Safari setting "Always allow on this/every website"

Hi @mikebore, that's effectively what the browser extension was doing before, correct.

To be clear, this warning message you're seeing comes from the OS / Safari - which is good practice, generally speaking. It makes sense to check with a user whether they want an extension to be able to access their websites, and if so, under what conditions!

I'll be interested to hear what others have to offer here. My take is that, in order to be effective and "just work", it makes sense to allow on all sites. This is because 1) 1Password in your browser only reads the web data in order to fill passwords for you (we don't make our money from advertising, we don't collect sketchy information on you, it's only used for the purposes of doing what you bought 1Password for in the first place, and so on) and 2) the 1Password browser extension is designed with security in mind.

It's also a good prompt, though, about what browser extensions can do - which is to read quite a bit of your data, under the right circumstances. This is something we talk about quite a bit here at 1Password, and something we wish people generally heard more about when it comes to information security. Many people's overall privacy and security would be improved by using fewer browser extensions, and vetting them more closely.

In terms of our own software, as @"jack.platten" said:

1Password for Safari requires access to all webpages in order to fill properly. The only use for this permission is the ability to fill and detect what needs to be filled as necessary.

This is the core case for allow all: the app is designed for a limited purpose, is subject to the same privacy policies as all our software, and needs to be able to view websites to work well.