Two accounts - now needs two different passwords every time you login?

The other issue is just the fact that 1password recommends using the same password across accounts will make people question the competency of the architecture. If you guys recommend this one bad practice, what did you do in the code that no one can see?

This seems like a really stupid decision on Agilebits' part. My wife has my 1password account in case something happens to me but I can't go through and set up all my clients' accounts to use the same password as it would violate my contracts with them.
I think the development team really didn't think this through.
It is also impossible to explain to a Board how this is secure. I always recommend 1password when I go into a new client but with the advent of version 8, I really can't do that.

Thank you roustem. I see that in the course of the long history lesson, I forget to actually answer the question about the safety of using the same account password for multiple 1Password accounts.

Do not use a password that you use for something other than 1Password else as an account password, but the kinds of attacks against typical login passwords doesn't apply to 1Password. The (analogue of) the hash that we store is truly uncrackable (your Secret Key takes care of that) and no secrets are transmitted during sign-in (SRP takes care of that). So it is perfectly fine to put all of the accounts that you want to unlock together under the same account password.

Mixed messages

Quite honestly we would much rather not have to say, "never do X. Do X in our special case." But the alternative would have been to continue with the whole "primary vault" business, which introduces its own problems. We also try to make 1Password sign-in look familiar to people, and that means obscuring how radically different it really is from signing into a typical service. So thank you to everyone who has asked whether we are giving mixed messages and for the full story. It is an excellent question.

Using the same password everywhere seems to be go against the premise of 1Password — always use unique passwords. However, in this case, it is completely safe and we recommend it. Most of the websites either store your password or a hash of it.

1Password doesn't do that. When you type the password, it is combined with the Secret Key and then processed through the derivation function to create both encryption and authentication keys. This is a one-way operation, there is no way to obtain your account password from the authentication key.

The password never leaves you device. You can use the same account password everywhere and be 100% sure that it is safe.

I understand that what is happening in 1Password 8 is a big change for some people and will take some getting used to, but it is a good change. What exists for versions of 1Password prior to 8 is a bit of a mess. (It is slightly different for different platforms, but I will use 1Password 7 (and prior) on Mac as my reference example.

In the beginning there was one vault

When 1Password was first designed more than a decade ago, it supported one vault. This one vault design persisted through the Agile Keychain and OPVault formats. Accounts didn't exist back then, and so in that context "vault" and "account" were really the same thing.

And it was good. Well it was good until people wanted to share certain items with family members or colleagues. But it turns out that people do want to securely share sets of items among colleagues and family members. Who knew?

Some users found ways to cobble together some sharing techniques. These were expert users, who had a strong sense of how data synchronization worked and where data was located and how to get 1Password to read data from different locations. We cobbled together some things to support these expert users, and supported multiple vaults being unlocked at the same time.

The Primary Vault

There were no Secret Keys in these days, so there were more reasons to have different master passwords for different vaults. But most of the people who were doing this multiple vault thing, just wanted to unlock 1Password once. So what we did was designate one of their vaults as their "primary vault". Unlocking the primary vault, decrypted keys that could be used to unlock the other vaults. So for secondary vaults, you only needed to give their master password when you first set of synching to that device.

For a while we even had some UI controls so that people could select which vault would be their primary vault. This just created user confusion and didn't last long. So instead we had a complicated set of instructions that involved removing vaults and setting them back up again to switch primary vaults for the few people who wanted this. Getting master password changes to propagate in a sane way was a tricky thing for primary vaults; it it was even worse for secondary vaults.

Anyway, this worked for expert users. They might even sync some vaults over different channels than they synced other vaults. They understood the relationship among their various vaults.

1password.com

For reasons that should be clear from the above and many others, that system of synching and sharing just wasn't going to scale. It didn't have the security properties that we and our users expected and it was simply hard for people who didn't understand synching in some detail to manage. We launched the 1password.com service beta in late 2015, with full launches for families, teams, individuals throughout 2016. To make the transition as seamless as possible and support a mix of 1Password.com accounts with all of the other ways people were synching their data, we kept the notion of primary vault.

The notion of primary vault doesn't make sense when we move to well-defined accounts. And with the mix that people had, the primary could be a primary account or it could be a primary "local" vault. This was getting less coherent by the day. But we couldn't change it, given the mix of accounts and vaults that people had. Using one set of rules for accounts and another for vaults would have been more confusing.

Account password policies

Some of our customers needed to have password strength and complexity requirements on the account passwords for the members of an account. Often times, those requirements were imposed by auditors, insurers, regulators; but whatever the source and wisdom of such policies, those customers very correctly wanted to know that people were unlocking those accounts with passwords that conforms to their policies instead of through whatever people do with unlocking their primary accounts.

Even without that need, the whole notion of primary account had to die. The 1Password 8 scheme is the right approach.

No account is unlocked without its account password

Suppose you are a member of five different accounts. No account is "primary". No account contains keys that can be used to unlock the other accounts. Suppose also that you use the same account password for A, B, and D, but you use a different account password for C and E. Should C and E unlock when you only use the account password for A, B, and D? Should A, B, and D unlock if you give your account password for C? Should unlocking keys for E be buried in account A? Should we tie ourselves to a design decision that was made ten years ago for experts who were setting up tricky synching situations?

Obviously, I think that the answer to all of those rhetorical questions is "no." Just as obviously, some people who will be reading this will disagree. But if you disagree, I'd like you to think about what would make the most sense for multiple accounts if we were starting from scratch and did not have a history of unlocking through a mysterious primary account.

Making a change

Whether or not what we did with primary vaults ten years ago was a good idea at the time, it is simply not appropriate today. But yes, this does mean real changes in some people's habits and workflows. And that will be annoying. But come back after three month of using the new system and look at this discussion again. I hope that we will all find that the new behavior makes a lot more sense and feels natural and comfortable.

Set up the SAME password for multiple accounts? Sorry, I think I am totally missing something. That would give every sing employee access to all my personal passwords and confidential information. I am surprise that is was even suggested.

Are you sharing an account with your employees? The recommended solution here is to have each employee have their own unique account, with their own account password and Secret Key, within the 1Password Business membership. This guide may help:

Administrators: Get started with 1Password

And then employees can also have their own entirely separate membership, at no additional cost, to store their personal data:

Get a free 1Password Families membership when you use 1Password Business

These accounts can have the same password, and doing so wouldn't expose any risk of the business having access to personal data.

Ben

Could you help explain further how using the same Account Password would give your employees access to your data @capsule?

Each account still has its own unique Secret Key, which would rule-out anyone but yourself being able to access your data, even if they knew your Account Password.

1P_Ben
I'm sorry, I can't tell if your suggested workaround is supposed to be a joke or not, I know things are fairly tough in here these days. What you've suggested is that we use a single password for multiple accounts. One of the very terrible security practices that 1Password is supposed to solve, is the re-use of passwords. In fact one of the features you advertise repeatedly on the website is "(1Passwords will) Identify weak or duplicate passwords,"

Your suggested "workaround" goes blatantly against this and I'd never recommend it to my users. I have a number of 1password accounts, as previously stated, and all of them have unique passwords.

The Biometrics are handy, but not a solve all. I cannot tell you the number of times I have had to manually unlock 1Password on my iPhone. At least once every day or so. Very annoying, but I'll consider it the price of security. Now entering 6 passwords every day? Heck no.

Again I repeat my statement.** Let myself or my business admin decide what our companies risk tolerance is for account unlocks**. Your security team is great, I'm sure. But they will always suggest things be done in the most secure way possible - that's their job (I know, I work in security). That doesn't mean it's user friendly. Or necessarily even the most secure in the grander scheme of things. If I want to allow my users to unlock their personal vault from the business password, that should be my choice - not your security teams. Or if I want them to use any of their passwords to unlock the business vault - same thing. If you're going to change how it works, give us the tools to decide and make good choices for our user base.

Along with a number of other things in 1Password 8, you've made a huge unilateral change that wildly effects a large number of users. With seemingly no desire for input from the community.

Set up the SAME password for multiple accounts? Sorry, I think I am totally missing something. That would give every sing employee access to all my personal passwords and confidential information. I am surprise that is was even suggested.

@capsule

The recommendation of using the same account password for all 1Password accounts is the same in v7 and v8. It hasn't changed. The difference is that 1Password 7 will unlock all accounts, even if they have different passwords, whereas 1Password 8 selectively unlocks accounts based on the password entered.

@ShakataGaNai

You can still unlock all of your accounts simultaneously in v8 by using the same password for all of them. They will each still have their own unique Secret Key to protect against the normal threats caused with password reuse. "Touch ID" may not be a thing on Windows, but we do support Windows Hello and the various unlock methods that exposes, including fingerprints.

@topher1078

That is the intended behavior. If the accounts have different passwords then the only one that will unlock is the one with the password you entered. As mentioned above you can limit or expand which accounts are unlocked by setting their account passwords to be the same or not.

There are a few things you alluded to that I think we can look at more closely:

1. How to unlock additional accounts after initial unlock
2. Showing which accounts are locked/unlocked

I hope that helps!

Ben