Signing back into the Community for the first time? You'll need to reset your password to access your account. Find out more.
Forum Discussion
Former Member
3 years agoWhy does 1password still install to the user’s local application directory?
I'm interested in 1password, mostly because of the automation options via the connect server.
So I started reading and reading, including security audit reports. In the last security audit handled by cure53, there is a 'high' described as follows:
1PW-18-003 WP2: Windows malware can trivially backdoor .html and .js (High)
This security audit took place end of 2021. At that time, 1 password commented the following:
[...] 1Password wants to get those trade-offs just right before they roll out a fix.
Another solution mentioned in the security audit report, is the use of an .msi, which actually installs in a much more secure location.
Almost 7 months later, I can see this issue is still not fixed in the normal installer. Neither a .msi available for 1password 8. In this community I can find questions asking for this .msi since november 2021.
I'm very curious why this "high" issue is still not fixed and why the workaround of the .msi isn't still available. Mostly, because backdooring of 1password 8 on Windows is so trivial, it's even described in detail in the public report.
What am I missing here?
1Password Version: 8
Extension Version: Not Provided
OS Version: Not Provided
Browser:_ Not Provided
Referrer: forum-search:cure53
- ag_mike_d
1Password Team
Hello @Charlzey,
Thanks for your question. Details related to the MSI can be found here, Deploy 1Password for Mac and Windows.
The message you've quoted there is related to non-enterprise customers. We have no further details to share yet about similar solutions as of yet.
Thanks for your patience.
- Former Member
Hi ag_mike_d, any news on when there will be an official MSI?
> "As a result of that report, we have created new installers (MSI) that can be used by enterprise clients to install software in protected directories while also allowing them to manage security updates in their own time. We are working on a similar solution for our non-enterprise customers, which we hope to have available in 2023 but we do not have an exact deadlines at this moment."
- ag_mike_d
1Password Team
Hi @Charlzey,
Thanks for your message and interest here about the ability to install 1Password a user selected destination for our non-enterprise users.
I have no additional news to share aside from what was shared in my earlier message. I'd like suggest watching 👀 for updates like this in our release notes!
- Former Member
Any additional info or progress on this issue?
- ag_mike_d
1Password Team
Hello again Mousit - Thanks for your reply and no worries at all!
When using 1Password 8 with automatic updates disabled, Settings (Ctrl + Comma) > About contains a link to our release notes page so you can review new versions before you decide to click Check for updates to proceed with any new updates that may be current.
Have a great day!
- TertiusSuper Contributor
Mousit Automatic updates can be disabled in v8, but they are no big deal and no real risk. I use the nightly update channel and literally every day a new update is available. 1Password will update on app restart and asks for restart once it detects an update.
In the one year of nightly channel usage and daily update, there was never a version that crashed or had broken functionality that prevented me from using 1Password and accessing my passwords. What 1Password delivers as nightly and unstable is actually more stable than releases of many other software.
I usually install updates of all kind of apps the day they are released. If there is a change I don't like, I have the choice of eternally postponing and keep an obsolete app experience, or to adapt as fast as possible and stay current. I choose to adapt and stay current. That was a conscious decision. From my experience from the last 10 years with this behavior of mine, updates that appear to be bad at first sight usually turn out as improvement in the long run, if you adapt your workflow and actually use changed functionality instead of working around it.
So either I use the current version of any software, or I don't use the software (any more). - MousitOccasional Contributor
Sorry that was also a harsher message than I really intended. :) I'm just very against automatic updates, especially unattended ones. I like to be aware of software changes, and what those changes actually are before they're applied--I really appreciate 1P7 Mac version in particular for its pop-up about an update being available, with that pop-up window also displaying the detailed changelog. 1P7 Windows simply says an update is ready and doesn't offer any actual details other than version number.
Also I usually like to wait a little on installation (unless it's a major security update), just to see how reports shake out because bad updates dooooo sometimes occur, however rarely.
Anyway, good to know 1P8 keeps the option to turn off automatic updates. Thanks!
- ag_mike_d
1Password Team
Hello Mousit,
Thanks for your message. I'm sorry for any confusion caused by my earlier message. This was referring to 1Password .MSI installs to a protected directory where automatic updates are not possible. In those cases, this leaves it to those IT teams to manage updates as needed.
The usual 1Password 8 installs, at a user's discretion, allow automatic updates to be disabled: Settings (
Ctrl + Comma
) > Advanced > Install automatic updatesFor more information about what's involved with our automatic update process, I'll leave that support guide below:
* How to keep 1Password up to datePlease let us know if you have any other questions. We'd be happy to help.
- MousitOccasional Contributor
"...we install to a non-protected directory to ensure we can keep our software updated automatically without user interaction..."
This makes me spasm. This can be disabled, yes? I'm still on 1P7 (which asks to update) for a variety of reasons but my god this would keep me off 1P8 forever. I absolutely do not want software to "update automatically without interaction". EVER. I want to evaluate, and then update on my decision and schedule.
- ag_mike_d
1Password Team
Hello again @ArjenvT - you're most welcome!
Do let us know if you have any other questions and please keep an eye open for updates on this front, in the future. 😀