Disable Reused Password Notification?

Why is 1Password not offering me a way to disable the reused password notification?

Why is the UX/UI team unaware of the extreme effects this has on usability?

Why is 1password acting like a paternalistic government?

Take my money, store my passwords, Offer me features that I can choose to use. I do not invite you to do more.

This is pathetic. Switching to competitor in 30 days if not addressed.


1Password Version: 7.2.4
Extension Version: Not Provided
OS Version: 10.14.2
Sync Type: Not Provided

Comments

  • LarsLars Junior Member

    Team Member

    Welcome to the forum, @leave1password!

    We tend to respond as well as most humans to ultimatums, and we're also a decent-sized security company with a lot of priorities on our plate, so my suspicion is that we probably won't meet your thirty-day deadline. But regardless of timelines, if you feel another product or solution would best suit your password-management needs, then by all means - assuming your solution isn't sticky notes on your monitor or re-using the same password everywhere - we're happy if you're happy. We want satisfied users, not ones who feel trapped or upset.

    That said, our user-base is large enough that literally every decision we make will delight some users and upset or outrage others, so our usual approach is to take in as much feedback as we can and use our own judgment about the best way forward, knowing that we quite literally can't please everyone.

    Why is 1Password not offering me a way to disable the reused password notification? Why is the UX/UI team unaware of the extreme effects this has on usability?

    This has been addressed in multiple threads in this forum already, so please feel free to browse those if you'd like a fuller discussion of the issue, but briefly, we are indeed aware. What we're looking into are ways to allow greater flexibility for more-advanced users while not allowing newer, less-sophisticated users to turn off warnings they probably should be seeing without being able to just dismiss them in such a way that they may not even know they're no able to see these warnings even when they're appropriate/necessary. But again, since we're not likely to have that concluded within 30 days, you may want to take that into account. Thanks for writing in to let us know your wishes on this issue, and good luck with whatever you end up deciding! :)

  • I could not love this response more if I tried!! Kudos!

    That being said... I add my vote for "an advanced mode to disable notifications for users who know better but choose to live in blissful uncertain insecurity."

    Of course, I'm not one of those per se... (I may have a couple of intentional duplicates, but not as a general practice)... however, there are stubborn people in my life who use 1P more as an "auto-login" system and who will never, ever, ever do as we all recommend by having secure, impossible to remember, and unique passwords for every account.

    Alas, these folks (mostly older and the most vulnerable, I propose) insist on still having only one or two passwords that they know and can remember, and they use them for every account everywhere, only using 1P to track what sites for which they have accounts and to auto-populate the login window for them. They will never change. No matter how much data I present to them, no matter how much I assure them that it's safe and smart. It just won't happen.

    Likewise........ they also won't stop asking me how to make that warning go away, which finally brings this overly-verbose post to its point:

    I understand any organization has to balance the intended method and application of their product with the various real ways the end-users could use the same product. So, while I shall refrain from tyrannical demands of expedited resolution deadlines, I do hope this feature can appear somewhere on the bottom of a developer's "to do" list. :)

  • LarsLars Junior Member

    Team Member

    @eFlat7 - thanks for the kind words! We really don't enjoy disappointing users, despite what it apparently seems to some people. But we've grown to a size where our user base is diverse enough that we sometimes have people advocating for literally the exact opposite things from one another, in different threads. No matter what we do, someone's not going to be happy. :(

    I do hope this feature can appear somewhere on the bottom of a developer's "to do" list.

    It already is, in the sense that we're quite aware there's a decent chunk of users who'd like to be able to defeat or suppress these warnings, and not without reason. It's more in the "we need to figure out how to do this in a way that's secure and works best for everyone" stage, not the "we've got a roadmap and it's happening soon" stage. But yes, it's something we're continuing to look at/work on. Thanks for adding your voice and your positivity to this thread. :)

  • I know I am kind of resurrecting a dead thread, but have you considered an option where an advanced user can tick a box that says "If login is identical in all aspects (modified on, attachments, fields, etc) and is in a different vault, do not display duplicate password warning" or similar? I have shared vaults with different people or persons which include the login to various services (Netflix, etc) and I would hazard a guess that 90% of my duplicate logins fall under this scenario. It would be great if a starting point was to eliminate identical login entries from the list!

  • brentybrenty

    Team Member

    It's something to consider, but the problem is that most of the people requesting this sort of option are not dealing with completely identical items, so it wouldn't help very many folks. I think we need to allow for some flexibility.

  • +1 I get this everywhere because of duplicate Vaults, that I don't want to remove yet.
    Actually, it feels like a bug that a Vault excluded from All Vaults is considered for duplicates.

  • brentybrenty

    Team Member

    @roninXpl: We definitely want 1Password telling the user about any duplicate passwords it knows about. Otherwise I'm not sure what a "Duplicate passwords" feature would be good for. I'm curious why you're hanging onto duplicate vaults when it sounds like you really don't want that.

  • Suggestion: While waiting for the muse, perhaps change the text of the warning message to something more polite and less bullying in tone? Maybe: "reused passwords are insecure, you may wish to consider changing your password". I bristle every time the current warning appears and obscures part of the window! Just a thought...

  • ag_anaag_ana

    Team Member

    Thank you for your feedback @krysteaux! I still feel that, in case of a reused password, the recommendation should be "change it" rather than something softer, but I see where you are coming from :)

  • I really hate this alert. I have tons of vaults, copy passwords for archive purposes, rename them and keep the old one too (for archive purposes), etc. I categorically need to be able to disable this one universally and prospectively.

  • brentybrenty

    Team Member

    copy passwords for archive purposes

    @AgileByte: Can you elaborate on that? What are you trying to accomplish? It sounds like you might be better served by the mere fact that changing the password in a Login item keeps the old ones under "previously used passwords".

  • 1+ for possibility of disabling this warning. Using 1Password for teams and have multiple systems that require the same password even while the corresponding username is different. So have different records for auto login and getting this alert. Maybe only alerting when combination username and password is the same, or get a "expert" mode with some extra configuration options.

  • LarsLars Junior Member

    Team Member

    @AJH2 - thanks for the feedback! We don't have anything to announce on this just yet, but it's definitely something we're still considering how we might best accomplish. It won't be any sort of "expert mode," as we've resisted such ideas historically due to complicating the UI for everyone; it's the same reason we won't release "1Password Lite" or anything similar; because we believe good security a) should be accessible to everyone and b) shouldn't be impossible to achieve in a single app without having to resort to an "expert mode." Creating such a thing might make some small slice of power users happy (or possibly not, depending on what was in it, and how we went about it), but it would also definitely mean, tacitly, that we had given up on the idea of being able to ship a password manager that was powerful/secure enough for anyone, flexible enough for all but the most dedicated "tinkerers/modifiers," and had a gentle enough learning curve for nearly anyone to grasp.

    Keep an eye on release notes to see what kind of updates are coming to this and other aspects of 1Password - there's lots more good stuff to come! :)

  • I have an opinion on all of this, for better or worse.

    My security is my business. But what I see in 1P and agilebits is that you are declaring that I am obligated to follow what you think of security.

    If I want to use an older version of MacOS, that's on me. If I don't want to see the reused password alert, that's on me. And so on.

    You think security means X. I may choose not to do it that way, for reasons not of your concern.

    It's all well and good that you do what you do, but understand that others do other things for other reasons. To declare that to be "inherently wrong" is not a good business model.

  • LarsLars Junior Member

    Team Member
    edited July 1

    @adam1991

    My security is my business.

    Indeed, we agree! :)

    But what I see in 1P and agilebits is that you are declaring that I am obligated to follow what you think of security.

    Oh, certainly not! Sorry if we gave you that impression. What you may have seen us gently pointing out in various threads on this forum is that if you want to use 1Password (or anything else, for that matter, from other software to your toaster), you do have to use it as it currently exists, not as you wish it did.

    That said, we've always been happy to listen to user feedback and suggestions, from the very beginning of 1Password right up to the current version. Many of the features you see in 1Password today began life at least in part as user suggestions, in fact. What I think can sometimes perhaps not come across clearly is that being happy to listen to suggestions and feedback doesn't automatically mean we're going to pursue or implement every suggestion we receive. With a user-base the size ours is now, that would literally be impossible even if we wanted to try to attempt it, because different users will often ask for completely opposite features/directions. There's no squaring that circle; we can't please everyone, and we certainly can't make a custom version of 1Password for every taste. And just adding a toggle/checkbox/lite mode/expert mode/preference for every conceivable use case would result in, well, something not too far from this:

    That's something we're just not going to do, for reasons that should be obvious. So what we do instead is try to take in as much feedback, as many suggestions and opinions/use cases as we can (because we don't have all the answers or always have the best idea), then add in our own ideas about what makes the best password manager, and come up with what we think on balance is the best approach. It's a continual process, and there aren't too many things that are set in cement. So by all means, we encourage everyone to keep letting us know about their use cases/wishes. We don't promise to say 'yes' to every one of them, but we do promise to listen to each one and think seriously about whether we should change how things are currently. And also, to tell you directly if what you're asking for is one of those rare things we just plain don't see changing, ever.

    If I want to use an older version of MacOS, that's on me. If I don't want to see the reused password alert, that's on me. And so on.

    That's a bit of apples and oranges. Using an older version of macOS is most certainly your decision, and we've never suggested otherwise. What we have done and will continue to do is remind users that staying current with their critical security software (including macOS, 1Password and browser versions) is the best way to ensure compatibility and security. However, the Reused Password warning is another matter altogether. We've received quite a bit of feedback about that, and are in the process of a comprehensive solution that is server-based instead of resting on a Mac-only tag or other method to simply "suppress" such warnings only in 1Password for Mac. It's a good example of us hearing the use-cases and arguments of the user community and deciding to alter how 1Password works in response. I realize you can't actually SEE that yet...but it is definitely in the works. Keep an eye on release notes and updates. :)

    You think security means X. I may choose not to do it that way, for reasons not of your concern.

    Exactly! We're well aware there are plenty of security models and use-cases. That's why this space (password management) already has many options (with new arrivals seemingly every week!) - so it's likely any given user will be able to find something that fits their use case/preferences.

    It's all well and good that you do what you do, but understand that others do other things for other reasons. To declare that to be "inherently wrong" is not a good business model.

    The words "inherently" and "wrong" appear only once in this thread (until just now, I guess, LOL :lol: ): in your most-recent post. That's chiefly because it's just not how we view such things ("we're right, you're wrong," etc). We do indeed have ideas about what constitutes good security practice, and we'll continue to explain and advance them. What you do is definitely your prerogative, and how we build our software is ours. We certainly do take customer feedback into consideration when making decisions but ultimately this is a product that we are designing and offering. Beyond that, I'm not sure there's much value in attempting to turn that into a "we're-right-and-you're-wrong" (or vice-versa) confrontational argument. I generally assume that people with their own strong ideas about what constitutes good security who see what we say about security and think "oh, that's definitely not what I believe" will try to find a solution that's not so at odds with their own ideas about security. :)

  • unrelated, but did you take that Word image from the one going around in the late 80s/early 90s (as a goof of what someone "predicted" Word would turn into) or did you fire up Word and hit every checkbox?

    Because I was there watching as that "goof" prediction actually came true...

  • LarsLars Junior Member

    Team Member

    @adam1991 - I don't recall where I wound up getting it from initially, but yes, I remember watching as some of the worst predictions came true regarding cluttered/off-putting UI.

    That's a point that was implied in what I mentioned above but perhaps not explicitly stated: 1Password will never be a "Pro" app in the sense of being designed for power users who want every conceivable (or at least many) options/layouts/preferences, in the way that Photoshop or other apps aimed explicitly at working professionals in a particular field are often designed. The reason for that is because we believe good security and strong password management should be available to everyone. And "available" means not just that you can purchase it somewhere but also that it's designed in a way that allows the benefits of its power and usefulness without requiring a CS degree to understand/use.

  • good message to know, thanks.

  • LarsLars Junior Member

    Team Member

    :) :+1:

  • Dear Lars:

    I want to echo the others who deem the password reuse warning intrusive and annoying. (So far, I have not seen any "thank you for that great feature" response --if they appear somewhere it might be good to reflect them in this forum too). I understand the company being taken by surprise with the negative response of a well-intended feature, yet the obvious answer seems to me "we will take care of this in a future release". That has been the response from companies I have come to admire, especially when they follow up on the commitment. It is hard to admire your "woe is us -everyone wants something different", defensive, and unsympathetic response to your customers' complaints. Only a lack of imagination would prevent implementing an intelligent solution and I suspect your company has smart people working there. On the other hand, if the company thinks imposing annoying and intrusive messages is not actually a mistake, then I am with Mr./Ms. leave1password's notion to look for a different product. I am less in a hurry: switching password platforms is a pain in the neck. All-in-all you have an excellent product and I have used it for several years (I have lost track), but I will prefer to patronize a customer-first, customer-positive, and creative password solutions company. I look forward to your response.

  • LarsLars Junior Member

    Team Member
    edited July 8

    @danaz

    ...the obvious answer seems to me "we will take care of this in a future release".

    Maybe you just haven't stumbled across the right thread(s) so far, but that is indeed what we've been saying for a while now. We're not going to be removing the feature, and we're not offering a way to suppress the warning using a tag-based or checkbox/toggle approach. What we're working on is a server-based approach that incorporates per-user attributes, which will allow this to work cross-platform and in multi-person accounts (1Password Families, 1Password Teams, 1Password Business). I don't have anything to share in terms of when this will be ready, but that's the direction our work is taking on it. Hope that's helpful.

  • ag_anaag_ana

    Team Member

    Thank you for sharing your thoughts (and welcome to the forum! )

    As Lars wrote above, we carefully consider adding any new settings, even when there is the possibility to hide them under the Advanced preferences. Therefore we are working on this in a different way, so that this will work cross-platform (while the solution you are proposing would be limited, because it would only work on a per-client basis).

  • BenBen AWS Team

    Team Member
    edited August 8

    Thank you for taking the time to share your thoughts on this. We'll take that perspective into consideration as we continue to build 1Password to be the best tool available to help people manage their passwords and stay secure online.

    Ben

  • Hello Lars,

    As a user with a lot of reused and weak password notifications, I've been reading on the threads about this feature. My credo for good security is "keep it simple": if I can understand what's going on, then I can apply the appropriate measures to keep me safe. As soon as security depends on lots of options and dependencies, I may have a false sense of security because something important is out of my view.

    That's why I understand the rationale behind the global notifications on reused and weak passwords: if I start tinkering with options on individual entries, I could unintentionally create weak spots, thus defeating the purpose of the watchtower feature. Reminds me of that lazy developer habit that consists of adding just enough code to get rid of those pesky compiler warnings :)

    Having said that, I feel that something still should be done to address the proliferation of messages, because that too defeats the simplicity principle: as I have too many false positives, I give up on applying an "inbox zero" policy on the watchtower notifications...

    Here are some use cases that I think could be considered. First of all, as a business user, I need to separate internal systems from external ones. Internal systems can be either legacy ones, or do not support strong passwords (for example just a PIN number. Moreover, they sometimes use the same global user account with the same password, and can sometimes lack SSL, all of this because they are secured by other means (network of physical for example).

    As for external systems, you can also have situations where weak of reused passwords are the norm. Of course, that doesn't mean that it's a good thing, but sometimes you are forced into those situations. I would personally flog developers who set hard limits on password size for example: some sites require you to choose a 6 characters password, or worse, a 6 digit pin. Some go as high as 10 characters...

    So what do I do? I'll be happy to set big fat complex passwords whenever I can, but for those edge cases on which I have no control, it's a nagging reminder that despite my best efforts I'm still not the supreme leader of the universe, thus having the power to have all the IT industry get their crap together and let users set the complex passwords they long for.

    I have no solution as I'm not aware of your code dependencies and your roadmap, not will I send you an ultimatum because the joke would be on me, trying to find a better solution than 1password. I've been there, and I'm happy to have settled with your product (and even pushing my friends and colleagues to use it). But I can humbly share a few ideas on this.

    • Have certain vaults be excluded from the watchtower gaze. A bit extreme and would require appropriate caveats, but would provide a global solution for those special cases
    • Have a "secured by other means" toggle on certain items. Yes, the password is 1234 but it's an off-network piece of equipment in a locked room situation.
    • Have linked items: yes, I reuse the password but it's my company account so...
    • Have a "this website has been coded by drunk monkeys": I cannot set a strong password, but please remind me to either choose another provider for this service or harass the support team until they change their policy on passwords.

    And in any case, keep up the good work, and thanks for your time.

  • brentybrenty

    Team Member
    edited August 9

    Yep. We're in agreement that something needs to be done. We just don't want to slap a bandaid on something that ultimately impacts all 1Password users' ability to keep up with security issues affecting them. A quick cure can easily be worse than the disease. Also, a lot of the requests we get are very platform-centric, yet people are using 1Password pretty much everywhere. As an example, if we make any of the changes you suggest in 1Password for Mac, that's work that benefits no one on Windows, Android, etc. (though we could probably share some code with iOS).We need a solution that benefits those all our other apps. So we're working behind the scenes on some changes to give us more flexibility with Watchtower, with cross-platform in mind. I know that doesn't help you or anyone else today, but in the past you would have had to check for vulnerabilities yourself; so, while imperfect, there has been progress and will continue to be. It just takes time and effort to come up with good solutions that will scale well (in multiple senses) and not need to be thrown out in short order, potentially breaking people's workflows in the process. Thanks for taking the time to share your feedback on this! :)

  • ryansebizryansebiz Junior Member

    I'd love a way to disable/hide the "Reused Password" banner.

  • brentybrenty

    Team Member

    Thanks for letting us know. Frankly, you're not alone. Hopefully we'll be able to come up with a good solution that scales so it benefits all 1Password users, without making people miss important notices. Cheers! :)

Leave a Comment

BoldItalicStrikethroughOrdered listUnordered list
Emoji
Image
Align leftAlign centerAlign rightToggle HTML viewToggle full pageToggle lights
Drop image/file