Using 1Password with other browsers

1Password for Android currently embeds a list of known browser apps that it will support autofilling logins for. The list is quite small, with many popular browsers still unrecognized despite years of requests from users to add Chromium/Fennec/Bromite/Kiwi/etc to the list. The reasoning that's typically given for this is that the 1Password folks carefully vet each supported browser for compatibility and security before allowing it, which understandably takes a lot of time. However, some browsers, like Chromium or Fennec, are functionally identical to supported variants as far as a password manager is concerned and would work perfectly with zero code changes required, but remain blocked just because they have a different package name. In some cases, users have https://1password.community/discussion/142654/no-recommended-logins-on-grapheneos.

This limitation inevitably leads users to have to link their browser app with each individual login they use, and then having to manually scroll through the entire list to find the login for the page they're on. In addition to being incredibly tedious, frustrating, and error-prone (like filling a credential for the wrong site without realizing you mis-tapped), this is also bad for security, because the user loses the phishing protections that autofill offers against things like lookalike domains. The issue also disproportionately affects users who place a high value on their privacy, since many of these unsupported browsers are essentially "[popular browser] with tracking removed," meaning that 1Password is effectively forcing users to choose between privacy and security, actively preventing them from having both. I hope it's clear why this is a bad thing.

1Password used to be better about allowing flexibility in situations like this. In https://1password.community/discussion/comment/210451/#Comment_210451, you'd occasionally see references to a https://web.archive.org/web/20181010035515/https://support.1password.com/code-signature/. Unfortunately, that URL now redirects to a https://support.1password.com/disable-browser-validation/ that doesn't even address the original issue directly. Telling users to simply stop using their primary browser is not a strategy that's likely to win over many hearts. Other users are even https://1password.community/discussion/comment/537824, but with local modifications, and are locked out "for their own safety" because the signature doesn't match, essentially being told that 1Password is simply not an option for them. I'm unclear if 1Password for Android also enforces signature verification for trusted browsers or just uses the package name, but I fear it may be the former.

In an ideal world, 1Password would have the resources to fully vet every browser people want to use, and this problem would be limited to just the extreme edge cases, like developers or power users who compile their browser from source. But in a world of finite resources, there's another obvious solution: just let users add trusted browsers themselves, at their own peril. I've been very careful to avoid using the word "support" here, because I fully expect that such a feature would be explicitly unsupported, and I would even encourage the use of a scary warning message about the risks involved. Believe me, I understand what can happen if a malicious or even just insecure browser was able to fetch logins from 1Password, and I totally get the desire to offer users some protection against that risk. But while a trusted list of known-working, known-safe browsers is a valuable thing to have, it shouldn't be a hard limitation that prevents people from using 1Password entirely. If I trust the browser I'm using, that's all that ultimately matters.

I also don't think that offering this option would constitute a meaningful reduction in security. For years, users in this situation have had to resort to linking their browser app with every login they want to use in a browser, which I suspect for most users is going to be most logins. This means that browser app has the ability to fill logins from (nearly) any site, putting it right back into the same position as an app that 1Password recognizes as a browser. While I unfortunately can't confirm anything myself without access to 1Password's source code, that sure sounds to me like an awfully similar risk profile to interoperating with an untrusted browser, with the biggest difference being an enormous increase in the effort required on the user's part, both to set it up and to use it on an ongoing basis. In theory users could limit this linking to only a handful of logins, but in reality that's almost certainly not the case. Users ARE using this workaround today, and since there's no explicit messaging around "apps that look like a browser but are untrusted," some may not even realize that the reason 1Password's UX is so bad on a phone is because of the browser they're using. For those that do know the reason, a support article telling them to go download Chrome does nothing to help them. Giving them an option to tell 1Password "treat the following app as a browser" does.

In summary:
- 1Password refuses to interoperate with countless browsers that would otherwise be fully compatible
- At best, this is unkind to users and hostile to privacy
- At worst, this restriction opens up users to easily preventable phishing attacks
- Users should be able to add their own manually-approved browsers to 1Password's list
- This would resolve years of complaints from users, and has the potential to improve their security over the current state of affairs when used properly
- Use of this new feature should still be discouraged, but that doesn't mean it shouldn't exist

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Browser: Not Provided