Master-Passwort bei jedem Neustart des PCs und Notebooks

Hi @Chris63, you're very welcome! I'm pleased to hear that the information was helpful. If you have any further questions, let me know. 😄

Hi 1P_Gem

Thanks a lot for your help and the time you spent to answer my questions. I really appreciate. As there is no other option to use the password manager for my wife, we have to accept the risk and to be carefully using the computer until there is a more secure solution.

Kind Regards,
Chris

Hi @Chris63, thanks for getting back to me! I'm so glad to hear that all is working well now.

It sounds as if you had previously stopped during the set up process - for the first unlock after enabling the TPM option, 1Password will ask for your account password, followed by a Windows Hello prompt to finish setting up the unlock key with your TPM. After this, it should start to work as expected and allow Hello unlock to persist through restarts.

Now I have to ask you one more question: How security-relevant the warning "When this setting is on, a malicious app could gain access to your 1Password information." is?

When you enable TPM support, 1Password no longer has control over what can prompt you to access the key we create on the TPM, or when. With regular Hello unlock, everything stays within 1Password's processes so any prompt phishing by a malicious process wouldn't work. However, with TPM integration enabled, all a malicious process would need to do in order to decrypt your data is trick you into accepting a context-less Hello prompt.

In general, the level of risk depends on how careful you are with your device. The best way to stay safe and avoid this occurring would be to make sure you trust the apps you use, and keep malicious applications off your system by following the points below:

• Keep your computer and software updated.
• Exercise caution when clicking links or downloading anything.
• Be careful about opening email attachments or images.
• Don't trust pop-up windows that ask you to download software.
• Use security software such as an anti-malware application.

I hope this helps, but if you have any further questions, let me know! 😄

Hello 1P_Gem, here an update:

After my feedback above 15 minutes ago, I thought by refering to your answer to try one more time with TPM. I did everything exactly like yesterday and it didn't work. After restarting and logging in with Windows Hello, the prompt for the master password was displayed again in 1Password. Yesterday I stopped at this point because I was fed up to enter the over 20 character lenght password again and again. When I tried again some minutes ago, in opposite to yesterday, I entered the master password. Then the Windows Hello input field was displayed again and I entered this again too. After the next restart, it worked. So it's a success. Thank you very much.

Now I have to ask you one more question: How security-relevant the warning "When this setting is on, a malicious app could gain access to your 1Password information." is? I've read a lot about it in the forum, but I'm not the IT nerd with the huge understanding. Therefore - is there a simple statement as to whether it represents a really questionable risk or whether the risk is rather small?

Thanks again.

Hi 1P_Gem, thanks a lot for the feedback. As I wrote, since yesterday I tried about 20 hours to solve the problem, so I also had already tried to activate the TPM checkbox yesterday, but unfortunately it wasn't successful. Before I had checked if my computer is TPM capable and yes, it is, TPM Manufactur INTC 403.1.0.0, version 2.0. So the prerequisites would be given, but 1Password still requires the master password after the reboot, even if TPM is activated.

Is there really no feature that solves the problem? For example, isn't it possible to log in to 1Password on the PC / Notebook using the 2-factor authentication via mobile phone (where biometric login works without entering the master password)? Unfortunately I can't find an option like this, only the 2-factor authentication for everything else except the 1Password log in..

Hi @Chris63! This sounds like the expected behaviour with just the Windows Hello unlock setting enabled. You'll still need to use your account password under certain circumstances, such as the first time you unlock 1Password after a restart of the app or your device. This is because 1Password doesn't have a secure place to persistently store the decryption key for Windows Hello to access, and so it will abandon this key during a restart to protect it from unauthorized access.

This behaviour can be improved if your device is TPM 2.0-enabled, as the TPM provides a secure place for 1Password to store the decryption key. If you'd like Windows Hello unlock to persist through restarts, you can follow the steps below:

1. Press the Windows key on your keyboard, and click 1Password near the top.
2. Unlock with your usual credentials if prompted.
3. In the top left, next to the word 1Password, click ⋮ > Settings > Security.
4. Check the option to Use the Trusted Platform Module with Windows Hello.

I hope this helps, but if you have any further questions, let me know 😄