don't set up autofill in the settings app, then you can close that hole in security, I think.

This is a big vulnerability! They don't need to force you at all. Only observe you type in your passcode, and then steal your phone.

With the basic phone passcode they can see all 1Password passwords, as they show up under iOS settings>Passwords!

This defeats the vault password. If anyone knows how to prevent this, please let us know.

See this article
https://www.wsj.com/articles/apple-iphone-security-theft-passcode-data-privacya-basic-iphone-feature-helps-criminals-steal-your-digital-life-cbf14b1a

I do think about this a lot but there’s not much to be done if you reveal your passcode. Security models generally exclude the scenario of unprotected device access. That said, 1Password will only unlock if given your biometric or the master password, both of which the attacker wouldn’t have with a stolen phone. Not much they can do with your email accounts except receive reset tokens - here is where a hardware key may come in handy but even then many accounts offer the ability to reset if you lose that key. One thing to recognize is that credit cards will often protect you from financial fraud in these situations so as long as you don’t keep a debit card on your phone, that should be remedied. Also you can use Screen Time to restrict access to account, passcode and mail account changes behind a different passcode - I do this. Given that 1Password is not accessible, my hope is that I can get to a computing device fast enough after the theft to deactivate email accounts on the iPhone after it is stolen.

Outside of that, if you’re in a situation where you’re under threat to life, please go ahead and reveal your passcode. Most fraud of this kind can be remediated, and your life is more precious.