Getting started with 1Password for your growing team, or refining your setup? Our Secured Success quickstart guide is for you.
Forum Discussion
Anonymous
4 years agov8 missing quick multi vault login
With 1Password 7 I could login into both vaults, private and work at once by typing either password in the prompt. On 1P 8 I need to actually open the app window, click on the other account and enter...
esquared
4 years agoSuper Contributor
Jack_P_1P - I'm sure I'm "tilting at windmills" here, and I'm digressing from the main point of this topic, but I find the logic you employed seriously flawed. Yes, there are three pieces of information that are needed to do a fresh login into a 1Password account: email address, secret key, and account password. Certainly one can claim that the email address is one's "user name", and thus not expected to be privileged or secret information. But to claim that the secret key is somehow akin to a password is, in my opinion, simply false. The secret key is recoverable in clear text from either an existing login or from a recovery kit. Moreover, the secret key is embedded into a PDF that one can download, and even in the macOS keyring (for a period of time). Therefore, it's in clear text in some electronic form on a local system that does not require 1Password to decrypt.
That is in clear contrast to the actual account password, which as you note never leaves one's computer in a non-hashed form - Ignoring the fact that I don't recall the exact hash algorithm, and assuming it's not a reversible or collision-likely hash, this is the only real secret piece of information that we as account holders have that nobody else can recover, unless they are in our heads.
Consider the following scenario, which is actually exactly the scenario in which I work: I have both a business- and a family-account. I have to, for security reasons too detailed to enumerate, ensure that ALL accounts I use have distinct passwords. This is not an option for me. Moreover, since my recovery kit for my family account is in my safe deposit box, and the similar recovery kit is in an envelope in our business safe for my business partner to recover, either can, in the event of an unfortunate accident, get access as needed to the various accounts I have. This is a good thing. Now consider that my business partner also will have access to my computer (again, by means and requirements too detailed for this forum). He thus has access to my secret key for BOTH accounts, again in clear text, recoverable from the keyring or other means. If I were to have the same account password for BOTH accounts, my business partner would have access to my personal/family accounts as well. Now, I really do trust my business partner, but that's orthogonal. One can easily extrapolate a scenario in which someone nefarious gains access to one of the two accounts - they now have access to both. In that way, the logic of using a shared password for both accounts falls down, and hard.
I've seen and been referred to https://1password.community/discussion/comment/608291/#Comment_608291 by @jpgoldberg, and I understand and agree with his logic. However, the following comments that mimic your own also actively encourage people to use the same account password for multiple accounts. I really think this not only sends a bad message to more naive users, but, give my logic and example scenario above, is actually a bad idea. This is especially for a security-focused company and application such as yourselves.
I repeat: I totally agree with @jpgoldberg's comments and the change as was made that now requires each account password to unlock. I'm only asking that the tool reduce the friction involved in maintaining multiple accounts with separate passwords is critical, not only for people like me who don't and can't use the same password for both accounts, but also because you aught not be promoting the reuse of passwords, anywhere, period.