Touch ID stops working after a while

SystemSystem

Team Member
in Mac
This discussion was created from comments split from: Touch ID on Macbook Pro not working after upgrade to 1P7.
«1

Comments

  • Hi, I'm having problems too. I'm with 1p 7 latest version and Sierra 10.12.6 latest version.
    Just upgraded from 1p6 to 1p7.
    Sometimes works, then it stops working.
    I associate the problem with having chrome extension 1pX.
    I don't use keychains, other than to store my certificates. I don't mess with the keychain.

    What should I do?

  • ag_anaag_ana

    Team Member

    Hi @anprieto!

    Sometimes works, then it stops working.

    Can you please elaborate on what happens exactly when this stops working?

  • I only get the possibility of entering the master password.

  • ag_anaag_ana

    Team Member

    Does this normally happen after an operating system update or a reboot @anprieto?

  • Nope. Today I removed the check for allowing touch id in the app, restarted the app, then rechecked it. It worked. After 1h or so, when I tried to use 1P again, it did not. I could only enter master password

  • I now restarted the computer and it's working. This is driving me crazy.
    Same computer, same OS as with 1password 6, so nothing to to with an upgrade in Mac OS.

  • brentybrenty

    Team Member

    @anprieto: Did you migrate your data on the Mac from another computer or Time Machine originally? That's what this thread is about.

  • Hi brenty, no, I did not migrate anything.
    This thread is titled ''Touch ID on Macbook Pro not working after upgrade to 1P7', which is what happened to me. Where should I go with my problem?

  • brentybrenty

    Team Member

    @anprieto: I'll split you off into a separate thread. Can you tell me the specifics of your setup, and walk me through the steps you took leading up to the issue?

  • Hi brenty, I explained it above. It's pretty simple, it stops working after a while.
    I still don't understand why this is not the thread, but you are the expert, so go ahead.

  • brentybrenty

    Team Member

    @anprieto: I guess that's where I'm confused. "Sometimes works, then it stops working" unfortunately doesn't tell me much, so I was hoping for more specifics about that, and about the steps leading up to when you first started experiencing that. I've only got the information you provide, so I'm at a bit of a disadvantage here. Thanks for bearing with me. :)

    You've got macOS Sierra 10.12.6. You say "latest version", but that was released nearly two years ago so I'm not so sure. You haven't given version numbers for 1Password yet, and that would be helpful as well. You also said "Same computer, same OS", but I'm not sure what you're comparing it to exactly. Are there multiple Macs involved here?

    Ultimately we don't have any control over Touch ID, so you may need to get help from Apple. But it may be possible to reset it and get it working by disabling Touch ID completely in 1Password and on your Mac, removing all the fingerprints, restarting, and then setting it up from scratch in System Preferences again. I may be able to suggest something else based on additional information, but at the end of the day all 1Password is doing is asking macOS to store a secret and then later asking to retrieve it, and all of that is dependent on the OS and hardware.

  • Hi, sorry. Let me explain...
    10.12.6 is the latest Sierra. I have not upgraded to High Sierra.
    By latest version of 1P.7, it is that, no beta but it is the latest.
    By sometimes it works sometimes does not... It is that. When I do a change in config regarding touch I'd, or reinstall the the app, it works, then after sometime, cannot say if the same day or 1 day later, I try to open 1p, and it requests the master password.
    With 1p6, this never happened. Touchid always worked.
    By the way, when it works, it opens slightly slower than with 1p6. It must be half a second but still annoying.
    Hope this helps

  • LarsLars Junior Member

    Team Member

    @anprieto - I'm sorry for the continued trouble, but I'm not quite sure what could be causing this. We've had no other widespread reports of Touch ID issues with macOS 10.12 (“Sierra”), so I'd say it isn't likely to be an issue of compatibility that's cropped up recently between 1Password for Mac and Sierra. As brenty mentioned, we have no control over Touch ID -- we're simply calling a system process that can function as a stand-in (if you allow it) for entering your Master Password. If Touch ID is timing out for you, you may want to check your Touch ID settings themselves, re-map your saved fingerprints or try the troubleshooting steps suggested by Apple. It's also worth mentioning that there are not one but two newer versions of macOS (High Sierra and Mojave) that don't seem to exhibit the problem you're seeing either. As a security company, we recommend users stay on the most-current versions of all critical software, including browsers and OS as well as 1Password, for both security and compatibility reasons.

  • Thanks.
    I dont think this is an apple problem. This was not happening with 1password 6, so it must be something from 1p7.

  • LarsLars Junior Member

    Team Member

    @anprieto - the way forward on this will be to install macOS 10.14 (“Mojave”) (or at least macOS 10.13 (“High Sierra”)), as neither of those OSes demonstrate the issue you're having. To be clear, neither does macOS 10.12 (“Sierra”) from what we know about it, though of course we've done less extensive testing on the older OSes, since our recommendation for all users is to keep updated, and comparatively few users are still on macOS 10.12 (“Sierra”).

    However, if you'd like to re-check/verify your assertion, you can Quit 1Password 7 Completely by typing ^⌥⌘Q (or just holding down the Control and Option keys as you choose Quit from the 1Password menu), then delete the 1Password 7 for Mac app. Don't use any app cleaners or uninstallers to do this, as these programs can remove more data than we want them to. Just drag the 1Password app to the Trash, then restart your Mac. After you've done that, visit our downloads page to grab a fresh copy of 1Password 6 for Mac and run the installer. If you get old data in 1Password 6 for Mac after re-installing, lock 1Password 6 and then click Help > Troubleshooting > Reset all 1Password data, then either sign into your 1password.com account when you re-launch it or choose whatever method of sync you use (iCloud, Dropbox) at first-run. You'll be able to test it then, since nothing else will have changed on your Mac other than deleting 1Password 7 for Mac and re-installing 1Password 6 for Mac. Let us know what you discover!

  • brentybrenty

    Team Member
    edited May 13

    @anprieto: However, it's worth noting that 1Password 7 is using newer Touch ID APIs than we were at the time of 1Password 6, to take advantage of Apple's Secure Enclave hardware. So it is possible you'll see a difference due to that (certainly I suspect that's why there's a slightly longer delay). And, as Lars mentioned, our focus for testing is on current, supported OSes; so it's entirely possible that older ones are less reliable in this regard and/or simply don't fully support the new stuff. Again, not something we can fix for you, but maybe that offers some insight into why you'd have a different experience on an outdated OS. Put another way, any improvements that are made will be in the area of the current versions of macOS and 1Password, so it's best to stay up to date with both, for a number of reasons.

  • Upgrading os implies a lot of problems that I won't go into now. Supporting a os 2 yrs old doesn't seem like too much to ask for, for those who you have lured into changing from license to account and ongoing payment. Truth is now I pay an account, and it works worse for me.

  • LarsLars Junior Member

    Team Member

    @anprieto - I'm sorry things aren't working as you remember them working previously. However, that's not to do with whether you're using a 1password.com account or standalone data. You can, as I mentioned above, uninstall 1Password 7 for Mac and re-install 1Password 6 for Mac and continue using your 1password.com account.

  • adam1991adam1991
    edited May 17

    Came here looking for this, and found it exactly.

    2017 MacBook Pro, 10.12.6. 1Password.com account. All was well until...well, not horribly long ago, but a little while ago.

    It may have been when I upgraded to 1P version 7, now that I think about it. My symptoms are exactly as what anprieto describes. 1P works fine with fingerprint, until all of a sudden it doesn't. It might work for a long while, I invoke it for a web site and it works, then not give me the option 5 seconds later for the next web site. There's no rhyme or reason to it.

    The first time it happened, I eventually went into preferences and turned off fingerprint and turned it back on, and all was well for a long while. And then all of a sudden I invoked 1P and again it acted like it didn't even know fingerprint was an option.

    Just a few moments ago it happened again. I went into 1P directly and checked for updates. I was on 7.2.6, and it showed that 7.2.7 was available (but didn't mention this problem). I let it update, re-launched it, and on re-launch it asked me for my fingerprint--without my doing a thing. So at some base level it retained knowledge of fingerprint access and that knowledge survived (a) after 7.2.6 suddenly didn't give me the option, (b) after I pressed the Upgrade button, and (c) I relaunched 1P.

    To be clear, when this happens it happens out of the blue AND the 1P interface is missing the fingerprint icon and gives every indication that fingerprint isn't and never was an option.

    Now I wonder if merely quitting 1P and relaunching it is the answer.

    Also to be clear, this has happened to me 3 times--again, probably since I upgraded to version 7 two or three months ago. I will say with some emphasis that this never happened under 1P version 6.

    And no, for many reasons upgrading the OS is not an answer. I'm with anprieto on this. If "change your OS" is the answer, then 1P isn't ready for professionals in the world.

  • brentybrenty

    Team Member

    @adam1991: Can you send me a screenshot the next time it happens?

    To be clear, "Upgrade your OS" is going to be the answer more generally because 1) that's the only way you'll get any bug fixes with OS features, 2) that's the only way you'll get important security fixes for known vulnerabilities, and 3) we're a security company. Put another way, there is a newer version available that doesn’t seem to have this issue, among others. But I would like to get a better idea of what's happening in case it helps you or anyone else.

  • adam1991adam1991
    edited May 18

    I will send you a screenshot the next time it happens. Frankly, I think I can generate a screenshot of what it looks like when it happens--just go into prefs and turn off fingerprint.

    Yup. That's exactly what it looks like. Turn off Touch ID in prefs, and the login screen I get is exactly the login screen I see when this problem happens. But, in prefs Touch ID is still checked. Toggling that off, and then immediately back on, gives me Touch ID functionality again when I hit cmd-\ the next time. And of course, hitting the upgrade button that causes 1P to exit, and then my re-launching it, caused Touch ID to work again.

    I don't know what else to tell you, to give you a better idea of what's happening. It just...happens. Or that's how it appears, anyway.

    My only thought right now is that this could be related to the two-week time limit on Touch ID. In the past with version 6, all I had to do was enter my password manually--and Touch ID was enabled again. I could not tell you if I ever saw that same successful behavior with 1P v7. Given that I just recently upgraded to v7, maybe that's it. Maybe after re-enabling with the actual password, Touch ID is not being made available. Toggle Touch ID in prefs, or quit and re-open 1P (and of course re-enter the password), and fingerprint access shows up. ???

    I will look for this. I will set the timeout to something stupid short and watch the behavior.

  • brentybrenty

    Team Member

    @adam1991: I appreciate it! I'd rather get info on the real thing rather than having you fake it. ;)

    The difficulty is that Touch ID is actually fairly simple (from a 3rd party app perspective anyway): we make a call to the OS and it gives us a yes or no as to whether Touch ID is available, and then again if authentication is successful (or not). We don't have any other information as far as why one way or the other. But if you can narrow down steps to reproduce, that could help us work with Apple on it. The tough thing is that in that case you still wouldn't see any benefit to any future improvements without upgrading, and it may very well be that whatever is causing this has already been addressed in more recent versions of macOS. So I don't want to give you false hope. :blush:

  • I will say, I have zero other issues with Touch ID. From an OS standpoint It Just Works.

  • ag_anaag_ana

    Team Member

    @adam1991: Thank you for the confirmation!

    I would indeed expect TouchID to work everywhere else at the OS level, since your OS didn't change. But apps that make use of OS features could behave differently if those are kept updated, but the OS isn't.

  • brentybrenty

    Team Member

    @adam1991: Indeed, to elaborate on that, we've heard something similar to that from time to time since the release of 1Password 7 since, as I mentioned above, we're taking advantage of Apple's latest tools to integrate Touch ID into the current version of 1Password, which utilizes their Secure Enclave (hardware), not just the Keychain (software). Though some might exist, I'm not aware of any other apps that use this. Most things added support for Touch ID that only used the Keychain to begin with, and haven't made the switch. It's probably not worth the effort for developers of apps that are not security-focused but use Touch ID mainly for convenience, or because their users have requested the feature. But for obvious reasons we tend to jump at the chance to use newer methods that offer increased security benefit, even if relatively small, whenever feasible, since that's our focus with 1Password. So people who encountered an entirely different issue (as in the previous discussion about a mismatch due to migrating Keychain data from another Mac or backup) would understandably be frustrated that other apps (using only Keychain) worked with Touch ID when 1Password 7 did not (since it uses the Secure Enclave, and that relies on the data in the Keychain matching as well).

    I've been discussing this with another colleague, and this way of looking at it may help: the "Require Master Password" setting (Preferences > Security) is not "require if I haven't unlocked 1Password at all for this long", but rather "require Master Password if it's been longer than the selected time interval since I last entered my Master Password". It's also possible that the Touch ID state prompt was updated while your screen was locked but the main window was open, in which case the security server told us you can't use Touch ID. Switching away from 1Password and back again _should trigger it to refresh that state, and it would be helpful to confirm exactly what you're seeing -- hence the request for the screenshot.

    As an example scenario:

    1. The 1Password main window is open and locked
    2. Machine locks/sleeps
    3. You wake machine from sleep and see the OS lock screen
    4. 1Password is woken up and it updates its Touch ID state...
      If this happens before the OS is fully unlocked, the security server in the OS will always return a negative when we query for Touch ID unlock, or Touch ID at all. So there will be a series of error messages in the logs about being unable to talk to the security server while in the current "state".
    5. You then unlock the OS (or it finishes unlocking)
      You get to see your apps again, except 1Password was already told by the OS that Touch ID is a no-go, so it asks for your Master Password.

    @adam1991, @anprieto: So, in addition to a screenshot of what you're encountering, answers to the following questions may be helpful:

    a. Does this happen primarily or exclusively when the machine was locked/asleep?
    b. Does switching away from and back to 1Password result in any change?

  • I think I'm buying into this. Although:

    a) no. When it happened to me the other day (again, one of maybe three times since I upgraded to version 7 not long ago), it was no more than a minute after I had previously used touch ID successfully. Let me touch on that below.

    b) I don't know. I will have to try that should this happen again. I do know that quitting and re-launching it re-set the state of touch ID.

    But overall, what you say makes perfect sense.

    So something else just occurred to me, relating to (a) above. For a long long time I was at 1P v6. It worked, and all was well. For some reason fairly recently I moved to v7, and am now at 7.2.6.

    When I was at v6, I believe--although I can't prove--that it had a preference setting that I set on this laptop, such that after an hour of not using 1P it would lock and require master password or touch ID. When I upgraded to v7, I paid no attention to the preferences; I just started using it, and it behaved exactly as I expected.

    But now I look at the prefs for v7, and I don't see that preference. I do see "Lock after computer is idle for X minutes"; that is not checked. And as far as I know, it has nothing to do with the old preference that I did use. On a portable computer, no matter what, I wanted--and as far as I know, I implemented--the safety switch of "if it's been X minutes since I used 1P, lock 'er down". I would be using the computer the entire time, so it wasn't idle--but I wasn't using 1P, so indeed it locked down.

    And I do believe it's doing that now.

    I was going down the path of thinking that maybe that hour was up when things got confused. That's very possible. But if that preference is no longer there...is there something going on in migrating from v6 to v7? Is that preference still there and checked under the hood, even though it's not visible in the UI? Is it supposed to work that way even though it's not in the UI? Is it confusing things?

    I'll start paying very close attention to the wake from sleep situation, as I do open and close the machine regularly. I also switch user accounts very regularly, and it seems that would play into a similar scenario.

  • brentybrenty

    Team Member

    @adam1991: That's a really good question. I suppose it's possible that something got migrated from the previous version which should not have. The settings that are not under the "Touch ID" heading in Preferences > Security have no bearing on Touch ID behaviour, only locking in general, whether you're using Touch ID or not.

    The only settings that do affect Touch ID behaviour are the first two, which are to have Touch ID enabled at all, and how long it should be before you are required to enter your Master Password no matter what -- for example, after a week, regardless of how you've been using/unlocking 1Password, require the Master Password to be entered. So it's quite possible, in your description, that you'd be asked for your Master Password "after one hour" because in reality a week had passed since you initially enabled Touch ID -- all of this completely separate from everything else we've been discussing here.

    To phrase it a bit differently, when it's set to "one week", you should have to enter your Master Password after one week has passed no matter what else happens. You may need to enter it more due to a reboot, a Touch ID authentication failure, etc. But if you unlock using your Master Password after six days and 23 hours, you'd still need to do that again an hour later.

    Getting back to what I was describing in my last post, you're correct that switching user accounts would have the same effect. 1Password 7 has a number of very specific messages it shows depending on the context, which is why I'm hoping to get a screenshot. And then if you can provide some details on the specific instance and let me know if switching from/to 1Password again makes a difference, that should be instructive as well. I definitely appreciate that you may not have a definitive answer/sense for what you did in the hours (or potentially even weeks) leading up to the issue no matter what, but any additional details you can will help. Thanks! :)

  • @brenty to your questions:
    a) Still cannot find a replicable pattern.
    b) By switching you mean cmd-tab, change app and come back?? If so... no, no change at all. Once it stops showing the touch ID option, it stops forever.
    I have done tests as you suggest, keeping the 1password open but locked, go to sleep and back, wait a bit before I unlock the os....nothing (remember that before I went to sleep it was already offering me the touch id option), so when I came back, the same window, offering me touch id was still there. I Quit 1p, restart the app, still offers me the touch id.
    I have been trying to do some tests of restarting the computer, going to sleep and back, to see if it stops working... nothing.

    Once it's broken, the only thing it works is to deactivate Touch id option and then reactivate.

    For me this problem is VERY frequent, it may take 1 day before it breaks.

    I have not updated 1P to the new version, in order to keep things as they are to find the moment it breaks. I'll keep you posted.

  • @adam1991 by the way, thanks for the help-

  • brentybrenty

    Team Member
    edited May 19

    a) Still cannot find a replicable pattern.

    @anprieto: I'd rather know the specifics about how/when it's happening to you even if it's not something that can be reproduced at will. For now, please update (we are not going to be making changes in an outdated version), and let's focus on some specifics. The next time it happens, please take a screenshot and note the following:

    • If your Mac was locked/asleep at the time
    • If the main 1Password window was left open
    • If switching away from and back to 1Password

    And generate a diagnostics report immediately in case we need to look at the logs.

    Thanks!

Leave a Comment

BoldItalicStrikethroughOrdered listUnordered list
Emoji
Image
Align leftAlign centerAlign rightToggle HTML viewToggle full pageToggle lights
Drop image/file