Native Password AutoFill Extension macOS

TooSlimSam

Thank you again for the feedback, I've shared your comments with the team.

-Dave

ref: PB-38145918

Thanks, Dave. I appreciate the commitment that 1Password has made to security -- that's why I've been a user for 15 years. But I still would prefer to give even the most trusted software only the minimum permissions it needs to do its job.

TooSlimSam

Thanks for the feedback, I've shared it with the team as well.

The same security team that makes sure that your data is stored safely and securely in your 1Password account also reviews and secures the browser extension and Universal Autofill. In addition to the amazing work that our developers and security team have done to make sure that 1Password protects your data in various environments and scenarios, 1Password also undertakes multiple independent security audits from external venders, which you can read about here: https://support.1password.com/security-assessments/

You can also read more specifically about the security of 1Password in the browser here: About the security of 1Password in your browser

-Dave

lamsquat

Thank you for answering those questions. I've passed your request and description of your use case to the Product team internally.

The most annoying cases in which Universal Autofill hasn't worked for me are Cisco Jabber and Webex, although at least in Webex this has been fixed in the latest version. It also does not work in vmware Remote Console and something called PP3D (this is B2B tooling, I don't think it is publicly available).

So that the team can look into this, can you reproduce the issue in one of the apps in questions and then I'd like to ask you to create a diagnostics report from your Mac:

Sending Diagnostics Reports (Mac)

Attach the diagnostics to an email message addressed to support+forum@1password.com.

With your email please include:

• A link to this thread: https://1password.community/discussion/comment/721432/#Comment_721432
• Your forum username: lamsquat
• Please do not post your diagnostic report to the forum. This is for your privacy and security.

Please send the entire file.

You should receive an automated reply from our BitBot assistant with a Support ID number. Please post that number here. Thanks very much!

-Dave

ref: PB-44582138

I want to second the other comments in this thread that explain why native autofill would make for a better user experience. But I'm also troubled by the fact that the two alternatives offered for Mac users require either 1) a Safari extension that can read and alter every web page that I visit or 2) permission to view and control everything that happens on my computer. Yikes! Yes, I realize that we are already placing a lot of trust in 1Password. But I'd expect a security focused company to understand the principle of least privilege. The native autofill API is not just the best user experience -- it's the most secure solution.

Strongbox uses the native api implementation. It is one of the things I missed more when I switched to 1P and having my wife as she it worked best for her workflow.

1P_Dave

Thank you for your prompt response. In regards to your two points:

1. You are absolutely right about the webapps. I was mainly talking about apps that come in a native container, but use embedded web technolgies such as electron for the whole app (such as Microsoft Teams) or at least the login/SSO part. Especially the latter is very important for me because a lot of my work stuff integrates with Azure AD. Those apps all work with password entry and passkeys via the native implementation. I have checked with passkeys in iCloud Keychain and a colleague tells me that something called Strongbox (?) works as well. On the other hand with 1P you are out of luck because you can't install extensions in these 'native' apps.
2. The most annoying cases in which Universal Autofill hasn't worked for me are Cisco Jabber and Webex, although at least in Webex this has been fixed in the latest version. It also does not work in vmware Remote Console and something called PP3D (this is B2B tooling, I don't think it is publicly available). My theory is that those things do something to prevent input via the Acessiblity features of macOS because of some security policy? Or maybe just a badly configured SSO? Whatever it is, the native password integration just works.

lamsquat

Thank you for the feedback, I've filed a feature request on your behalf as well. 🙂

Regarding the last two bullet points in your reply:

1. With a recent update to macOS, Safari now allows browser extensions in web apps. There is an issue where 1Password for Safari won't unlock properly in a Safari web app if app integration is turned on and our developers are aware of the issue. 1Password in the browser already works in web apps from browsers like Chrome even with app integration turned on.
2. Are there any particular apps where Universal Autofill isn't working? Our team can investigate further and get those fixed.

-Dave

ref: PB-44582138

I just want to add my voice to the many poeple here asking about the native OS integration. In the past this was one of the major strengths of 1P, but has been becoming substantially worse since the release of version 8.

That being said my main pain points with this right now are
- Passkey support in native apps such as some enterprise stuff as well as a growing list of consumer apps such as Discord and Home Assistant
- Password dropdown in Safari webapps or other web technology based desktop apps
- Universal autofill does not work on sometimes on apps with bad accessibility support while the native fill does work in almost every 'secure' input field.

I would really appreciate progress in this regard :-)

Greetings

nthnchng

Thank you for the detailed feedback, I've filed your request with our Product team and included your entire comment. 🙂

-Dave

ref: PB-44182228