Why does 1password still install to the user’s local application directory?

Hello @ArjenvT,

Thanks for your message and I'm for the delay in response here. I've reached out to the security team for an update to your original inquiry.

Software installed to a protected directory requires user interaction to install updates so we install to a non-protected directory to ensure we can keep our software updated automatically without user interaction. There is obviously a security trade off in that decision, which is called out in the referenced pentest report. As a result of that report, we have created new installers (MSI) that can be used by enterprise clients to install software in protected directories while also allowing them to manage security updates in their own time. We are working on a similar solution for our non-enterprise customers, which we hope to have available in 2023 but we do not have an exact deadlines at this moment.

In the meantime, should this apply and you'd like to try out an MSI, send an email message addressed to support+windows@1password.com and we'd be happy to help look into this further with you.

Have a great day!