Two accounts - now needs two different passwords every time you login?

It also doesn't help that there has been zero justification of why this was changed. It feels like development just decided to change it with no thought as to how it would impact anyone.

The main reason for this change is that this new way makes sense. It isn't what we've grown used to, but it really is far more coherent than the sort of kludge that evolved over time with "primary accounts.

Suppose Patty has two accounts. One of them is her personal account and the other is with her job at the DIA (Dog Intelligence Agency). Patty does not want account PW unlocked most of the time, but she does want PP unlocked most of the time. In particular, she doesn't want the unlocking of the two accounts in lockstep. (All puns intended.) So. what does she do? She sets up a different account password for each. (Many of my examples involve my dogs Patty and Molly.)

Molly, on the other hand (paw) has a personal account, MP, and a work account, MW. She wants to unlock both with a single account password. If you (or Molly) want to unlock two accounts using a single account password it makes most sense to set the same account password for both of those accounts. This is what I meant when I said the new system makes more sense.

Suppose also that the DIA (not being as intelligent as their name claims) insists that account passwords be changed every two dog years. (Or every four months). If Patty always unlocks her work account with her personal account password she is certainly violating the intent of her employer's policy. Probably the letter of it as well. This is just one of the ways in which Patty may want to need different account password practices for her different accounts. She most certainly does not want to change her personal account password every few months.

Molly wants her account unlocking to be in lockstep with each other. The most natural and semantically coherent way to achieve that is to have the same account password for those accounts she wants to unlock as a group.

The old system

In the old system, there was a little known and poorly understood concept of "primary account." It would, on your own disk, have encrypted secrets needed to unlock other accounts. Your primary account was rarely something a user chose for that purpose, but instead was a consequence of the order in which they set up their accounts on that device. It was fairly arbitrary which account became the primary.

One difficulty with the lack of transparency to the user about what account password was unlocking what is that users could forget that they even had a different account password for their non-primary accounts. Forgetting you have a separate password for an account is a good way to forget that password. Suppose Molly was using the old system. She regularly unlocked both her accounts with the password for her primary account on her computer. Note that "primary" may not mean the one that has the information that Molly needs the most. It just happens to be the one that she set up first on that device. She is never prompted for the account password for the "secondary" account (which might contain the most important data for her). She forgets that secondary account password and she forgets that she even has a different password for that account.

Now suppose the nefarious Mr Talk (the neighbor's cat) steals Molly's computer, and there is no way for Molly to get it back from him. Molly also doesn't have good back ups. So now Molly needs to set things up on a new computer. She does have her Secret Keys for both accounts safely stored for such an event, but she doesn't have the passwords written down because she is supposed to remember them. She can set up her new computer and unlock what was in her old primary account, but she has no way to unlock what was under an account password that she'd forgotten about.

This kind of problem is the result of the old system being very opaque to users. Now having a much clearer relationship between account password and the accounts it unlocks should very much reduce that problem. If you want multiple accounts to unlock when you give a single account password there is a very natural thing to do about it. You no longer have silent unlocking of accounts.

Somewhere above I gave a bit of a history lesson. The old system was never designed for a world in which lots of users have multiple accounts. Instead it was the result of hacks and patches to a system that was originally built for individual users who would have a single vault/account. The people who started playing with multiple vaults were expert users who had to do additional tricks to synchronize data from multiple vaults. It also wasn't even consistent across platforms. Now we make it easy for people (and dogs) to have multiple accounts, and these different accounts are part of different teams and families with their own policies. So we took the opportunity to design unlocking in a way that makes sense on their own at the expense of a substantial behavior change.

While I personally have never used multiple vaults, and thus this change won't effect me, I can actually think of multiple scenarios wherein this change would quickly become a nightmare.

One such scenario I can think of:
* You have a single personal account that you and your partner share.
* You have a work account.
* You help a friend manage his/her account.
* You help a parent(s) manage their account.

In this case, since your personal account is shared with another user, you would want it to have a unique password from your business account. Since you are helping manage a friend's account s/he will want to have their own password. And finally, with your parent, again there will be a separate password. In this scenario it would be completely untenable for each of these accounts/vaults to have the same password. As such, we are up to 4 unique passwords that would need to be entered in each time. While TouchID or Windows Hello could help mitigate this to an extent, every time you restart your computer or 1Password has to be re-authenticated you would have to put in each password again. This is significantly exacerbated by computers that DO NOT SUPPORT TouchID or Windows Hello - and there are quite a few out there that don't.

This is yet another example, in a sea of examples, where 1Password 8 introduces a major change that completely breaks users workflows, and it continues to show that the developers have simply not thought everything through when it comes to 1Password 8.

@shadcollins:

As I mentioned, if you're using multiple account passwords for various accounts, unlocking all of them at least once with your various account passwords will then allow you to use Windows Hello to unlock all these accounts.

In this example, my Jack Platten account, and my Platten Family account use the same account password, while the Wendy Appleseed account is using a separate account password. When I initially unlock 1Password, using the account password for my two actual accounts unlocks both of them, with the Wendy Appleseed account needing to be separately unlocked before I can use Windows Hello (in this case just a PIN, but a Hello fingerprint or face device would work just the same) to unlock all three accounts simultaneously. This behavior would be the same using 1Password 8 for Mac, just with Touch ID or Apple Watch unlock instead of Windows Hello.

Jack

@"jack.platten" It also doesn't help that there has been zero justification of why this was changed. It feels like development just decided to change it with no thought as to how it would impact anyone.

@"jack.platten" I'm not seeing that behavior on Windows. I had a company account manually. I had no idea it was even locked. I couldn't find a password and then went to the vaults and it showed a lock beside it. I was like what the heck is this?? Then I clicked it and it prompted me for the password. It didn't do that before.

Hi @shadcollins:

Touch ID or Apple Watch on macOS, or Windows Hello on Windows will still be able to unlock all of your accounts, but that does require that each account is unlocked first with an account password prior to being able to unlock that account using Touch ID / Apple Watch / Windows Hello after starting 1Password.

Jack

@shaywood I have clients that I have put 1Password into and I have an account into their systems. I don't understand why Agilebits changed this functionality, didn't call it out as a huge red-flag related to a major change. I also don't understand how you guys/gals think telling people to set their passwords to the same thing is going to fly with an IT audit.
Before my fingerprint or Hello(Windows) would unlock things and now it doesn't. I have to log into everything individually. This is a nightmare to manage. I think the team didn't think this through at all before they decided to change everything.

I have been using this product for 11 years and I have never seen a build like this come out before.

@shadcollins I think I may be misunderstanding your particular use case. Are you creating and managing 1Password accounts for each of your clients?

There is no way I can justify using a single password for all my clients, There is no way I could explain to a client that oh it isn't awful practice because you see 1password does this unique thing you have never heard of that uses a secret key and.... do you see how ridiculous this sounds?

@shadcollins In your case, our recommendation would be for you to use the same password across all of the 1Password accounts you own, while each of your client's would set their own unique password for their account, which they could reuse with any other 1Password accounts they have. As @jpgoldberg discussed earlier, this is safe because each account has a unique Secret Key that is combined with the password, effectively making each password unique. In addition, our use of SRP means we do not store a representation of your password on our server, like most other companies, so an attacker cannot crack your password if they were to compromise our server.

1Password goes to great lengths to demonstrate the security of our product including providing a https://1passwordstatic.com/files/security/1password-white-paper.pdf that details how our system works and documents the shortcomings of our system. In addition, we conduct routine third-party penetration tests and regularly https://support.1password.com/security-assessments/ the results. You can read more about how we handle security https://1password.com/security/.