Our community is getting an upgrade on July 2nd! Learn more in the FAQs →

security tips

57 Topics

Did 1Password get hacked? The Disney Employee said hackers got into his 1password account.
Hey Folks, Decade+, happy 1password user here, however, my underpants clenched up when I read this on the WSJ today A Disney Worker Downloaded an AI Tool. It Led to a Hack That Ruined His Life. - WSJ At the heart of it, was them gaining access to his 1Password's. I didn't think folks could get access to your passwords without having the Secret Key you need in addition to the username/pw. Would love to hear from folks and 1Password (post-mortem/RCA), about what happened, and what we can do to secure our 1Password so this can't happen to us! I have just enabled 2FA for the first time, but it looks like you only need it to get updated PW's? and that you can still see the old ones. Scary! Thanks, Kyle
Solved
racerx_2502
1 year ago Place Lounge
6.1KViews
8likes
25Comments
Phishing email attempt - be careful out there
I just received this phishing email and thought I would share it with the community as a reminder to stay safe and always inspect before you click. I already forwarded the email to 1password (with headers) in addition to reporting it to the abuse email of the campaign service it came from. Not sure how they got ahold of the email though.
Solved
jj1pwd
1 year ago Place Lounge
899Views
1like
3Comments
Fake email from 1Password?
Hi, Received an email from 1Password today 05 May 25 advising to update my Linux before 16 May 25. Here's the thing. I've used 1Password since version 3, stand-a-lone software. No cloud. I've NEVER received an email from 1Password. So this is unusual. No where can I find guidance for a possible phishing email. So here I am asking for the info to forward this email so I can find out if it is legit. Why isn't there a confirmed process that if emails are sent, all of your customers know the email is a true email from 1Password? Please advise where I am to send an email that might be a scam, fake, fraud etc. Thank you
Solved
Quo_Vadis
1 year ago Place Lounge
600Views
0likes
7Comments
Share tips, win swag!
Hi 1Password Community, One of the great things about bringing everyone together here is the collective knowledge of having thousands of 1Password users in one place. We want to tap into that expertise by asking everyone to share their best tips and tricks for any 1Password product. Something that’s old news to you might help a new user save time and energy! To make it more fun, we’ve made it into a game! Reply to this thread with your favorite tip and you’ll be entered into a drawing to win an assortment of 1Password swag. For every tip you submit, you get one entry into the drawing (maximum of five entries into the drawing). When submitting your tips, please use the following format: Tool: Passage/Device Trust/SaaS Manager/Enterprise Password Manager/Personal Password Manager Platform: Web, iOS, Android, Mac, Windows, Linux Tip: Reply to this thread before March 11th, 2025 to be entered into the drawing.
1P_SimonH
1 year ago Place Lounge
312Views
0likes
2Comments
1Password's stance on Canada's Lawful Access Bill C-22?
I'm sorry if these touches in a topic that bends to the political, but this is something that I don't think we as keepers of people's most important and sensitive information should be just standing by and not getting into the discussion before it is too late. As a Canadian and a 1Password being a Canadian based "Electronic Service Provider", based on the law's very loose definition of what an ESP is, I have very grave concerns that just like Apple and Meta the data that is contained within 1Password could be subject to this "unlawful" bill. Even my own company as small as it may be is caught up in the legal definition of an ESP. There is no scope at what an ESP is and what the government has defined and what their level of Systemic Vulnerability will be. 1Password in its current wording is caught up in this definition The powers can be extended through regulations an minimal future debate No Guardrails Secret ministerial orders requiring system modifications or re-engineering that could be demanded of 1Password with a gag order No mandatory oversight Limited ability for 1Password to challenge orders or redefine vulnerabilities Extensive Realtime access & retention 1Password would have to build the capability (at its expense) the ability to intercept, decrypt & hand over data Access to metadata, geolocation, in realtime and stored for retroactive access for all users for up to one year (with talk from law enforcement of wanting this to be even longer in the future). Basically eroding privacy and security, and weakens encryption and creates a permanent surveillance state power and, because of the conflicting sections of the Bill, the "so called" protections can be overridden by a secret request, 1Password won't be allowed to ever tell us that it had to do any of this for the government, law enforcement, or the Canadian security (spy agencies). Now I hear that because of the growing pushback on this bill, that the debate on this bill is going to be now limited to 3 days and a goal of having this law by the end of the month. Has your legal team been studying this bill? What is the 1Password stance on this invasive bill that even Apple, Meta and US Congress are voicing their concerns of this bill in its current form? If Both Apple and Meta, with huge legal and resources, are concerned that this could force them to weaken encryption, how is 1Password a Canadian company going to be able to ethically stand ground to weakened privacy, security and increased enduring real-time surveillance? I remain unconvinced that all the data and access that we all store within 1Password would not be a prime target for access requests. All we have is a verbal promise that the government would never make these kinds of requests. If not now, as Micheal Geist says, in the setting ready and waiting for a "Turnkey Totalitarianism"? I think this warrants a response and a position from 1Password before the company no longer has the legal right to do so, don't you? https://www.michaelgeist.ca/2026/05/wilful-blindness-how-the-lawful-access-charter-statement-skips-bill-c-22s-most-constitutionally-vulnerable-provisions/ https://openmedia.org/press/item/civil-society-to-parliament-kill-bill-c-22
Solved
skippingrock
1 month ago Place Lounge
298Views
3likes
5Comments
Random but Memorable 14.7: Malicious Pottery Service Provider with Tarah Wheeler
Hey everyone! 👋 A new episode of 1Password's Random but Memorable podcast has dropped! Listen now Watch on YouTube Episode summary What’s the best thing small businesses can do to improve their security posture? 👩‍💼📊 Our guest this week, Tarah Wheeler, breaks down why small businesses are vulnerable to hacks, breaches, and ransomware, and shares some tips for choosing the right managed service provider (MSP). In Watchtower Weekly, we lift the lid on “SignalGate” and the rise of a new QR code phishing technique: Quishing. 🐟🤷‍♂️ Plus, we walk through 1Password’s Travel Mode feature in #Ask1Password. ✈️📱 You can read a transcript of the interview here! Want to chat about anything we discussed on the episode? Let us know in the thread below!
1P_nick
1 year ago Place Lounge
261Views
0likes
7Comments
New exploit
I just read about this exploit which seems like it could trick 1Password due to the url trick: https://x.com/nicksdjohnson/status/1912439023982834120?s=46&t=AJ8QxRZyw0qhDN040YYHYg Be careful everybody.
danito
1 year ago Place Lounge
246Views
0likes
6Comments
RBM 15.4: How to build a career in cybersecurity with Heath Adams
Want to work in cybersecurity but don’t know where to begin? Or just curious what it takes to break into the field? Find out in the latest episode of 1Password's award-winning podcast! Listen now Watch on YouTube Episode summary This week, the Random but Memorable crew are joined by the internet’s very own Heath Adams, better known as The Cyber Mentor. He explains what it takes to build a career in cybersecurity – no matter your background. 👩‍💻💼 In Crash Course, you’ll learn about Security Fatigue and why we should all be talking about it. You’ll understand why it’s affecting so many people in the industry and how to spot the early warning signs. Plus, in Watchtower Weekly we unravel the latest in IoT vulnerabilities, and why your TV could be part of a botnet. 📺🤖 Once you've finished the episode, read our blog post for more tips and parenting resources! Got a question about the cybersecurity industry? Or have some tips for landing your first job? Share them in the thread below!
1P_nick
9 months ago Place Lounge
199Views
0likes
3Comments
Random but Memorable 14.5: Triple Hollywood Movie Sabotage with Ralph Echemendia
Hey everyone! 👋 A new episode of 1Password's Random but Memorable podcast has dropped! Listen now Watch on YouTube Episode summary Why does Hollywood get hacking wrong in so many movies and TV series? 🎬🎥 In this episode, we invite Ralph Echemendia to share his wild stories working in Hollywood as a technical supervisor on award-winning projects like Mr. Robot, Snowden, Savages, and Nerve. We also shine a spotlight on the work Ralph is doing to help the world’s most influential record labels and movie studios protect what they’re working on. In Watchtower Weekly, we learn how a resentful developer used a kill switch to sabotage employer's systems. 👨‍💻 You can read a transcript of the interview here! Want to chat about anything we discussed on the episode? Let us know in the thread below!
1P_nick
1 year ago Place Lounge
158Views
1like
3Comments
As a 1Password user - how to access security audits?
Hi there, as a paying 1Password user how can I access your security audits? After the change last year I cannot access them. As a privacy orientated user I'd like to get some insight into that. Thx.
dragon1
3 months ago Place Lounge
154Views
0likes
6Comments