Forum Discussion
Why are items moved between vaults listed in "Recently Deleted"? Bad security model!
Oh wow! I do vaguely recall noticing this in the distant past, but it was in the heat of something else happening and I completely forgot about it. I fairly often have to move things when I put them in the wrong vault -- particularly in v8, with the way it guesses where a new item should go instead of just letting me specify a default -- so I'm probably leaving things all over the place. I've also moved lots of items when I introduce a new vaults to adjust access. For example, I'll move sensitive items to a new vault right before opening sharing access on the original vault.
This is definitely a huge security problem. I suppose I need to set aside a day or two ASAP to go through my several dozen vaults to see what may be errantly hanging around....
It hurts my brain just to think about all the cases of this that my corp users may have triggered. And we all know how successful a request for them to do their own reviews will be. What a mess! And what a waste of time.
I don't see how this can be considered anything but a critical security bug. No one is going to expect a "move" operation to leave an item blatantly, yet non-obviously, accessible in its original location. A fix should go out that, if at all possible, identifies and cleans up affected items, then lists them for the user so the user can change those credentials if appropriate.
Just like with the https://1password.community/discussion/131324/1p-8s-uncontrollable-auto-fill-just-gave-away-my-private-data, stuff like this makes me question how committed to user-friendly security the Agile team is these days. These are both cases where poor UI/UX decisions have opened the user to serious security gaps that can only be avoided through unreasonable attentiveness in daily activities and closely following this forum. It's the opposite of what 1P was created to do. And not only did you guys go with poor UI/UX decisions to begin with, but much worse, you dug in when they were pointed out instead of jumping on fixes. I still love 1P (hence why I'm here complaining so much - it comes from a place of love) for all the goodness it has, but at some point, these problems will become too much and I'll be forced to switch to something else that I don't like as much but which doesn't compromise as much on my security.