Protect what matters – even after you're gone. Make a plan for your digital legacy today.
device trust
11 Topicsdebsig package signing issue for 1password & 1password-cli
Problem: I have already raised this issue by email (no response from 1password yet), and BitBot has given this matter reference CKQ-37366-878. 1Password uses the weak, deprecated algorithm SHA1, with debsig, to sign its Debian packages (this affects both 1password [gui app package], and 1password-cli, each in their deb package form). Way back in Nov-2021, debsig v0.24 deprecated SHA1 as an acceptable way to sign packages. This is because a practical collision attack for SHA1 was first demonstrated in 2017. debsig release announcement: https://lists.debian.org/debian-dpkg/2021/11/msg00006.html#:~:text=*%20reject%20weak%20ripemd160%20and%20sha1%20algorithms Any Ubuntu or Debian distro using debsig >= v0.24 will by default not verify 1password or 1password-cli packages, due to the use of weak SHA1 packages. To further prove it is use of weak SHA1 algo for signing that is root cause of debsig-verify failing, and nothing else, you can put "allow-weak-digest-algos" (without quotes) into /etc/gnupg/gpg.conf and then debsig-verify command will confirm that latest 1password or 1password-gui deb package was signed appropriately in "_gpgorigin" file. Yes, an SHA1 collision is still hard, and so SHA1 signing is still better than nothing, and Debian packages is a smaller subset of an already small linux user base for 1password, but it still disappoints me that 1password appears not on top of ensuring all of it crypto algorithm use, are strong, secure, not depricated ones! It makes me wonder and worry where else depricated crypto cyphers are in use, and should I switch to something with more open source code that I can check for myself, like Proton or Bitwarden. Fix required: Please restore my faith in 1password by switching your signing algorithm for all Debian packages, from using SHA 1 (digest algo 2) to SHA 256 (digest algo 8), or even better, SHA 512 (digest algo 10), for debsig. This does not need to change the keys you use, and changes nothing about the underlying packages for 1password or 1password-cli. It is just a change to the deb packages. Steps to reproduce and analyse the issue: (1) Fire up an Ubuntu or Debian instance with debsig >= v0.24 (I used Debian 13 Trixie) (2) wget -O "1password-latest.deb" https://downloads.1password.com/linux/debian/amd64/stable/1password-latest.deb This gets you a suitable package to test the problem on. (3) debsig-verify -d 1password-latest.deb This runs debsig-verify, with debug output visible, on the just downloaded deb package. You can see the signature failure message on the final output line. Higher you can see complaints about an invalid digest algorithm as the root cause (4) Add "allow-weak-digest-algos" (without quotes) into /etc/gnupg/gpg.conf and then re-run the debsig-verify command from step 3 above. Now that we move away from default secure config to reject old, weak depriecated algorithms, such as SHA1, the 1password deb package successfully shows as signed. You could keep all the same keys, and just switch the signing algorithm used by debsig, to SHA256 or even better SHA512 (SHA512 is 64-bit words, so no slower on 64-bit architectures than SHA256, but larger and more secure), and you would fix this problem. If you are still using SHA1 here, and had not noticed until user pointed it out, you should probably (re-)audit where else you are using weak, old, deprecated cyphers in your codebase too, as a good step to continuously improve 1password security!29Views0likes1CommentThe Access-Trust Gap: Annual Report 2025
Unsanctioned AI tools. Patchy access controls. Unmanaged apps and devices. And of course, compromised credentials. These are the issues revealed in our latest 1Password Annual Report 2025: The Access-Trust Gap. Based on a survey of over 5,000 knowledge workers, IT and security professionals, and CISOs, the report captures a moment of rapid technological and cultural change. The rise of hybrid work, SaaS sprawl, personal device use, and generative AI have all stretched identity and access tools like SSO and MDM beyond their limits. The result is what we call the Access-Trust Gap — the divide between the access that IT and security teams can govern, and the reality of how people (and now AI agents) actually access sensitive data. The report highlights four areas where that gap is widest: AI tools: High enthusiasm, low policy compliance. SaaS apps: Shadow IT and unmanaged access remain rampant. Credentials: Weak and reused passwords still drive breaches. Devices: MDM alone can’t keep pace with today’s hybrid workforce. Together, these findings paint a picture of an enterprise world struggling to keep up with how (and where) work happens today. The good news? There’s a clear path forward. We outline how organizations can close the Access-Trust Gap by pairing stronger governance with modern tools like 1Password Extended Access Management, Trelica by 1Password, and 1Password Device Trust — helping companies embrace AI and modern work securely. 📘 Read the full report: 1Password Annual Report 2025 📰 Read the blog post: The enterprise AI crisis: Unsanctioned tools and unenforced policies27Views0likes0CommentsRequest for Zen Browser communication to app Support in 1Password (linux)
The 1Password browser extension cannot connect to the 1Password desktop application when using Zen Browser, despite native messaging being correctly configured. This results in fingerprint and other quality of life not working on Zen. The connection fails because 1Password's BrowserSupport binary rejects Zen as an "UnknownBrowser". - OS: Linux (Arch-based) - 1Password: Version 8.x (Linux desktop app) - Zen Browser: Version 1.16.3b (Firefox-based, using Gecko 143.0.4) - Extension ID: `{d634138d-c276-4fc8-924b-40a0ea21d284}` (1Password extension version 8.11.12.27) 1. : The native messaging host configuration (`com.1password.1password.json`) is correctly placed in all standard locations: - `~/.mozilla/native-messaging-hosts/` - `/usr/lib/mozilla/native-messaging-hosts/` - `~/.zen/native-messaging-hosts/` 2. When the 1Password extension in Zen attempts to connect, the BrowserSupport binary IS successfully invoked with the correct parameters. 3. **Failure Point**: The BrowserSupport binary immediately returns: ```json {"type":"Notification","content":{"type":"BrowserVerificationFailed","content":"UnknownBrowser"}} ``` Exit code: 1 4. The BrowserSupport binary appears to have a whitelist of supported browsers and doesn't recognize Zen Browser's identity, despite Zen being a Firefox-based browser. Please consider adding Zen Browser to the list of supported browsers in 1Password's BrowserSupport binary. The browser's application identifier is: - **Name**: Zen - **RemotingName**: zen - **Application ID**: `{ec8030f7-c20a-464f-9b0e-13a3a9e97384}` If you need any additional technical details or testing assistance for Zen Browser support, I'd be happy to help provide that information. NB! Fingerprint works fine on Firefox on the same machine. Just not on Zen, because apparently "unknown browser" on your side. Also I am not sure, but its possible same issue occurs on MacOS(too lazy to test)Solved47Views0likes4CommentsHelp with 1Password SSO Unlock Across Multiple Desktops
Hi, I’m looking for some assistance with 1Password in a small office environment (around 45–50 desktops) that runs Hybrid AD. We’ve enabled Unlock with SSO, and it works fine on a user’s first workstation. However, when the same user signs in on another workstation, 1Password prompts them to transfer their encryption key. The challenge is that our users often move between desktops throughout the day depending on their work schedule. This constant key transfer prompt is disruptive. Is there a way to disable this key transfer requirement or a recommended best practice to allow seamless use of SSO across multiple desktops? Thanks in advance for any guidance!89Views0likes5CommentsIssue re-instating employee
Hello, We provision 1Password from AD. We had a user resign and return shortly after. We had not wiped their device so we returned it to them. They were removed and re-added to the group we use to control who gets invited and their account and profile look normal on the 1Password admin console. We initiated a recovery which they completed. Upon trying to sign-in they are prompted with the message: This device was deauthorized. You will need to re-enter your Secret Key and sign in again. We have not encountered this before nor can we figure out how to re-authorize the device. The used does not have their original Secret Key.38Views0likes3CommentsZscaler and 1Password Device Trust integration available now
1Password is proud to announce a new integration with Zscaler, a leading cloud-based solution for Zero Trust network access (ZTNA). This marks a shared commitment to helping our customers secure access, reduce their attack surface, manage AI app sprawl, and practice the principles of Zero Trust. The 1Password® Extended Access Management platform is designed to support Zero Trust initiatives by securing every sign-in to every application from any device, including unmanaged devices and apps. Now, 1Password has built an integration between Zscaler and 1Password Device Trust to help mutual customers secure access and reduce risk. With this integration, customers using 1Password and Zscaler can be confident that critical applications are only accessible from trusted, healthy devices where Zscaler is installed and configured. Available to all 1Password Device Trust and Zscaler joint customers! Learn more about the integration announcement72Views2likes0Comments1Password for Windows app keeps requiring encryption key transfer
I have a business account that uses SSO for authentication. I am able to authenticate in the browser just fine and use the browser extension with no issues. When I sign in to the Windows app via SSO, I am asked to transfer the encryption key from my browser. I am able to do this successfully, but I keep having to transfer the key every day or two. Is there a way to prevent the encryption key transfer from happening or to get it to stop repeating?364Views1like8CommentsShare Your Experience with Device Trust and Get a $100 Gift Card
Hey 1Password community 👋 Whether you’re using 1Password Device Trust today, have evaluated it, or decided not to use it, we’re running 30-minute research interviews to learn more about your experience. Your feedback will help us better understand real-world access management challenges and shape how Device Trust evolves in 2025. Plus, you’ll get a $100 gift card for your time! Who we’re looking for: Current users of 1Password Business who have used, trialed, or considered Device Trust Admins, IT, or Security leads at companies of any size in North America, Europe, or Australia Decision-makers, or those with hands-on experience managing access tools What to expect: A 30 minute live interview with a member of our Product Marketing or UX Research team Flexible scheduling of interviews A $100 gift card from popular retailers as a thank-you We have limited spots available, so if you’re interested, please sign up here! Thanks for helping us make Device Trust even better, we’re excited to learn from your experiences!40Views0likes0CommentsResearch opportunity: Help shape the future of 1Password + gift card for your time
Hey 1Password community 👋 Our team is running 1:1 research interviews with current 1Password Business customers, and we’d love your insights. We’re especially interested in hearing from folks using the 1Password Enterprise Password Manager (with or without 1Password Device Trust or Trelica by 1Password), and who are involved in managing access, identity, and device posture at their company. Our goal with this research is to better understand how access is managed in the real world, especially in places where SSO, IdPs, and MDMs may not reach. Your feedback will directly influence how we evolve our products and features going into 2025. Who we’re looking for: Admins, IT, or Security leads at companies with 500–3,000 employees in North America, Europe, or Australia Decision-makers, or those with hands-on experience managing access tools Current users of 1Password Business and/or Extended Access Management What to expect: A 60-minute live interview Flexible scheduling between August 4th and 15th A $100 gift card from popular retailers as a thank-you We only have 10 slots available, so if you’re interested, please fill out this short screener survey. Thanks for being part of the community, we’re excited to learn from you!61Views1like0CommentsUnable to recover account frozen from unsubscribed family.
Dear 1Password Team, I would like to escalate a serious issue regarding the recovery process that seems quite illogical and leaves users like me stuck without any viable solution. I was previously part of a Family plan on 1Password. After some time, the Family owner unsubscribed from the plan, and as a result, I was automatically logged out from all browsers. When I tried to log back in via the web, I received an error stating that my user account has been deleted. However, I still have access to my 1Password app on my iPhone where my data and vaults are still present — though marked as frozen. I attempted to generate a recovery code and followed the recovery procedure, but it ultimately failed. Now, as I am registering for a new Family plan, I find myself completely blocked from transferring or recovering my existing data, even though: My account and vault data still exist and are fully accessible on my iPhone. The app still recognizes my previous vault but simply locks new changes because of the frozen state. There is no official option to link this existing local data to my newly subscribed Family account. I find it quite unreasonable that the system offers no migration or recovery path despite the fact that my data is intact and accessible on my device. In effect, I am being forced to lose all my stored information and start over, solely because the previous Family owner unsubscribed. This creates a highly frustrating user experience and puts user data at unnecessary risk of loss. I believe 1Password should have a better solution for such scenarios — at the very least, provide a way to re-activate or migrate frozen local vaults into a new subscription. Please escalate this issue to your technical or product team. I look forward to your assistance and hope a reasonable solution can be provided. Thank you.46Views0likes1Comment