Forum Discussion

tambo's avatar
tambo
Occasional Contributor
4 years ago

Major issues: "1Password can't verify that Google Chrome...," followed by wrong password autofill

A few days ago, I tried to login to the administrative page on my router (which is named Rahonavis) using a saved login. Unlike the other 100+ times I've done so this month that succeeded without a problem, I received this message:

"1Password can't verify that Google Chrome should have access to your Rahonavis item. Do you want to fill it anyway?", with the options: "Fill once," "fill & update login," and "cancel."

Not understanding why I was suddenly seeing this dialog (perhaps the first time in my 7+ years of using 1Password!), I clicked "Fill & update login." To my surprise, from that point forward, 1Password autofilled every page with the login credentials for Rahonavis on the first attempt. That included Amazon, Gmail, Dropbox - even the login for 1Password.com. The additionally weird part is that if I hit Autofill on the same webpage again, 1Password replaced the wrong credentials with the correct credentials for the web page.

I opened 1Password and checked out the login for Rahonavis, and found that the login for Rahonavis (and only Rahonavis) included a new field that read: Linked Apps: Google Chrome. I deleted that entry, and Chrome stopped using Rahonavis for all entries.

However, that isn't the end of the story, and I am still having major issues, for this reason: every login is exhibiting some weird behaviors involving this dialog.

Here is a complete description of the problem:

1) Initially, when I visit a login web page (one that 1Password has previously been able to autofill without any problem) and hit the Autofill button, 1Password does not recognize the page and autofill the fields. Instead, 1Password pops up the generic "select a login" dialog with no entries suggested.

2) A few moments after 1Password displays the "can't verify" dialog, 1Password often attaches the "autofill" suggestion bubble to the textbox on the web page with the correct login suggested. If I click the suggestion bubble, 1Password autofills the correct credentials on the page, and the generic suggestion dialog disappears. However, subsequent attempts to autofill the page reproduce the behavior at step 1 above.

3) If I select the correct login through the generic "select a login" dialog, I now receive the message: "1Password can't verify that Google Chrome should have access to your ___ item," with the options: "fill once," "fill & update login," and "cancel."

4a) If I select "fill & update login," 1Password now uses those credentials by default on every website. If I autofill again on the same web page, 1Password often replaces the initial (incorrect) credentials with the correct credentials for that website. I can stop this behavior by removing the "Linked Apps: Google Chrome" field that was added to the login.

4b) If I select "fill once," the dialog goes vanishes, 1Password autofills the form, and (I think) 1Password stops presenting the "can't verify" message... but only for that login. Other logins that I haven't used in a while are still subject to this.

4c) If I select "cancel" and try again, 1Password shows me the "can't verify" dialog again.

4d) If I select "cancel" and instead click the autofill bubble attached to the login textbox, 1Password autofills the form just fine. But if I logout and hit the Autofill button again, I go right back to step 1 above.

I will note that I didn't change anything in 1Password to provoke this behavior. The logins didn't change, my configuration didn't change, etc. However, a few days ago, I dumped my Google Chrome cookies (while addressing an unrelated tech issue with a particular website). If 1Password lost anything due to that dumping, then it is not handling the consequences gracefully. I have tried uninstalling and reinstalling the 1Password Chrome extension, but nothing changed as a result.

My guess is that a 1Password software update has altered its security behavior in unexpected ways and is creating havoc for me and, possibly, other users.

I put in a help request, documenting much of the above, and tech support is looking into it. No response yet.

Finally, I will note that this behavior is serious and concerning for two reasons:

1) 1Password is presenting a security dialog in some contexts while simultaneously offering to autofill the credentials. Is there a problem with 1Password's security being circumventable in some circumstances?

2) 1Password is autofilling pages with the wrong credentials! I don't want Amazon to have my Gmail password, nor vice versa.


1Password Version: 8.7.3
Extension Version: 2.3.6
OS Version: macOS 12.4
Browser:_ Google Chrome

23 Replies

  • Thanks for letting us know you're in the same situation @josmo I've added you to our tracker. Apologies for the trouble.

    ref: dev/core/core#16119

  • Former Member's avatar
    Former Member

    Having the exact same issue with Brave just as an fyi

  • Jack_P_1P's avatar
    Jack_P_1P
    Icon for 1Password Team rank1Password Team

    Hi tambo:

    Thanks for sharing your feedback. This is something we're actively investigating. In the meantime, removing your Linked App for Chrome like you describe and using the inline menu, rather than the Autofill shortcut would be your best bet.

    Jack

    ref: KIL-41376-499
    ref: dev/core/core#16119